Migrating and transfering gitolite to a new server

I am going to assume you have already installed gitolite on two servers (if you haven't, check out my guide on installing gitolite). This post will outline how you will move your repositories from one server to your new one.

The server side

1. You can edit some of the configuration files stored in the home directory of the gitolite user. You only have to do this step if you have an unusual set-up; it should work fine if you did a default install.
2. Copy the contents of your repositories folder to the new server (except gitolite-admin; we will do this at a later stage). Use either the commands cp or scp. For instance:
   

   scp -r repo.git/ root@192.168.0.1:/var/lib/gitolite/repositories/

3. Change the owner and group of the copied repositories:
   

   chown -R gitolite:gitolite repo.git/

4. Clone the gitolite configuration repository on your administration machine:
   

   git clone gitolite@192.168.0.1:gitolite-admin.git

5. Add the keys and configuration files from your old repository and place them into your new repository. Do a commit and then a push:
   

   git add .
   git commit -as
   git push

6. The server is now set up and ready to use! Optional: The guide quoted that you may need to run gl-setup again once the repositories have been copied across, but I didn't need to. You may want to do that step....

The client side

To point your git repository to the new server (so you don't have to reconfigure your IDE or scripts) just run the following commands:

git remote rename origin old
git remote add origin git@192.168.0.1:repo.git
git remote -v
git remote rm old

Further Reading:

• Stackoverflow on transferring gitolite to another server
• Old official documentation on moving your gitolite server

Installing gitolite in CentOS 6

Gitolite is an management service that sits on top of git. It helps restrict users to certain projects (and what they can do on those projects). In this post we will install gitolite in a CentOS 6 environment.

1. First we need to enable the EPEL repository. You could download and install gitolite directly, but I prefer to manage everything through the package manager for auditing purposes.
   

   wget http://dl.fedoraproject.org/pub/epel/6/i386/epel-release-6-7.noarch.rpm
   rpm -ivh ./epel-release-6-7.noarch.rpm

2. Install gitolite (it will most likely install a variety of dependencies):
   

   yum install gitlolite

3. If this is a brand new gitolite installation you will need to create a public SSH key on the account you will be using to administer your gitolite installation. The creation of these keys are outside the scope of this documentation. Once the key pair has been created, copy the public version to a common place where gitolite can access it (like temp). Use the command cp or scp to acheive this.
4. Rename your copied public key with some sort of identifier. Gitolite uses the name of your keys to determine access.
5. Log in as the gitolite user:
   

   su - gitolite

6. Initialize your gitolite service with the key:
   

   gl-setup -q /tmp/user.pub

7. Now you can use gitolite!
   

   ssh gitolite@192.168.0.1 info
   git clone gitolite@192.168.0.1:gitolite-admin.git

Further Reading:

• Quick 'n' Dirty start-up guide to gitolite
• Official documentation

Setting up a virtual guest on a headless CentOS 6 host

This guide assumes you have at least followed my guides for setting up the host (either my 6.2 or 6.3 version) and have set up the bridge networking interface. You optionally can see my other posts such as auditing your software installs, hardening your accounts, network hardening, services hardening and clearing out orphaned packages.

Note that if you followed my guide for services hardening you may want to turn the messagebus daemon back on. If the avahi daemon and zeroconf is disabled, you will need to edit /etc/libvirt/libvirtd.conf with the following:

mdns_adv=0

The rest of the guide should apply to virtually everyone else:

1. Edit /etc/libvirt/qemu.conf to allow the VNC server to listen on all ports:
   

   vnc_listen='0.0.0.0'

2. Restart the libvirt daemon:
   

   service libvirtd restart

3. If you don't already have one create the LVM partition that we will be our VM's hard-disk:
   

   lvcreate -L20G -n lv_vm1 VolGroup

4. Poke a hole in the firewall so we can connect via VNC to the server. You can choose any port you wish, but in this case we will be using port 7601. Make sure you change the network to match your own settings! Edit /etc/sysconfig/iptables

   -A INPUT -m --state NEW -s 192.168.0.0/24 -m tcp -p tcp --dport 7601 -j ACCEPT

   
   
5. Restart the firewall:
   

   service iptables restart

6. Run the installation command:
   

   virt-install -n vm1 -r 512 --vcpus=2 --disk path=/dev/VolGroup/lv_vm1 -c /path/to/disk.iso -v --accelerate -w bridge:br0 --vnc --vncport=7601 --noautoconsole --os-type linux --osvariant rhel6

7. Now use a VNC client to connect to your server by connecting to the firewall hole we created earlier. Follow through with the rest of the installation process.
8. To start and stop your VM just use the virsh command. The VM has been configured to use port 7601 for VNC, so you can always connect to it using that port unless you close it.
   

   virsh start vm1 

Further reading

• This excellent series from 'How to forge'. Part 1 (Configuration), Part 2 (Connecting to Guest), Part 3 (Creating Guest with GUI), Part 4 (Command line tools), and Part 5 (LVM based guests).
• CentOS documentation on using virt-install
• This excellent guide by Blog Normation
• A beginners guide to LVM from How to Forge
• The isborken blog on headless VM management
• Allan Fied's blog on the topic

Bridge Networking in CentOS 6.3

Bridge networking is a useful technique to allow Virtual Guests to access your networking hardware. This guide was written in mind for CentOS 6.3 but should be applicable to other Linux versions (with modifications).

