Linux System Administration Recipes A Problem-Solution Approach

More documents

Recommendations

Info

CHAPTER 6 ■ SECURING YOUR SYSTEMS■ Note This script doesn’t worry about looking terribly hard for shell escapes(although line 07 does look for anyone trying to pass an extra command in using ; asin rsync directory/ "server:/data/directory/;rm -rf /" . If you’re using thisin a local-access-only setup with a small number of reasonably trusted users, this is areasonable risk. If it’s a machine that’s open to the world at large, you’ll want to bemore careful. Also, bear in mind that using the command /usr/bin/rsync (asopposed to rsync) will trip the “no login” script.The echo statement in lines 14–17 will show up if someone tries to log indirectly, but unfortunately, rsync doesn’t handle echo statements well. So,there is no message to the user if they are misusing rsync (whether deliberatelyor accidentally). Again, depending on your setup (for example, if it’s a smallsetup where users can contact you when there’s a problem), this may wellbe fine.Test by creating a test user and setting the user up in /etc/password and /etc/shadow as shownearlier. Check that you can use rsync and that you can’t log in directly via ssh. Then check that you canstill ssh in as yourself or as whatever admin user still has access in the ssh AllowUsers directive.6-4. ssh Options: Keeping Your Connection AliveThere are stacks of options that you can set on SSH, and some of them can save you quite a lot of hassle.SSH options can be set on the command line (with the -o option) or by editing your ~/.ssh/config file(to set the option for just that user) or /etc/ssh_config file (to set the option globally).SSH uses the first setting that it encounters for an option. It reads command-line options, then peruserconfig, then the global config, and finally general/default ones at the end. So, the command line willoverride per user, and so on.If you leave an SSH connection sitting open for too long but don’t actually put any data through it,you may find that it drops out. This can be irritating, but it’s easily fixed with the SSH config optionServerAliveInterval.Add this to your ~/.ssh/config file to turn ServerAliveInterval on for all SSH connections:Host *Protocol 2ServerAliveInterval 60The first two lines state that this section applies to every host (to apply only to some hosts, specify ahostname rather than *) and that an SSH v2 connection should be made. SSH v2 is significantly moresecure than SSH v1, and ServerAliveInterval requires v2. There’s virtually no reason to be running SSHv1 these days, and modern Debian/Ubuntu runs v2 only by default, so stick to v2.140Download at WoweBook.Com
CHAPTER 6 ■ SECURING YOUR SYSTEMS■ Note To use this on the command line, you’d just use this:ssh server.example.com -o ServerAliveInterval 60ServerAliveInterval sends a package through the encrypted channel after the specified number ofseconds of inactivity to the server, requesting a response. It’s turned off by default, and you may need toexperiment a little with the value. However, once you have the value set to work with your system, youshould be able to keep your SSH sessions connected.■ Note Most systems will have TCPKeepAlive on by default. This sends a TCP package after a period of idleness,usually two hours. This is often too long an interval to prevent disconnection. Also, TCPKeepAlive packets can bespoofed, whereas ServerAliveInterval ones can’t.6-5. ssh Options: Minimizing TypingAnother useful option to set is IdentityFile. SSH keys, ssh-agent, and keychain are useful to minimizepassword typing (see recipe 6-2). But you don’t necessarily want to use the same key for all the machinesyou log onto, which means that you need to specify -i keyfile on the command line. Alternatively, youcan set the identify file per host with a section like this in your ~/.ssh/config file:Host ssh.example.comIdentityFile ~/.ssh/example_id_rsaYou can also use the ~/.ssh/config file to set hostname abbreviations and usernames. This is usefulif you regularly log into a particular machine that has an inconveniently long name or for which youhave a different username. Here’s an example:Host longname.machine.example.comHostName lmachUser julietkemp-longnameThis, put in your ~/.ssh/config file, will enable you to log in to that machine simply by typing sshlmach rather than ssh julietkemp-longname@longname.machine.example.com. You could do somethingsimilar with a bash alias; however, since scp will also use settings from the .ssh/config file, editing thisfile is a more generalized solution and therefore superior.The -X and -Y command-line options enable X11 forwarding and trusted X11 forwarding,respectively. If you always want to forward X11 but want trusted X11 for a particular machine only, trythis:141Download at WoweBook.Com
