Wednesday, October 29, 2008

How do I force users to change their passwords upon first login?

1.) Firstly, lock the account to prevent the user from using the login until the change has been made:

# usermod -L 

2.) Change the password expiration date to 0 to ensure the user changes the password during the next login:

# chage -d 0 

3.) To unlock the account after the change do the following:

# usermod -U 


Wednesday, October 22, 2008

Kernel parameters for enhance security

The following list shows tunable kernel parameters you can use to secure your Linux server against attacks.

For each tunable kernel parameters you need to be add it to the /etc/sysctl.conf configuration file to make the change permanent after reboots. To activate the configured kernel parameters immediately at runtime, use:
# sysctl -p

Enable TCP SYN Cookie Protection

A "SYN Attack" is a denial of service attack that consumes all the resources on a machine. Any server that is connected to a network is potentially subject to this attack.

To enable TCP SYN Cookie Protection, edit the /etc/sysctl.conf file and add the following line:
net.ipv4.tcp_syncookies = 1

Disable IP Source Routing

Source Routing is used to specify a path or route through the network from source to destination. This feature can be used by network people for diagnosing problems. However, if an intruder was able to send a source routed packet into the network, then he could intercept the replies and your server might not know that it's not communicating with a trusted server.

To enable Source Route Verification, edit the /etc/sysctl.conf file and add the following line:
net.ipv4.conf.all.accept_source_route = 0

Disable ICMP Redirect Acceptance

ICMP redirects are used by routers to tell the server that there is a better path to other networks than the one chosen by the server. However, an intruder could potentially use ICMP redirect packets to alter the hosts's routing table by causing traffic to use a path you didn't intend.

To disable ICMP Redirect Acceptance, edit the /etc/sysctl.conf file and add the following line:
net.ipv4.conf.all.accept_redirects = 0

Enable IP Spoofing Protection

IP spoofing is a technique where an intruder sends out packets which claim to be from another host by manipulating the source address. IP spoofing is very often used for denial of service attacks. For more information on IP Spoofing, I recommend the article IP Spoofing: Understanding the basics.

To enable IP Spoofing Protection, turn on Source Address Verification. Edit the /etc/sysctl.conf file and add the following line:
net.ipv4.conf.all.rp_filter = 1

Enable Ignoring to ICMP Requests

If you want or need Linux to ignore ping requests, edit the /etc/sysctl.conf file and add the following line:
net.ipv4.icmp_echo_ignore_all = 1
This cannot be done in many environments.

Enable Ignoring Broadcasts Request

If you want or need Linux to ignore broadcast requests, edit the /etc/sysctl.conf file and add the following line:
net.ipv4.icmp_echo_ignore_broadcasts = 1

Enable Bad Error Message Protection

To alert you about bad error messages in the network, edit the /etc/sysctl.conf file and add the following line:
net.ipv4.icmp_ignore_bogus_error_responses = 1

Enable Logging of Spoofed Packets, Source Routed Packets, Redirect Packets

To turn on logging for Spoofed Packets, Source Routed Packets, and Redirect Packets, edit the /etc/sysctl.conf file and add the following line:
net.ipv4.conf.all.log_martians = 1

Thursday, October 16, 2008

/proc explained

This filesystem (/proc) contains a huge set of numbered directories that come and go. Each and one of these numbered directories contains information pertaining to all of the currently active processes on the machine. When a new process is started, a new directory is created in the /proc filesystem for it, and a lot of data is created within it regarding the process, such as the commandline with which the program was started with, a link to the "current working directory", environment variables, where the executable is located, and so on