1. Copy the file /etc/sysconfig/networking-scripts/ifcfg-eth0 as br0

   cp /etc/sysconfig/networking-scripts/ifcfg-eth0 /etc/sysconfig/networking-scripts/ifcfg-br0

   
   
2. Edit the file /etc/sysconfig/networking-scripts/ifcfg-eth0 and add the line:
   

   BRIDGE=br0

   You can also delete the lines:
   

   BOOTPROTO
   IPADDR
   GATEWAY
   DNS1
   DNS2

3. Edit the file /etc/sysconfig/networking-scripts/ifcfg-br0 and edit the lines:
   

   DEVICE=br0
   TYPE=Bridge

   You can also delete the lines:
   

   HWADDR
   UUID

4. Restart your network:
   

   service network restart

    

References

• Howtoforge.com guide to Virtualisation with KVM
• Cyberciti post on KVM Bridging
• The isborken blog on setting up a headless KVM

SSH Hardening on CentOS 6.3

This is a follow on post from my guide to installing CentOS 6.2 (or you can read my updated 6.3 version). You can see my other posts such as auditing your software installs, hardening your accounts, network hardening, services hardening and clearing out orphaned packages.

This post outlines how you can harden your SSH server.

1. Strengthen your IP table firewall rules by editing /etc/sysconfig/iptables and adding or changing the line (NOTE: Any old SSH rule will be using port 22; change it accordingly):
   

   -A INPUT -m state --state NEW -s network/mask -p tcp --dport 4444 -j ACCEPT

   where network/mask is replaced with your actual network and mask values i.e 10.0.0.0/24
2. Since SSH uses the TCP wrappers library we will need to allow the service in /etc/hosts.allow

   sshd: 10.0.0.

   
   
3. Edit /etc/ssh/sshd_config with the following changes:
   

   # Use Port 4444 instead of Port 22
   Port 4444
   
   # Ensure we use Protocol 2 by default
   Protocol 2
   
   # Set idle timeouts (15 minutes)
   ClientAliveInterval 900
   ClientAliveCountMax 0
   
   # Disable rhost behaviour
   IgnoreRhosts yes
   
   # Do not trust other hosts
   HostbasedAuthentication no
   
   # Do not allow root logins
   PermitRootLogin no
   
   # Do not allow empty passwords
   PermitEmptyPasswords no
   
   #Disable environment alteration
   PermitUserEnvironment no
   
   #Disable X11 forwarding
   X11Forwarding no
   
   # Disable TCP forwarding
   AllowTCPForwarding no
   
   # Log level
   LogLevel INFO

4. Restart everything
   
   

   service sshd restart
   service iptables restart
   service network restart

References

• Red Hat Linux 5 Hardening Tips - National Security Agency
• Guide to the secure configuration of Red Hat Linux 5 - National Security Agency
• CentOS wiki on hardening the OS
• This guide from sysadminwiki
• The security nut blog

Setting up a CentOS 6 server: Services Hardening

This is a follow on post from my guide to installing CentOS 6.2 (or you can read my updated 6.3 version). You can see my other posts such as auditing your software installs, hardening your accounts, network hardening and clearing out orphaned packages.

This guide outlines how to cut down on unnecessary services so that you have a lean and mean machine.

1. List all the services running on your machine with the following command:
   

   chkconfig --list | grep :on

    
2.  Go through the list and select packages to disable or remove. For instance:
   

   chkconfig mdmonitor off
   chkconfig smartd off
   chkconfig messagebus off
   chkconfig haldaemon off
   chkconfig cups off
   chkconfig atd off
   chkconfig kdump off

3. If you do not know what a service is or does, just run:
   

   rpm -qf /etc/init.d/<service_name>

   
   Then run:
   

   rpm -qi <rpm>

References

• Red Hat Linux 5 Hardening Tips - National Security Agency
• Guide to the secure configuration of Red Hat Linux 5 - National Security Agency
• CentOS wiki on hardening the OS
• This guide from sysadminwiki

Setting up a CentOS 6 server: Network Hardening

This is a follow on post from my guide to installing CentOS 6.2 (or you can read my updated 6.3 version). You can see my other posts such as auditing your software installs, hardening your accounts, and clearing out orphaned packages.

This post will focus on hardening your networking infrastructure.

1. Disable wireless networking in the kernel by running the following loop:

for i in $(find /lib/modules/`uname -r`/kernel/drivers/net/wireless -name "*.ko" -type f ) ; do
echo blacklist $i >> /etc/modprobe.d/blacklist-wireless ; done

2. OPTIONAL: I also disabled the loading of bluetooth drivers by modifying the command loop. I replaced 'net/wireless' with 'bluetooth' and save it under a different filename.
3. Edit /etc/sysctl.conf to secure the network within the kernel.
   

