Chris Paquin

AI, Virtualization, Containers, Infrastructure, Linux

Tag: rhel

  • A Simple Introduction to TCP Wrappers

    0993fb024232491eIn the world of Linux there are numerous ways that you can configure a Linux server to allow or deny access to a service, and while many people like to rely solely on Iptables, I wanted to take the opportunity to get my feet wet with TCP Wrappers. Note that this post is not meant to be the be-all end-all post on tcp wrappers. I am not going to review each and every configuration option, and trust me there are quite a few. Rather this is going to be a simple post which explains how to use tcp wrappers.

    TCP Wrappers Configuration Files

    First off you need to know that there are two configuration files for TCP wrappers. They are listed below.

    #/etc/hosts.allow

    #/etc/hosts.deny

    To determine if a remote host is allowed to access a local service, the hosts.allow file referenced first, then the hosts.deny is referenced. Each file is read from the top down.

    Rules in the hosts.allow take precedence over rules in the hosts.deny. Access will be granted for rules in the /etc/hosts.allow, and denied for rules in the /etc/hosts.deny ( note that this is not always the case, however this is how most people use tcpwrappers)

    Basic rules are configured using the format below

    <daemon list> : <client list> [: <option> : <option> ]

    Below is a very simple and basic rule for sshd. In this example we want to allow all hosts in the domain fatmin.com to have access to sshd, and we want to deny sshd access to everyone else.

    So in the /etc/hosts.allow

    sshd : *.fatmin.com

    and in /etc/hosts.deny

    sshd: ALL

    Creating Rule Matching Patterns

    Ok, so what I have shown you above is a very simple example using a very simple matching rule, however there are actually quite a few ways to format a rule lets review a few of the more common ones that you might see.

    Match by Hostname – All hosts below in the domain fatmin.com matched. Vsftpd is specified service

    vsftpd: .fatmin.com

    Match by IP address – All hosts in 192.168.x.x are matched. Vsftpd is specified service

    vsftpd: 192.168.

    Match by IP/Subnet – All hosts in 192.168.0.0/24 are matched. Vsftpd is specified service

    vsftpd: 192.168.0.0/255.255.255.0

    Match All – All Services and Hosts are matched.

    ALL : ALL

    What Services Use TCP Wrappers

    Initially TCP Wrapper only “wrapped” services that were configured as part of inet.d, or xinet.d, but over time more and more processes have been configured to use librap.so. The example below shows how see if a daemon used libwrap, and can therefore be allowed or blocked via tcpwrappers.

    Below we are locating the sshd binary and seeing if it uses libwrap. Which is does.

    # whereis sshd

    # ldd /usr/sbin/sshd | grep wrap
    libwrap.so.0 => /lib64/libwrap.so.0 (0x00007f03f005d000)

    Below we are locating the smbd binary and seeing if it uses libwrap. Which is does not.

    # whereis smbd

    # ldd /usr/sbin/smbd | grep wrap

    Instead of checking one service at a time you can run the command below. Note that if a service is not installed, it will not show up

    # strings -f /usr/sbin/* |grep hosts_access
    /usr/sbin/rpc.mountd: hosts_access
    /usr/sbin/sshd: hosts_access
    /usr/sbin/tcpd: hosts_access_verbose
    /usr/sbin/tcpdmatch: hosts_access_verbose
    /usr/sbin/vsftpd: hosts_access
    /usr/sbin/xinetd: hosts_access

    Note that httpd, samba (smb) and nfs are not configured by default to use tcpwrappers (however it can be done but that is outside the scope of this post)

    Configuration Examples

    Below are are few more configuration examples that might be useful for reference.

    Allow tftpd access from fatmin, and block everyone else.

    #/etc/hosts.allow

    in.tftpd : .fatmin.com

    #/etc/hosts.deny

    in.tftpd : .ALL

    Allow SSH access from fatmin.com, but block from example.com. Also send log to sshd.log

    #/etc/hosts.allow

    sshd: .fatmin.com

    #/etc/hosts.deny

    sshd : .example.com  \
    : spawn /bin/echo `/bin/date` access denied>>/var/log/sshd.log \
    : deny

    Block tfpd access for all of fatmin.com except for server1.fatmin.com. Note that there is no corresponding hosts.allow entry needed.

    #/etc/hosts.deny

    tftpd .fatmin.com EXCEPT server1.fatmin.com

  • RHEL6 – Configuring Apache with TLS/SSL Encryption

    Henery-Hawk-iconDon’t let the acronyms and the word “Encryption” scare you, its actually very easy to enable TLS/SSL in Apache. So basically it sounds more complicated than it is — like these last two sentences for example.