Most of the information in the files are rather "human readable", except a few of them. However, a few of them you should not touch, such as the kcore file. The kcore file contains debugging information regarding the kernel, and if you try to 'cat' it, your system may very well hang up and die. If you try to copy it to a real file on the harddrive, you will very soon have filled up your whole partition, and so on. What all of this tells you is to be very careful. Mostly, none of the variables or entries in the /proc filesystem is not dangerous to watch, but a few of them are. A brief walkthrough of the most important files:
  • cmdline - The command line issued when starting the kernel.
  • cpuinfo - Information about the Central Processing Unit, who made it, known bugs, flags etcetera.
  • dma - Contains information about all DMA channels available, and which driver is using it.
  • filesystems - Contains short information about every single filesystem that the kernel supports.
  • interrupts - Gives you a brief listing of all IRQ channels, how many interrupts they have seen and what driver is actually using it.
  • iomem - A brief file containing all IO memory mappings used by different drivers.
  • ioports - Contains a brief listing of all IO ports used by different drivers.
  • kcore - Contains a complete memory dump. Do not cat or anything like that, you may freeze your system. Mainly used to debug the system.
  • kmsg - Contains messages sent by kernel, is not and should not be readable by users since it may contain vital information. Main usage is to debug the system.
  • ksyms - This contains the kernel symbol table, which is mainly used to debug the kernel.
  • loadavg - Gives the load average of the system during the last 1, 5 and 15 minutes.
  • meminfo - Contains information about memory usage on the system.
  • modules - Contains information about all currently loaded modules in the kernel.
  • mounts - Symlink to another file in the /proc filesystem which contains information about all mounted filesystems.
  • partitions - Contains information about all partitions found on all drives in the system.
  • pci - Gives tons of hardware information about all PCI devices on the system, also includes AGP devices and built in devices which are connected to the PCI bus.
  • swaps - Contains information about all swap partitions mounted.
  • uptime - Gives you the uptime of the computer since it was last rebooted in seconds.
  • version - Gives the exact version string of the kernel currently running, including build date and gcc versions etcetera.
And here is a list of the main directories and what you can expect to find in there:
  • bus - Contains information about all the buses, hardware-wise, such as USB, PCI and ISA buses.
  • ide - Contains information about all of the IDE buses on systems that has IDE buses.
  • net - Some basic information and statistics about the different network systems compiled into the system.
  • scsi - This directory contains information about SCSI buses on SCSI systems.
  • sys - Contains lots of variables that may be changed, including the /proc/sys/net/ipv4 which will be deeply discussed in this document.

Wednesday, October 8, 2008

EXCHANGE SERVER ADMINISTRATION TIPS Plan an Exchange 2007 standby continuous replication (SCR) deployment

Microsoft added standby continuous replication (SCR) to its solutions in Exchange Server 2007 Service Pack 1 (SP1). SCR works similarly to local continuous replication (LCR) and cluster continuous replication (CCR) but has some limitations, such as a lack of support for automatic failover. Get an understanding of how standby continuous replication works within your Exchange environment and how to properly plan an SCR deployment.

Microsoft Exchange Server 2007 brought with it several new features, including local continuous replication and cluster continuous replication. These features use log shipping to store a secondary copy of the Exchange server database in an alternate location. That way, the server can be recovered quickly by retrieving data from the database replica in the event of a catastrophic failure.

Although LCR and CCR are great features, Microsoft went a step further in Exchange Server 2007 SP1 with standby continuous replication, which works similarly to LCR and CCR, but has some additional capabilities. SCR overcomes some of the limits of LCR and CCR. It may be tempting to begin using SCR immediately, but you should be aware of its significant limitations and restrictions. That's why it's crucial to properly plan an SCR deployment.

LCR requires that database replicas are stored locally; CCR lets you store database replicas on a different server that must exist in the same subnet as the primary database server. With this, you can have only one replica.

SCR allows your primary mailbox server (source) to replicate its database to multiple standby servers (targets). These target servers can exist on your LAN, but that isn't necessary. The subnet limitation doesn't apply to SCR.

The first SCR limitation to be aware of is that, like LCR and CCR, SCR works by replicating an individual storage group. However, you can't replicate any storage group. Recovery storage groups are not supported, and the storage group that you're replicating can't contain more than one database.

While there is no limitation to the number of targets that a source storage group can be replicated to, Microsoft recommends that you limit the process to no more than four targets.

SCR and server roles

Although Microsoft recommends using a dedicated Exchange Server to host each server role, many companies choose to host multiple roles on a server because they lack the budget for a fully distributed deployment or they don't have enough users to justify having dedicated servers for each role. Because hosting multiple roles on a single Exchange Server is a common practice, it's important to understand how server roles work when SCR is implemented.

The roles that an SCR source server can host vary, depending on whether or not the server is clustered. If the source server is clustered, then it can only host the Mailbox Server role. If the source server isn't clustered, then the Mailbox Server role is required for SCR. However, the server can also optionally host the Client Access Server, Hub Transport Server or Unified Messaging (UM) Server roles.