   # Disables packet forwarding
   net.ipv4.ip_forward = 0
   
   # Source route verification
   net.ipv4.conf.all.rp_file = 1
   net.ipv4.conf.default.rp_file = 1
   
   # Don't accept source routing
   net.ipv4.conf.all.accept_source_route = 0
   net.ipv4.conf.default.accept_source_route = 0
   
   # Not a router, so do not send redirects
   net.ipv4.conf.all.send_redirects = 0
   net.ipv4.conf.default.send_redirects = 0
   
   # Not a router, so do not accept redirects
   net.ipv4.conf.all.accept_redirects = 0
   net.ipv4.conf.default.accept_redirects = 0
   net.ipv4.conf.all.secure_redirects = 0
   net.ipv4.conf.default.secure_redirects = 0
   
   # Log all packets with impossible addresses to the kernel log
   net.ipv4.conf.all.log_martians = 1
   
   # Ignore all ICMP ECHO and TIMESTAMP requests sent via broadcast/multicast
   # And protect against ICMP attacks
   net.ipv4.icmp_echo_ignore_broadcasts = 1
   net.ipv4.icmp_ignore_bogus_error_messages = 1
   
   # Protect against SYN flood attacks, and controls the use of SYN cookies
   net.ipv4.tcp_syncookies = 1
   net.ipv4.tcp_synack_retries = 2
   
   # This is not  a router so don't accept IPv6 solicitations
   net.ipv6.conf.all.router_solicitations = 0
   net.ipv6.conf.default.router_solicitations = 0
   
   # Do not accept IPv6 preferences from the router
   net.ipv6.conf.all.accept_ra_rtr_pref = 0
   net.ipv6.conf.default.accept_ra_rtr_pref = 0
   
   # Do not accept IPv6 prefix information from the router
   net.ipv6.conf.all.accept_ra_pinfo = 0
   net.ipv6.conf.default.accept_ra_pinfo = 0
   
   # Do not accept Hop Limit settings from router
   net.ipv6.conf.all.accept_ra_defrtr = 0
   net.ipv6.conf.default.accept_ra_defrtr = 0
   
   # Do not accept configuration from router
   net.ipv6.conf.all.autoconf = 0
   net.ipv6.conf.default.autoconf = 0
   
   # Not a router so don't sent IPv6 solicitations
   net.ipv6.conf.all.dad_transmits = 0
   net.ipv6.conf.default.dad_transmits = 0
   
   #Assign only one address per interface
   net.ipv6.conf.all.max_addresses = 1
   net.ipv6.conf.default.max_addresses = 1

4. OPTIONAL: While we are in /etc/sysctl.conf we may as well add a few hardening parameters for the kernel:
   

   # Controls System Request Debugging
   kernel.sysrq = 0
   
   # Append PID to core filename in a core dump (useful to determine what happened)
   kernel.core_users_pid = 1
   
   # Activate ExecShield
   kernel.exec-shield = 1
   kernel.randomize_va_space = 1

5. OPTIONAL: If you are going to use bridge interfaces then disable packet filtering. This way we will use the Virtual Machine's firewall rules instead of defining complex rules on the host.
   

   net.bridge.bridge_nf_call_ip6tables = 0
   net.bridge.bridge_nf_call_iptables = 0
   net.bridge.bridge_nf_call_arptables = 0

6. Disable automatic loading of IPv6 in the kernel by editing /etc/modprobe.d/dist.conf with:
   

   install ipv6 /bin/true

   While we are here, we will also disable the loading of uncommon networking protocols:
   

   install dccp /bin/true
   install sctp /bin/true
   install rds /bin/true
   install tipc /bin/true

7. Disable IPv6 interfaces by modifying /etc/sysconfig/network:
   

   NETWORKING_IPV6=no
   IPV6INIT=no
   IPV6_AUTOCONF=no

   You can also turn off avahi and zeroconf by adding the line:
   

   NOZEROCONF=yes

   (NOTE: If you are not going to use zeroconf you may as well uninstall it with yum remove avahi avahi-autoipd. The avahi-libs package is required by other programs so you may still need it)
8. Add the following line to every file that matches the pattern /etc/sysconfig/network-scripts/ifcfg-* with:
   

   IPV6INIT=no

9. Deny all TCP Wrapper services by default. Edit /etc/hosts.deny and enter the following as the only entry:
   

   ALL: ALL

10. OPTIONAL: If you wish, only allow TCP Wrapper services (like SSH) to run on the localhost loopback interface. Edit /etc/hosts.allow and enter the following:
    

    ALL: localhost

11. Edit IP tables (the firewall) to automatically drop packets that do not match a given rule. Edit the files /etc/sysconfig/iptables & /etc/sysconfig/ip6tables
    

    *filter
    :INPUT DROP [0:0]
    :FORWARD DROP [0:0]

12. Restrict ICMP messages by removing any lines in /etc/sysconfig/iptables containing the following:
    

    -p icmp

    and replace it with:
    

    -A INPUT -p icmp --icmp-type echo-reply -j ACCEPT
    -A INPUT -p icmp --icmp-type destination-unreachable -j ACCEPT
    -A INPUT -p icmp --icmp-type time-exceeded -j ACCEPT

13. To log all dropped packets in the system replace the following line in /etc/sysconfig/iptables:
    

    -A INPUT -j REJECT --reject-with icmp-host-prohibited-A FORWARD -j REJECT --reject-with icmp-host-prohibited

    with:
    

    -A INPUT -j LOG
    -A INPUT -j DROP-A FORWARD-j LOG
    -A FORWARD -j DROP

    You will need to write the same in the equivalent IPv6 file (in /etc/sysconfig/ip6tables)
14. You may have NFS installed; if you don't need it then uninstall it:
    
    

    yum remove portmap nfs-utils

    
    NOTE: If you are running virtual machines then it will need the libraries provided by portmap. Instead turn off the services:
    

    chkconfig portreserve off
    chkconfig rpcgssd off
    chkconfig rpcidmapd off
    chkconfig rpcbind off
    chkconfig rpcsvcgssd off
    chkconfig nfs off
    chkconfig nfslock off

15. Finally, to check what is running on your server:
    
    
    • This will show all services:
      

      netstat -tulp

    • This will show only services with active connection
      

      netstat -ant

    • This will show you the routing table
      

      route

    • This will show you if any program is actively pulling raw packets, and is a sign that there is a network sniffer. Note that on a fresh system that a positive result may just be the DHCP client (if you use one).
      