    First you should probably know what TLS and SSL are. Well according to Wikipedia …”Transport Layer Security (TLS) and its predecessor, Secure Sockets Layer (SSL), are cryptographic protocols that provide communication security over the internet”

    I am going to assume here that you have already installed and started Apache, I will also assume that you have SELinux configured properly, as well as IPTables.

    So next step is to install mod_ssl

    # yum -y install mod_ssl

    Once install a new config file, called ssl.conf will be installed in /var/www/html/conf.d. Inside that file are a couple of configuration items that you need to be aware of.

    # Point SSLCertificateFile at a PEM encoded certificate.  If
    SSLCertificateFile /etc/pki/tls/certs/localhost.crt
    SSLCertificateKeyFile /etc/pki/tls/private/localhost.key

    If you are replacing the test cert with a signed one you will need to drop it in /etc/pki/tls/certs and modify the lines in the section above to point to your new cert and your new key file.

    Now restart apache.

  • RHEL6 – SELinux Troubleshooting II: Electric Boogaloo

    Little_Miss_Trouble_by_Percyfan94So a good while back I posted an article on how to troubleshoot SELinux violations and after reviewing that article as part of a troubleshooting exercise, I realized that I left out a few details. Needless to say my original article was not as clear as it should be. Anyway I wanted to use up a few more bytes of the internet to clarify.

    When the package setroubleshoot-server is installed, SELinux violations will be sent to /var/log/messages, which makes it fairly easy to troubleshoot SELinux issues.

    So first lets install setroubleshoot and all its parts

    # yum install setroubleshoot*

    In my case on RHEL6, the following packages were installed

    setroubleshoot-plugins-3.0.40-1.el6.noarch
    setroubleshoot-server-3.0.47-3.el6_3.x86_64
    setroubleshoot-3.0.47-3.el6_3.x86_64

    Note that the setroubleshoot-server is the one that you need to troubleshoot via the command line.

    Now lets generate a violation. In this case I am just dropping a file with the wrong selinux context into /var/www/html and am trying to access it.

    # touch /root/file3 && cp /root/index.html /var/www/html/file3

    Check the context if you must to make sure that its not correct for httpd content. In this case you can see that it is not.

    # ls -lZ /var/www/html/file3
    -rwxrwxrwx. root root system_u:object_r:admin_home_t:s0 /var/www/html/file3

    Now start Apache and try to access the file via elinks or a browser. You will get a Forbidden error, which I have omitted below.

    # elinks -dump http://localhost/file3

    Note that you may need to restart auditd if your message does not show up in the messages file.

    Aug 11 17:08:39 vfatmin01 setroubleshoot: SELinux is preventing /usr/sbin/httpd from getattr access on the file /var/www/html/file3. For complete SELinux messages. run sealert -l 5a413022-af89-4222-b055-0cc1edc4bbad

    Note: You will also find a the same error in /var/log/audit/audit.log, albeit in a bit less friendly format.

    type=AVC msg=audit(1344719319.890:7196): avc:  denied  { getattr } for  pid=6765 comm=”httpd” path=”/var/www/html/file3″ dev=dm-1 ino=656718 scontext=unconfined_u:system_r:httpd_t:s0 tcontext=unconfined_u:object_r:admin_home_t:s0 tclass=file

    Anyway back to the error from the messages file. At the end of the error you are shown the UUID of the error and the sealert command to run to get more information on the error.

    # sealert -l 5a413022-af89-4222-b055-0cc1edc4bbad

    Output below:

    SELinux is preventing /usr/sbin/httpd from getattr access on the file /var/www/html/file3.

    *****  Plugin restorecon (99.5 confidence) suggests  *************************

    If you want to fix the label.
    /var/www/html/file3 default label should be httpd_sys_content_t.
    Then you can run restorecon.
    Do
    # /sbin/restorecon -v /var/www/html/file3

    Wow, sealert actually tells you why the file is being blocked and the commands that you should run to fix the problem. Nice!

  • RHEL6 – Using htpasswd to Create a Secure Apache Directory

    Bank-vaultThe process of setting up a simple password protected web directory on an Apache server is rather easy. The simplest way to accomplish this task is to use flat-file user authentication. Disclaimer, I am not claiming that the directions below are the most complete, or the most secure. However they work and are probably the most simple.

    The first thing that you need to do is to create a "secret" directory. In this instance my web root is /var/www2/html, so I will create my secure directory under that tree.

    #mkdir /var/www2/html/secret

    Now lets create an index.html inside our secret directory for the purpose of testing.

    #echo "Secret Directory Working" > /var/www2/html/secret/index.html

    This way we have something to look at when we actually are able to get this working correctly.