The same basic rules apply to SCR target servers. The Mailbox Server role is always required, because it contains the necessary replication components. If the target isn't part of a cluster, it can optionally host the Client Access Server, Hub Transport Server, or Unified Messaging Server roles. In either case, LCR cannot be used on a target server.

If the target is a part of a cluster, it should be designated as a passive node on a failover cluster. The Mailbox Server role must be installed where no other clustered mailbox servers have been installed in the cluster.

SCR and Exchange backups

One last limitation is related to backups. Many organizations use CCR to make the backup process more efficient. Backups can be run against a CCR replica without affecting the primary mailbox server. But unlike cluster continuous replication, you can't run a backup against a standby continuous replication target. You can, however, use CCR on an SCR host. This allows you to create a CCR replica of the primary database, run your backups against this replica and still reap SCR's benefits.





Monday, October 6, 2008

The top five reasons why Windows Vista failed

On Friday, Microsoft gave computer makers a six-month extension for offering Windows XP on newly-shipped PCs. While this doesn’t impact enterprise IT — because volume licensing agreements will allow IT to keep installing Windows XP for many years to come — the move is another symbolic nail in Vista’s coffin.

The public reputation of Windows Vista is in shambles, as Microsoft itself tacitly acknowledged in its Mojave ad campaign.

IT departments are largely ignoring Vista. In June (18 months after Vista’s launch), Forrester Research reported that just 8.8% of enterprise PCs worldwide were running Vista. Meanwhile, Microsoft appears to have put Windows 7 on an accelerated schedule that could see it released in 2010. That will provide IT departments with all the justification they need to simply skip Vista and wait to eventually standardize on Windows 7 as the next OS for business.

So how did Vista get left holding the bag? Let’s look at the five most important reasons why Vista failed.

5. Apple successfully demonized Vista

Apple’s clever I’m a Mac ads have successfully driven home the perception that Windows Vista is buggy, boring, and difficult to use. After taking two years of merciless pummeling from Apple, Microsoft recently responded with it’s I’m a PC campaign in order to defend the honor of Windows. This will likely restore some mojo to the PC and Windows brands overall, but it’s too late to save Vista’s perception as a dud.

4. Windows XP is too entrenched

In 2001, when Windows XP was released, there were about 600 million computers in use worldwide. Over 80% of them were running Windows but it was split between two code bases: Windows 95/98 (65%) and Windows NT/2000 (26%), according to IDC. One of the big goals of Windows XP was to unite the Windows 9x and Windows NT code bases, and it eventually accomplished that.

In 2008, there are now over 1.1 billion PCs in use worldwide and over 70% of them are running Windows XP. That means almost 800 million computers are running XP, which makes it the most widely installed operating system of all time. That’s a lot of inertia to overcome, especially for IT departments that have consolidated their deployments and applications around Windows XP.

And, believe it or not, Windows XP could actually increase its market share over the next couple years. How? Low-cost netbooks and nettops are going to be flooding the market. While these inexpensive machines are powerful enough to provide a solid Internet experience for most users, they don’t have enough resources to run Windows Vista, so they all run either Windows XP or Linux. Intel expects this market to explode in the years ahead. (For more on netbooks and nettops, see this fact sheet and this presentation — both are PDFs from Intel.)

3. Vista is too slow

For years Microsoft has been criticized by developers and IT professionals for “software bloat” — adding so many changes and features to its programs that the code gets huge and unwieldy. However, this never seemed to have enough of an effect to impact software sales. With Windows Vista, software bloat appears to have finally caught up with Microsoft.

Vista has over 50 million lines of code. XP had 35 million when it was released, and since then it has grown to about 40 million. This software bloat has had the effect of slowing down Windows Vista, especially when it’s running on anything but the latest and fastest hardware. Even then, the latest version of Windows XP soundly outperforms the latest version of Microsoft Vista. No one wants to use a new computer that is slower than their old one.

2. There wasn’t supposed to be a Vista

It’s easy to forget that when Microsoft launched Windows XP it was actually trying to change its OS business model to move away from shrink-wrapped software and convert customers to software subscribers. That’s why it abandoned the naming convention of Windows 95, Windows 98, and Windows 2000, and instead chose Windows XP.

The XP stood for “experience” and was part of Microsoft’s .NET Web services strategy at the time. The master plan was to get users and businesses to pay a yearly subscription fee for the Windows experience — XP would essentially be the on-going product name but would include all software upgrades and updates, as long as you paid for your subscription. Of course, it would disable Windows on your PC if you didn’t pay. That’s why product activation was coupled with Windows XP.