      

      cat /proc/net/packet

References

• Red Hat Linux 5 Hardening Tips - National Security Agency
• Guide to the secure configuration of Red Hat Linux 5 - National Security Agency
• CentOS wiki on hardening the OS
• This guide from sysadminwiki

Clearing orphaned and unused packages from CentOS 6.3

This is a follow on post from my guide to installing CentOS 6.2 (or you can read my updated 6.3 version) and auditing your software installs. We will go through some of the steps required to secure your server and get it ready for production use.

As always, I suggest you take this time to tighten up your machine first; run updates, turn off services, install software and harden your machine. You should also consider setting up your SSH settings.

To check which packages are left on your system just run the following command:

package-cleanup --leaves --exclude-bin

(NOTE: The --exclude-bin option means that packages with bin files are not included; to see packages with bin files just delete the option)

If you are happy with the list produced, run the modified version to delete all the files:

package-cleanup --quiet --leaves --exclude-bin | xargs yum remove -y

Further Reading

• Nux! has the short and sweet of it
• The man page for the package-cleanup tool
• A guide to the yum tool in CentOS 6

Setting up a CentOS 6.2 web server: Accounts Hardening

This is a follow on post from my guide to installing CentOS 6.2 and auditing your software installs. We will go through some of the steps required to secure your server and get it ready for production use.

These steps will outline how to harden your user accounts to lessen the risk that they will be compromise (and limit the damage able to be done if they are compromised).
We will assumes you have already created a new user account; if you haven't, just run the following command:

adduser -m -U USERNAME
passwd USERNAME

Now let's lock down our accounts!

1. Let's restrict the root access to the system console only. Edit /etc/securetty and remove everything except for the following:
   

   console
   tty1
   tty2
   ...
   tty10
   tty11

2. Uncomment the following line in /etc/pam.d/su
   
   

   auth required pam_wheel.so use_uid

   
   
3. Uncomment the following line in /etc/sudoers
   
   

   %wheel ALL=(ALL) ALL

4. Add your new administrator user to the wheel group
   

   usermod -G wheel USERNAME

5. Now we will lock non-root system accounts and block shell access. Figure out the list of accounts by running the following (it will print a list of accounts with the associated UID):
   

   awk -F: '{print $1 ":" $3 ":" $7}' /etc/passwd

6. Run the following commands on any non-root account with a UID less than 500:
   

   usermod -L account
   usermod -s /sbin/nologin account

    
7. For reference, this is a list of system accounts generally created on a fresh install:
   bin
   daemon
   adm
   lp
   sync
   shutdown
   halt
   mail
   uucp
   operator
   games
   gopher
   ftp
   nobody
   dbus
   rpc
   abrt
   vcsa
   haldaemon
   saslauth
   postfix
   rpcuser
   nfsnobody
   ntp
   qemu
   radvd
   sshd
   tcpdump
   oprofile
   avahi
   rtkit
   pulse
   avahi-autoipd
   mysql
8. Ensure passwords expire by editing /etc/login.defs
   

   PASS_MAX_DAYS 360
   PASS_MIN_DAYS 14
   PASS_MIN_LENGTH 8PASS_WARN_AGE 32

   For any accounts that have already been created, run the following to enforce the new rules:
   
   

   chage -M 360 -m 14 -W 7 admin

References

• Red Hat Linux 5 Hardening Tips - National Security Agency
• Guide to the secure configuration of Red Hat Linux 5 - National Security Agency
• CentOS wiki on hardening the OS

Setting up a CentOS 6.3 Virtual Host

This guide outlines how I set-up my virtual host using CentOS 6.3 (a free release version of Red Hat Linux with all the branding removed). It's partially based on my previous installation guide. I also used my guide to create a bootable USB installation disk, but this guide should work equally well with the standard DVD install.

Installation

1. Boot up your installation media (you may need to edit your BIOS to do so)
2. Select 'Install or upgrade an existing system' from the menu
3. Select your language and keyboard layout.
4. Click next at the splash screen.
5. Choose the 'Basic Storage Device' option
6. Select the 'Fresh Installation' option
7. Enter in the host-name of your new server (for best results you should append your domain name to the end so it works seamlessly with SSL certificates) i.e. testserver.example.com
   
   If you want to configure a static IP address click on the 'Configure Network' button, select the your network card (probably eth0) and enter away.
   
   If you are going to use DHCP, or just don't know, just hit 'Next'
8. Select the correct timezone for you (just click a location on the map and it should select the closest one to you).
9. Enter in an appropriate root password. Make as long and complex as possible (long sentences with mixed character types are easier to remember than jibberish strings; for instance 'My office is situated in 1234 fake street, Fakeville!')
10. In this example we are going to go for a custom partition layout, so select 'Create Custom Layout'. If you are fine with defaults, just skip to part .
11. Delete all existing partitions and do the following:
• A /boot partition of about 100MB. Use the ext4 format


• Create a LVM Physical Volume that fills up the rest of the hard-drive


• Create a LVM Volume Group with a Physical Extent of 4MB.