Page 2:
Download at WoweBook.Com
Page 5 and 6:
Download at WoweBook.Comiii
Page 7 and 8:
Contents■About the Author .......
Page 9 and 10:
■ CONTENTS3-7. Writing a Nagios P
Page 11 and 12:
■ CONTENTS■Chapter 8: Using the
Page 13 and 14:
■ CONTENTSAbout the Author■Juli
Page 15 and 16:
■ CONTENTSAcknowledgmentsMany tha
Page 17 and 18:
■ CONTENTSIntroductionThis book i
Page 19 and 20:
■ INTRODUCTIONDownloading the Cod
Page 21 and 22:
C H A P T E R 1■ ■ ■Saving Yo
Page 23 and 24:
CHAPTER 1 ■ SAVING YOURSELF EFFOR
Page 25 and 26:
Page 27 and 28:
Page 29 and 30:
Page 31 and 32:
Page 33 and 34:
Page 35 and 36:
Page 37 and 38:
Page 39 and 40:
Page 41 and 42:
C H A P T E R 2■ ■ ■Centraliz
Page 43 and 44:
CHAPTER 2 ■ CENTRALIZING YOUR NET
Page 45 and 46:
Page 47 and 48:
Page 49 and 50:
Page 51 and 52:
Page 53 and 54:
Page 55 and 56:
Page 57 and 58:
Page 59 and 60:
Page 61 and 62:
Page 63 and 64:
Page 65 and 66:
Page 67 and 68:
Page 69 and 70:
Page 71 and 72:
Page 73 and 74:
Page 75 and 76:
Page 77 and 78:
Page 79 and 80:
Page 81 and 82:
Page 83 and 84:
C H A P T E R 3■ ■ ■Monitorin
Page 85 and 86:
CHAPTER 3 ■ MONITORING AND UPDATI
Page 87 and 88:
Page 89 and 90:
Page 91 and 92:
Page 93 and 94:
Page 95 and 96:
Page 97 and 98:
Page 99 and 100:
Page 101 and 102:
Page 103 and 104:
Page 105 and 106:
Page 107 and 108:
Page 109 and 110: CHAPTER 3 ■ MONITORING AND UPDATI
Page 115 and 116: C H A P T E R 4■ ■ ■Taking Ba
Page 117 and 118: CHAPTER 4 ■ TAKING BACKUPS AND MA
Page 139 and 140: C H A P T E R 5■ ■ ■Working w
Page 141 and 142: CHAPTER 5 ■ WORKING WITH FILESYST
Page 155 and 156: C H A P T E R 6■ ■ ■Securing
Page 157 and 158: CHAPTER 6 ■ SECURING YOUR SYSTEMS
Page 159: CHAPTER 6 ■ SECURING YOUR SYSTEMS
Page 179 and 180: CHAPTER 7 ■ WORKING WITH APACHEOn
Page 181 and 182: CHAPTER 7 ■ WORKING WITH APACHEdi
Page 183 and 184: CHAPTER 7 ■ WORKING WITH APACHE4.
Page 185 and 186: CHAPTER 7 ■ WORKING WITH APACHE
Page 187 and 188: CHAPTER 7 ■ WORKING WITH APACHEAl
Page 189 and 190: CHAPTER 7 ■ WORKING WITH APACHE
Page 191 and 192: C H A P T E R 8■ ■ ■Making Be
Page 193 and 194: CHAPTER 8 ■ USING THE COMMAND LIN
Page 207 and 208: CHAPTER 9 ■ WORKING WITH TEXT IN
Page 209 and 210: CHAPTER 9 ■ WORKING WITH TEXT IN
Page 211 and 212:
CHAPTER 9 ■ WORKING WITH TEXT IN
Page 213 and 214:
Page 215 and 216:
Page 217 and 218:
Page 219 and 220:
Page 221 and 222:
Page 223 and 224:
C H A P T E R 10■ ■ ■Things G
Page 225 and 226:
CHAPTER 10 ■ THINGS GO IN, THINGS
Page 227 and 228:
Page 229 and 230:
Page 231 and 232:
Page 233 and 234:
C H A P T E R 11■ ■ ■Tracking
Page 235 and 236:
CHAPTER 11 ■ TRACKING DOWN BUGSTh
Page 237 and 238:
CHAPTER 11 ■ TRACKING DOWN BUGS01
Page 239 and 240:
CHAPTER 11 ■ TRACKING DOWN BUGS
Page 241 and 242:
Page 243 and 244:
Page 245 and 246:
CHAPTER 11 ■ TRACKING DOWN BUGSTh
Page 247 and 248:
CHAPTER 11 ■ TRACKING DOWN BUGSAn
Page 249 and 250:
CHAPTER 11 ■ TRACKING DOWN BUGS#
Page 251 and 252:
C H A P T E R 12■ ■ ■Managing
Page 253 and 254:
CHAPTER 12 ■ MANAGING TIME AND PE
Page 255 and 256:
Page 257 and 258:
Page 259 and 260:
Page 261 and 262:
Page 263 and 264:
Page 265 and 266:
Page 267 and 268:
APPENDIX■ ■ ■Perl TipsSee rec
Page 269 and 270:
APPENDIX ■ PERL TIPS• Date::Par
Page 271 and 272:
APPENDIX ■ PERL TIPSPerl Syntax N
Page 273 and 274:
■ ■ ■Index■Symbols$CDPATH,
Page 275 and 276:
■ INDEXenscript option (printing)
Page 277 and 278:
■ INDEX■NNagiosadding hosts to,
Page 279 and 280:
■ INDEXsyslogcentralized logging
Page 281 and 282:
Download at WoweBook.Com
show all

Linux System Administration Recipes A Problem-Solution Approach

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?