Microsoft released Windows XP and Office XP simultaneously in 2001 and both included product activation and the plan to eventually migrate to subscription products. However, by the end of 2001 Microsoft had already abandoned the subscription concept with Office, and quickly returned to the shrink-wrapped business model and the old product development model with both products.

The idea of doing incremental releases and upgrades of its software — rather than a major shrink-wrapped release every 3-5 years — was a good concept. Microsoft just couldn’t figure out how to make the business model work, but instead of figuring out how to get it right, it took the easy route and went back to an old model that was simply not very well suited to the economic and technical realities of today’s IT world.

1. It broke too much stuff

One of the big reasons that Windows XP caught on was because it had the hardware, software, and driver compatibility of the Windows 9x line plus the stability and industrial strength of the Windows NT line. The compatibility issue was huge. Having a single, highly-compatible Windows platform simplified the computing experience for users, IT departments, and software and hardware vendors.

Microsoft either forgot or disregarded that fact when it released Windows Vista, because, despite a long beta period, a lot of existing software and hardware were not compatible with Vista when it was released in January 2007. Since many important programs and peripherals were unusable in Vista, that made it impossible for a lot of IT departments to adopt it. Many of the incompatibilities were the result of tighter security.

After Windows was targeted by a nasty string of viruses, worms, and malware in the early 2000s, Microsoft embarked on the Trustworthy Computing initiative to make its products more secure. One of the results was Windows XP Service Pack 2 (SP2), which won over IT and paved the way for XP to become the world’s mostly widely deployed OS.

The other big piece of Trustworthy Computing was the even-further-locked-down version of Windows that Microsoft released in Vista. This was definitely the most secure OS that Microsoft had ever released but the price was user-hostile features such as UAC, a far more complicated set of security prompts that accompanied many basic tasks, and a host of software incompatibility issues. In order words, Vista broke a lot of the things that users were used to doing in XP.

Bottom line

There are some who argue that Vista is actually more widely adopted than XP was at this stage after its release, and that it’s highly likely that Vista will eventually replace XP in the enterprise. I don’t agree. With XP, there were clear motivations to migrate: bring Windows 9x machines to a more stable and secure OS and bring Windows NT/2000 machines to an OS with much better hardware and software compatibility. And, you also had the advantage of consolidating all of those machines on a single OS in order to simplify support.

With Vista, there are simply no major incentives for IT to use it over XP. Security isn’t even that big of an issue because XP SP2 (and above) are solid and most IT departments have it locked down quite well. As I wrote in the article Prediction: Microsoft will leapfrog Vista, release Windows 7 early, and change its OS business, Microsoft needs to abandon the strategy of releasing a new OS every 3-5 years and simply stick with a single version of Windows and release updates, patches, and new features on a regular basis. Most IT departments are essentially already on a subscription model with Microsoft so the business strategy is already in place there.

As far as the subscription model goes for small businesses and consumers, instead of disabling Windows on a user’s PC if they don’t renew their subscription, just don’t allow that machine to get any more updates if they don’t renew. Microsoft could also work with OEMs to sell something like a three-year subscription to Windows with every a new PC. Then users would have the choice of renewing on their own after that.

Thursday, October 2, 2008

Setting up 2 IP address on "One" NIC (Redhat/Fedora)

STEP 1 (The settings for the initial IP address)
$ cat /etc/sysconfig/network-scripts/ifcfg-eth0

DEVICE=eth0
BOOTPROTO=static
BROADCAST=192.168.1.255
IPADDR=192.168.1.1

NETMASK=255.255.255.0
NETWORK=192.168.1.0
ONBOOT=yes


STEP 2 (2nd IP address: )
$ cat /etc/sysconfig/network-scripts/ifcfg-eth0:1

DEVICE=eth0:1
BOOTPROTO=static
BROADCAST=192.168.1.255
IPADDR=192.168.1.2
NETMASK=255.255.255.0
NETWORK=192.168.1.0
ONBOOT=yes


Note, in STEP 1 the filename is “ifcfg-eth0″, whereas in STEP 2 it’s “ifcfg-eth0:1″ and also not the matching entries for “DEVICE=…”. Also, obviously, the “IPADDR” is different as well.
 
Custom Search