• Create LVM Logical Volumes on the Volume group as follows (make sure you leave some free space for your Virtual machines!!):


• Swap space that is at least equal to how much RAM is in your server
• /tmp/ should be as big as the largest file you will be manipulating (for instance, if you are copying a DVD you will need at least 4GB)
•  /var/log and /var/log/audit are separated so that if your log system goes haywire it does not kill the space for other applications. Dedicate a couple of gigabytes to each.
• /home/ and /usr/ should be a few gigabytes each. /usr/ just holds your applications and should remain pretty static, while /home/ is where you will store your personal files.
• /var/ and /var/www/ will contain the majority of space on your system. MySQL stores your database files in /var/lib/mysql/, while Apache runs from /var/www/. Dedicate adequate space to each folder.
• Your root folder (/) will only need a few GB of space. It will mainly hold configuration files.
12. The system will take some time to format your hard-drive. Once it is complete it will ask you to install the boot-loader. While the defaults are suitable, for extra security you should consider password protecting your boot-loader.
13. We can now select our packages. You can customize the system to suit your needs, but for the basics just select 'Basic Server' from the menu and the 'Customize now' from the radio buttons. Hit 'Next'.
14. Do the following edits:
• Remove the 'Java Platform' and 'Directory Client' meta-packages
• Add all of the Virtualization meta-packages (including client, platform and tools)
• Because the virt-manager tool requires a GUI, you may need to install the 'X Windows System'  and the 'KDE Desktop'
• From the base system, I removed packages such as hunspell and word (as well as hardware tools like RAID that I was not using)
15. Reboot your system!

 House cleaning

I suggest you take this time to tighten up your machine; run updates, turn off services, install software and harden your machine. You should also consider setting up your SSH settings.

Have a look at some of my guide to Software package integrity checks (aide).

Creating our first guest

We are going to use LVM based guests, so if you haven't left any space on your LVM partition I suggest you use these guides to free up some space. If you have partitions you don't think you need anymore, just delete it.

You may also want to ensure that KVM is installed so that you get the benefit from it's kernel and hardware virtualisation.

yum install kvm qemu-kvm qemu-kvm-tools

Now you just need to create a logical partition in the volume to store your VM by running the following command (assuming your volume is call VolGroup):

lvcreate -L20G -n vm1 VolGroup

To install to this new partition, just run the following command:

virt-install --connect qemu:///system -n vm1 -r 512 --vcpus=2 --disk path=/dev/VolGroup/lv_vm1 -c /path/to/installation.iso --graphics vnc --noautoconsole --os-type linux --os-variant rhel6

Note the following parameters:

• -r specifies the RAM size
• --vcpus specifies the virtual CPU's to use
• --os-type helps to optimise the VM by specifying an operating system
• --os-variant is a optional parameter, but helps further optimisation of the emulator.

Further reading

• This excellent series from 'How to forge'. Part 1 (Configuration), Part 2 (Connecting to Guest), Part 3 (Creating Guest with GUI), Part 4 (Command line tools), and Part 5 (LVM based guests).
• CentOS documentation on using virt-install
• This excellent guide by Blog Normation
• A beginners guide to LVM from How to Forge

Installing CentOS 6.3 from a USB mass storage device

I've done A LOT of research on this issue and I have finally been able to create a bootable USB to use for installing CentOS.

1. Download the Centos DVD for your system.
   
   (Optional: You can run the md5sum command on your download and compare the hash against that stored on the server)
2. Clear the USB (NOTE: This is assuming your device is sdb!!! Double check, otherwise you may wipe your hard-drive!!!):
   
   

   sudo dd if=/dev/zero of=/dev/sdb bs=512 count=1

3. Make it bootable (you can type in 'm' to show a help menu):
   
   

   sudo fdisk /dev/sdb
   >n
   >p
   >1
   >(default)
   >(default)
   >a
   >1
   >t
   >c
   >w

4. Format the partition:
   
   

   sudo mkfs.vfat /dev/sdb1

5. Download the livecd bash script and make it executable:
   
   

   wget http://git.fedorahosted.org/cgit/livecd/plain/tools/livecd-iso-to-disk.sh
   chmod +x livecd-iso-to-disk.sh

6. Install the software required by the script:
   
   

   sudo apt-get install isomd5sum syslinux extlinux

7. Run the script:
   
   

   sudo ./livecd-iso-to-disk.sh [your-dvd-iso] /dev/sdb1

8.  Insert your USB device and run!

Further reading

• The Fedora project hosting livecd tools
• This stackexchange guide

 You can also see my other related articles:

• Setting up a CentOS 6.2 web server: Installation
• Setting up a CentOS 6.2 web server: Software and package integrity and installation
• Setting up a CentOS 6.2 web server: Securing the file system

Setting up a CentOS 6.2 web server: Securing the file system

This is a follow on post from my guide to installing CentOS 6.2. We will go through some of the steps required to secure your server and get it ready for production use.

This section will outline how to lock down your partitions and file system. We will assume that you went for a file system structure similar to the one outlined in the above blog post.

Since the filesystem flags will be the most foriegn concept in this guide, I will give a quick outline about file system flags. However, I strongly suggest you follow the links provided in the references for more in-depth detail on any topic provided in this guide.

• nosuid disallows the filesystem from granting a user the temporary elevated privileges of a file's owner or group.
• noexec disallows the filesystem from running an executable.
• nodev disallows the filesystem from running files as block devices (i.e. treat the file as an I/O source or sink).