    Now using the htpasswd command we need to create an htpasswd file and add a user that will have access to our top secret directory. Note that you should not create this file inside your web-root.

    #htpasswd -c /etc/httpd/.htpasswd fatmin

    In the example above the "-c" option creates our htpasswd file, fatmin is the user that we want to grant access to. You will be prompted for a password.

    Now add the following stanza to your httpd.conf. Note that AuthName is the text that will display when the user is prompted for a password. AuthUserFile is the location of the password file. Basic is pretty much the only auth method that anyone uses.

    <Directory /var/www2/html/secret>
    AuthName "Secret Directory"
    AuthType basic
    AuthUserFile /etc/httpd/.htpasswd
    Require valid-user
    </Directory>

    Now restart apache, and when you navigate to http://www.mysite.com/secret you should be prompted for a userid and password.

     

     

  • RHEL6 -Configuring Apache Name-Based Virtual Hosts the Quick and Easy Way

    Ghost_with_a_cellephone_cartoon_TVirtual Hosts allow you to serve up content for more then one website from one Apache instance. In named-based virtual hosting, multiple web sites all point back to one server with one ip address. Apache itself determines which site to serve up depening on the hostname used to reach the site.

    Honestly is sounds more exciting than it is.

    Note that before we get started you will need to have a DNS entry for both the domain names that you plan to use. In my case my primary webserver is my hostname and the virtual server is a CNAME.

    Install Apache

    First lets install and configure Apache to start at boot.

    #  yum -y  install httpd && chkconfig httpd on && service httpd start

    Configure Selinux

    Ok lets make a directory for our virtual server under /var/www2

    In order to keep things as simple as possible, I am going to configure SELinux now.  As you can see the original web directory of /var/www/ has a different context then our new directory of /var/www2

    # ls -dZ /var/www
    drwxr-xr-x. root root system_u:object_r:httpd_sys_content_t:s0 /var/www

    # ls -dZ /var/www2
    drwxr-xr-x. root root unconfined_u:object_r:var_t:s0   /var/www2

    So now we must change the context for /var/www2 to match /var/www

    # semanage fcontext -a -t httpd_sys_content_t ‘ /var/www2

    # restorecon -Rv ‘/var/www2

    Ok now thats we have done that lets create some content for our webservers

    For testing purposes, I am going to create an index.html in /var/www/html  that contains the text “fatmin01.mydomain”. This will be useful for testing.

    Now lets create the directory /var/www2 for our second virtual host. Inside this directory we create an index.html that contains the text “fatmin02.mydomain”.

    Because of the fact that we configured SELinux first, any file of directory created under /var/www2 will inherit the SELinux context of its parent directory. What does this mean? Well in a nut shell we dont have to worry about the permissions on our new index.html that we created above.

    Configure Apache

    Now we etc /etc/http/conf/httpd.conf. Make sure that the following line is uncommented. Its near the bottom of the file.

    NameVirtualHost *:80

    Now add the two sections below. One fo each virtual server.

    <VirtualHost *:80>
    ServerName fatmin01.mydomain
    DocumentRoot /var/www/html
    </VirtualHost>

    <VirtualHost *:80>
    ServerName fatmin02.mydomain
    DocumentRoot /var/www2/html
    </VirtualHost>

    Boom – Now restart apache and test.

  • RHEL6 – Display and Modify SELinux Modes

    There are three basic commands that you can use to display and modify SELinux modes. They are as follows

    • getenforce

    • setenforce

    • sestatus

    The first two are installed as part of the package, libselinux-utils. The sestatus is installed as part of policycoreutils.

    Setenforce will enable or disable SELinux temporarily. Use 0 to disable and 1 to enable as shown below.

    #setenforce 0
    #setenforce 1

    If you need need your change to be persistent across reboots edit /etc/selinux/config.

    # This file controls the state of SELinux on the system.
    # SELINUX= can take one of these three values:
    #       enforcing - SELinux security policy is enforced.
    #       permissive - SELinux prints warnings instead of enforcing.
    #       disabled - SELinux is fully disabled.
    SELINUX=enforcing
    # SELINUXTYPE= type of policy in use. Possible values are:
    #       targeted - Only targeted network daemons are protected.
    #       strict - Full SELinux protection.
    SELINUXTYPE=targeted

    Getenforce is used to query your SELinux Status as seen below

    [root@vpaquin01 selinux]# getenforce 
    Enforcing

    Sestatus give you the same information as getenforce but in a bit more detail

    [root@vpaquin01 selinux]# /usr/sbin/sestatus
    SELinux status:                 enabled
    SELinuxfs mount:                /selinux
    Current mode:                   enforcing
    Mode from config file:          enforcing
    Policy version:                 24
    Policy from config file:        targeted