The process for securing your file system is as follows:

1. Secure your partitions by editing /etc/fstab as follows:
• Add nosuid, noexec, and nodev to partitions like  /dev/shm, /var/log, /tmp, and /var/log/audit. Basically any partition where you only expect to read and write files.
• Add nodev to all non-root file systems like /home and /var/www. You can add the noexec flag if you want, but note that cgi scripts stored in /var/www will break (as well as any scripts stored in the user's home directory).
• Add nosuid only to file systems like /var.
• DO NOT ADD ANY OF THESE FLAGS TO /!!!!!

 
2.  Add the following line to /etc/fstab to hardlink /var/tmp to /tmp
   
   /tmp /var/tmp none rw,noexec,nosuid,nodev,bind 0 0
    
3. Disable the autofs service if you do not need NFS (unless you have already un-installed the service):
   
   chkconfig autofs off 

References

• Howto Forge's guide: 'The Perfect Server - CentOS 6.2 x86_64 with Apache2'
• Howto Forge's guide: 'Installing Apache2 with PHP5 and MySQL support on CentOS 6.2'
• Red Hat Linux 5 Hardening Tips - National Security Agency
• Guide to the secure configuration of Red Hat Linux 5 - National Security Agency
• CentOS wiki on hardening the OS

Setting up a CentOS 6.2 web server: Software and package integrity and installation

This is a follow on post from my guide to installing CentOS 6.2. We will go through some of the steps required to secure your server and get it ready for production use.

These steps will outline how to check what is installed on your system and whether your system has been compromised.

1.  Log in as root and grab a current software list (check out my previous blog post on this topic).
   
#Using RPM
rpm -qa
#Using yum
yum list installed
    
2. Check to ensure that yum is forced to check the gpg signature when installing packages. This is default behaviour in CentOS 6.2, but for the sake of completeness I have included this step. Check /etc/yum.conf and all the files in /etc/yum.repos.d/ for the following line:
   
gpgcheck=1
    
3. AIDE is an intrusion dectection environment that checks the integrity of installed packages and files. It can report on the changes to your system. Install it using yum:
   
yum install aide
    
4. It should be your priority to read and understand /etc/aide.conf and tailor it to your system. While the defaults should be adequate for most installations, you should nevertheless know what AIDE does.
    
5. Generate the initial AIDE database (by default it will be stored as /var/lib/aide/aide.db.new.gz):
   
   /usr/sbin/aide --init
    
6. Back up the database (in this example we are copying it to root's home directory):
   
   cp /var/lib/aide/aide.db.new.gz ~/
    
7. Install the AIDE database:
   
   mv /var/lib/aide/aide.db.new.gz /var/lib/aide/aide.db.gz
    
8. Run a manual check:
   
   /usr/sbin/aide --check
    
9. Stop the yum update daemon (we are going to write our own). If you followed the above guide the service won't even be installed, but again I am including it here for completeness.
   
   chkconfig yum-updatesd off
    
10. Edit /etc/crontab by adding the following line (this will do a daily check of the system with AIDE):
    
    50 4 * * * root /usr/sbin/aide --check
     
11. Add a file called update.cron in /etc/cron.weekly/ and add in the following (NOTE!: cron.weekly is run by the anacron service. Keep this in mind when you are disabling services later on in this guide).
    
    #!/bin/sh
#
# Update yum, then the rest of the system
/usr/bin/yum -R 120 -e 0 -d 0 -y update yum
/usr/bin/yum -R 10 -e -0 -d 0 -y update
#
# Save a list of software currently installed on the system
/bin/rpm -qa > /root/`/bin/hostname -s`_software_`/bin/date +%Y%m%d`.txt
#
# OPTIONAL: Fix all the prelinks (otherwise you may get alot of prelink messages)
/usr/sbin/prelink --all
#
# Update the AIDE database
/usr/sbin/aide --update
#
# Make a back-up of the new database
/bin/cp /var/lib/aide/aide.db.gz /root/aide.db.`/bin/date +%Y%m%d`.gz
     
12. Make /etc/cron.weekly/update.cron executable:
    
    chmod 755 /etc/cron.weekly/update.cron
     

References

• Howto Forge's guide: 'The Perfect Server - CentOS 6.2 x86_64 with Apache2'
• Howto Forge's guide: 'Installing Apache2 with PHP5 and MySQL support on CentOS 6.2'
• Red Hat Linux 5 Hardening Tips - National Security Agency
• Guide to the secure configuration of Red Hat Linux 5 - National Security Agency
• CentOS wiki on hardening the OS

Setting up a CentOS 6.2 web server: Installation

CentOS is the free release version of Red Hat Linux with all the branding removed. It also does not have the support options and some of the fancy trimmings the Enterprise version offers, but it is still a solid server OS. This guide is a brief step-by-step guide in how to install CentOS 6.2 and configure it as a web-server.

Install from DVD:

1. Boot up from your DVD (you will need to enter into the Boot menu of your computer OR edit your BIOS to do so)


2. Select Install or upgrade an existing system from the menu


3. If you are worried about your DVD you can choose to to test it, but this is not a necessary step so you can skip it.


4. On the Welcome screen select 'Next'
   


5. Select your language (in our case we are going for the default of 'English (English)')


6. Select your keyboard type (in Australia we use 'U.S. English')


7. If you are just going for a standard local hard-drive set-up then just choose the 'Basic Storage Devices' option. If you are going for something fancy (such as network storage or special drives), or you just want to disable some devices for that extra level of paranoid security then choose 'Specialized Storage Devices'.
   
   If you have no idea which one you should choose then just select the Basic option.


8. Enter in the host-name of your new server (for best results you should append your domain name to the end so it works seamlessly with SSL certificates) i.e. testserver.example.com
   
   If you want to configure a static IP address click on the 'Configure Network' button, select the your network card (probably eth0) and enter away.
   
   If you are going to use DHCP, or just don't know, just hit 'Next'


9. Select the correct timezone for you (just click a location on the map and it should select the closest one to you).


10. Enter in an appropriate root password. Make as long and complex as possible (long sentences with mixed character types are easier to remember than jibberish strings; for instance 'My office is situated in 1234 fake street, Fakeville!')


11. In this example we are going to go for a custom partition layout, so select 'Create Custom Layout'. If you are fine with defaults, just skip to part .


12. Delete all existing partitions and do the following:
• A /boot partition of about 100MB. Use the ext4 format


• Create a LVM Physical Volume that fills up the rest of the hard-drive


• Create a LVM Volume Group with a Physical Extent of 4MB.


• Create LVM Logical Volumes on the Volume group as follows:


• Swap space that is at least equal to how much RAM is in your server
• /tmp/ should be as big as the largest file you will be manipulating (for instance, if you are copying a DVD you will need at least 4GB)
•  /var/log and /var/log/audit are separated so that if your log system goes haywire it does not kill the space for other applications. Dedicate a couple of gigabytes to each.
• /home/ and /usr/ should be a few gigabytes each. /usr/ just holds your applications and should remain pretty static, while /home/ is where you will store your personal files.
• /var/ and /var/www/ will contain the majority of space on your system. MySQL stores your database files in /var/lib/mysql/, while Apache runs from /var/www/. Dedicate adequate space to each folder.
• Your root folder (/) will only need a few GB of space. It will mainly hold configuration files.


13. The system will take some time to format your hard-drive. Once it is complete it will ask you to install the boot-loader. While the defaults are suitable, for extra security you should consider password protecting your boot-loader.


14. We can now select our packages. You can customize the system to suit your needs, but for the basics just select 'Basic Server' from the menu and the 'Customize now' from the radio buttons. Hit 'Next'.


15. Do the following edits:
• Base system - Remove 'Java Platform' and 'Directory Client'
• Web Server - Add 'Web Server' and 'PHP support'


16. Reboot your system!

References

• Howto Forge's guide: 'The Perfect Server - CentOS 6.2 x86_64 with Apache2'
• Howto Forge's guide: 'Installing Apache2 with PHP5 and MySQL support on CentOS 6.2'
• Red Hat Linux 5 Hardening Tips - National Security Agency
• Guide to the secure configuration of Red Hat Linux 5 - National Security Agency
• CentOS wiki on hardening the OS

Using RPM

RPM is a based software management system for Red Hat based systems such as Red Hat Enterprise Linux, CentOS, Scientific Linux and Fedora. It can refer to both the command-line utility and the file format used to contain the compiled software source for distribution. If you wish to learn more about the RPM system, I suggest you read Edward C. Bailey's excellent Maximum RPM.

• Installing a downloaded .rpm file:
  
  rpm -ihv filename.rpm
• Updating to the latest .rpm file when an application is already installed (to ensure no files are overwritten):
  
  rpm -Uhv filename.rpm
• Querying for an installed package with a certain filename (\* is a wildcard character):
  
  rpm -qa filename\*
• Remove an installed .rpm file:
  
  rpm -e filename
• Remove multiple installed applications that have similar names:
  
  rpm -qa filename\* | xargs rpm -e
• To get even more detailed information about an .rpm file we use:
  
  rpm -qpi filename.rpm

Software list for CentOS

This is a rough procedure I use to determine what software is installed on my system, and what has changed.

1. Create a text file with the list of currently installed software. This is usually best done on a fresh system. This code will also date the file so you can insert it into your scripts:
   
   sudo rpm -qa > ~/`hostname -s`-software-`date +%Y%m%d`.txt


2. We can now send ourselves an email of what has been installed on this system (in case the system is compromised):
   
   mail -s "`hostname -s` Software `date +%Y%m%d`" john@example.com.au < ~/host-software-20111026.txt


3. We can also compare files to see how our system has changed (for instance, on an update):
   
   diff host-software-20111026.txt host-software-20111027.txt

VSFTPD and CentOS

This basic configuration allows only users with an account and a home directory to log in and use the resource. Although it must be said that if you have SSH up and running then you should use SFTP (which is pretty much FTP over SSH), as it provides a little bit more security.

1. Install vsftpd:
   
   sudo yum install vsftpd


2. Configure our firewall to allow incoming connections:
   
   sudo /sbin/iptables -I RH-Firewall-1-INPUT 4 -p tcp --dport 21 -m state --state NEW -j ACCEPT
sudo /sbin/iptables -I RH-Firewall-1-INPUT 5 -p tcp --dport 20 -m state --state NEW -j ACCEPT


3. Check to see if SELinux is up and running (an output of 0 means that it is):
   
   /usr/sbin/selinuxenabled; echo $?


4. If SELinux is up and running you need to disable it for the ftp protocol, or apply a policy to allow FTP to make changes to your local directory:
   
   sudo /usr/sbin/setsebool -P ftpd_disable_trans 1


5. Open up the vsftpd configuration file for editing:
   
   sudo vim /etc/vsftpd/vsftpd.conf


6. Make the following changes:
   
   anonymous_enable=NO
local_enable=YES
write_enable=YES
chroot_local_user=YES


7. Start VSFTPD:
   
   sudo /sbin/service vsftpd start


8. Turn on FTP on reboot:
   
   sudo /sbin/chkconfig --levels 235 vsftpd on

References:

• Fedora Forum post about how to set up SELinux policies for FTP
• nixCraft guide to setting up FTP on RedHat/CentOS
• IPTables guides are available from here and here
• Red Hat documentation manuals (good reference for ANYTHING)

Tomcat Configuration

For those keeping track, I have been playing with Tomcat. And I have mentioned the lack of useful tutorials out there. So here is one I made to (hopefully) fill in the gap! If you have any questions just ask away in the comments!

What you need:

• Apache Tomcat
• This guide was done with CentOS, but should be applicable to other Unix-based distributions

Summary:

This guide will take you through some steps to ensure Tomcat just works. I am trying to be as thorough as possible so some of these steps may not be applicable to you.

Here we go....

1. First, you have to install Tomcat5. I just use the CentOS repository since that is the nice & easy way to get the latest security patches and fixes. Of course, purists will recommend you build from source. Each to their own; if you choose to do it my way just enter the following into the command-prompt:
   
   sudo yum install tomcat5
    
2. Find out which version of Java you are running (so we can set up our variables)

/usr/sbin/alternatives --display java

Our system is configured to use /usr/lib/jvm/jre-1.6.0-openjdk/bin/java


3. Now we need to edit the Tomcat5 configuration file to use our Java implementation. Edit the file /etc/tomcat5/tomcat5.conf with your own values:

# you could also override JAVA_HOME here
# Where your java installation lives
JAVA_HOME="/usr/lib/jvm/jre-1.6.0-openjdk/"
# Time to wait in seconds, before killing process
# Lower this value for testing to stop you waiting ages
SHUTDOWN_WAIT=10
# Connector port is 8080 for this tomcat5 instance
# Need to change this in server.xml as well
CONNECTOR_PORT=8080
   


4. Edit /etc/tomcat5/server.xml file with your desired configuration


5. Start Tomcat5 through the following commands:
   
   sudo /etc/init.d/tomcat5 start
#To start tomcat on reboot run the following
sudo chkconfig tomcat5 on --level 2,3,5

References:

• OpenBD guide to running Tomcat (geared to their app)
• David Ghedini's blog offers a great overview of this topic

Tomcat with SSL

I have been tackling some server issues lately, trying to get Tomcat to play nicely with SSL and get everything locked down. And since there seems to be a lack of useful tutorials out there (at least nothing I could find) I made my own little how-to. If you have any questions just ask away in the comments!

What you need:

• Apache Tomcat
• The OpenSSL toolset which comes installed with Linux (this guide was done with CentOS, but should be applicable to other distributions)
• An account with startssl.com (or other certificate signing authority)

Summary:

This post will go through the various steps required to set up Tomcat with SSL. At the time of writing StartSSL were still offering free signed certificates.

1. Getting your ceritificate

I am going to assume that you have already got yourself an account with a certificate signing authority. Most of these services provide documentation on how you can get your very own certificate, but for the sake of thoroughness I will outline the steps I followed to get my certificate:

1. Run the following command on your server(where [server] should be changed into something unique for you)

openssl req -new -newkey rsa:2048 -nodes -keyout [server].key -out [server].csr


2. The system will now ask you a bunch of questions such as location, emails and passwords. Answer appropriately for your system.


3. Log-in to http://www.startssl.com/ (or whatever certificate signing authority you have chosen)


4. Select the option to upload your own cetificate signing request file (you don't need them to generate another key for you; step 1 already created that for us)


5. Once you uploaded the contents of the *.csr file, you should receive an encoded public certificate file (*.crt). It should also give you the root and intermediate certificates of the servers used to sign those certificates.


6. Save all files in a safe place (something with decent file permissions so that the files cannot be tampered with). For the rest of this guide we are going to assume /etc/pki/tls/certs/.

2. Configuring TomCat

1.  If your certificate authority has not already done so, create a chain file of the signing server's certificates:
   
   cat [cert1].pem [cert2]/pem > chain.pem
   


2. We need to put all out certificates into a keystore file, so that Tomcat only has to load up one object (not multiple files)

openssl pkcs12 -export -in [server].crt -inkey [server].key -out [server].p12 -name tomcat -CAfile chain.pem -chain

3. The final step is to let Tomcat know the existence of the keystore file. Edit the server.xml file (in CentOS it is /etc/tomcat5/server.xml) as follows:
   
   <!-- Define a SSL HTTP/1.1 Connector on port 8443 -->
<Connector port="8443" maxHttpHeaderSize="8192" maxThreads="150" minSpareThreads="25" maxSpareThreads="75" algorithm="SunX509" keystoreType="PKCS12" keystoreFile="/etc/pki/tls/certs/server.p12" keystorePass="abc123" enableLookups="false" disableUploadTimeout="true acceptCount="100" scheme="https" secure="true" clientAuth="false" sslProtocol="TLS" />
   
   NOTE: The lines algorithm="..." and keystoreType="..." are crucial! This is where most of my headaches lay; apparently Tomcat couldn't auto-detect the algorithm and so HTTPS just didn't work.

References:

• Ars Technica guide to getting a free SSL certificate
• GoDaddy help article for generating certificates
• Mulesoft guide to configuring Tomcat with SSL
• Digicert guide to configuring Tomcat with SSL
• Ashraf Hossain's guide to redirecting all HTTP requests to HTTPS