Linux System Administration Recipes A Problem-Solution Approach

More documents

Recommendations

Info

CHAPTER 7 ■ WORKING WITH APACHEApache2 config file. This would have the advantage of keeping your module setup and config separate, whichmakes adding and removing modules much easier.You can of course do this symlink adding or removing by hand, but it’s better to use the Debiantools provided. To enable a module, use this command:a2enmod modulenameTo disable it, use this command:a2dismod modulenameTo get a list of the modules available to enable or disable, just use a2enmod or a2dismod without anyargument.Remember that after you’ve made any changes, you’ll need to reload Apache2 for them to takeeffect:/etc/init.d/apache2 reload7-3. Setting Up an SSL Certificate for Apache2When you set up a secure web server, clients have confirmation both that the server is who it claims tobe and that the transaction is well encrypted so their data is safe. To do this with Apache, you need touse Secure Sockets Layer (SSL), which is a secure communication protocol. Transport Layer Security(TLS) is the successor to SSL, but they work in basically the same way, so this recipe refers to SSL.SSL provides a protocol for cryptographically securing browser/web server transactions. In mostcases, only the server end is authenticated. Therefore, when the connection starts up, the client canconfirm that the server is who or what it claims to be, but not vice versa. However, once the connectionis established, both ends are secure, because only the server and that particular client have access to thekey that they’re exchanging. This is acceptable because in most cases all the server cares about is that theclient stays the same throughout the transaction. For client authentication, see the next recipe for howto set up Kerberos authentication.From the client side, you want to check both that you’re sending your data to the site that you thinkyou are communicating with and that no one is grabbing your data on the way through (a person-in-themiddleattack). SSL deals with both of these problems.Here’s a quick rundown of the SSL process:1. The client sends the web server a list of the ciphers it can use.2. The server picks the strongest cipher that both it and the client support andsends back a certificate with its name and public encryption key, signed by atrusted certificate authority (such as VeriSign).3. The client checks the CA signature; clients often store popular CAs locally, sothis can be done faster and without having to contact the CA.162Download at WoweBook.Com
CHAPTER 7 ■ WORKING WITH APACHE4. The client sends back a random number encrypted with the server’s publickey. Only the client knows the number, and only the server can decrypt it,since decryption requires the server’s private key. This means that a maliciousthird party can’t get this number.5. The server and client use this random number to generate a key to use forencrypting the rest of the transaction. So, since the malicious third-party can’tget at the random number, they can’t get at the data that’s encrypted with thekey based on it.The aim of SSL (and modern web browsers) is to make this as straightforward as possible from theclient side. This recipe and the next one use Apache2 with mod_ssl to get this set up on the web serverside.See recipe 2-3 for how to create an SSL certificate, either self-signed (which is fine for testing or for alocal site) or signed by an external CA (a much better bet if you’re a reasonably large or public site). Thecommon name (CN) must be the same as the address of your web site; otherwise, the certificate won’tmatch, and users will receive a warning when connecting. Note that you can create your certificateeither with or without a passphrase. In theory, a passphrase increases server security. However, inpractice, if someone can read or copy the private key (and therefore need the passphrase), then theyalready have root-level access to the system and could obtain the passphrase, for example by using aprogram like keylogger. A passphrase will protect against script kiddies but not against a serious hacker.On the other hand, using a passphrase means that your web server won’t start unattended (forexample, automatically on boot or reboot), because the passphrase must be typed every time the webserver starts.■ Note You should not set a challenge password. (This is not the same thing as the passphrase!)To view your certificate, use the following:openssl -x509 -text -in server.crt■ Note Set up a diary reminder of the expiry date so that you can renew it when necessary! It’s embarrassingwhen your SSL suddenly stops working.When you have your certificate back from the CA, it’s best to rename it to my.domain.org.crt (to fitApache conventions and to allow for multiple domains with multiple certificates) and to rename the keyfile similarly. You should then verify the certificate:openssl verify -CAfile /path/to/trusted_ca.crt -purpose sslserver my.domain.org.crt163Download at WoweBook.Com
Page 2:
Download at WoweBook.Com
Page 5 and 6:
Download at WoweBook.Comiii
Page 7 and 8:
Contents■About the Author .......
Page 9 and 10:
■ CONTENTS3-7. Writing a Nagios P
Page 11 and 12:
■ CONTENTS■Chapter 8: Using the
Page 13 and 14:
■ CONTENTSAbout the Author■Juli
Page 15 and 16:
■ CONTENTSAcknowledgmentsMany tha
Page 17 and 18:
■ CONTENTSIntroductionThis book i
Page 19 and 20:
■ INTRODUCTIONDownloading the Cod
Page 21 and 22:
C H A P T E R 1■ ■ ■Saving Yo
Page 23 and 24:
CHAPTER 1 ■ SAVING YOURSELF EFFOR
Page 25 and 26:
Page 27 and 28:
Page 29 and 30:
Page 31 and 32:
Page 33 and 34:
Page 35 and 36:
Page 37 and 38:
Page 39 and 40:
Page 41 and 42:
C H A P T E R 2■ ■ ■Centraliz
Page 43 and 44:
CHAPTER 2 ■ CENTRALIZING YOUR NET
Page 45 and 46:
Page 47 and 48:
Page 49 and 50:
Page 51 and 52:
Page 53 and 54:
Page 55 and 56:
Page 57 and 58:
Page 59 and 60:
Page 61 and 62:
Page 63 and 64:
Page 65 and 66:
Page 67 and 68:
Page 69 and 70:
Page 71 and 72:
Page 73 and 74:
Page 75 and 76:
Page 77 and 78:
Page 79 and 80:
Page 81 and 82:
Page 83 and 84:
C H A P T E R 3■ ■ ■Monitorin
Page 85 and 86:
CHAPTER 3 ■ MONITORING AND UPDATI
Page 87 and 88:
Page 89 and 90:
Page 91 and 92:
Page 93 and 94:
Page 95 and 96:
Page 97 and 98:
Page 99 and 100:
Page 101 and 102:
Page 103 and 104:
Page 105 and 106:
Page 107 and 108:
Page 109 and 110:
Page 111 and 112:
Page 113 and 114:
Page 115 and 116:
C H A P T E R 4■ ■ ■Taking Ba
Page 117 and 118:
CHAPTER 4 ■ TAKING BACKUPS AND MA
Page 119 and 120:
Page 121 and 122:
Page 123 and 124:
Page 125 and 126:
Page 127 and 128:
Page 129 and 130:
Page 131 and 132: CHAPTER 4 ■ TAKING BACKUPS AND MA
Page 139 and 140: C H A P T E R 5■ ■ ■Working w
Page 141 and 142: CHAPTER 5 ■ WORKING WITH FILESYST
Page 155 and 156: C H A P T E R 6■ ■ ■Securing
Page 157 and 158: CHAPTER 6 ■ SECURING YOUR SYSTEMS
Page 179 and 180: CHAPTER 7 ■ WORKING WITH APACHEOn
Page 181: CHAPTER 7 ■ WORKING WITH APACHEdi
Page 185 and 186: CHAPTER 7 ■ WORKING WITH APACHE
Page 187 and 188: CHAPTER 7 ■ WORKING WITH APACHEAl
Page 189 and 190: CHAPTER 7 ■ WORKING WITH APACHE
Page 191 and 192: C H A P T E R 8■ ■ ■Making Be
Page 193 and 194: CHAPTER 8 ■ USING THE COMMAND LIN
Page 207 and 208: CHAPTER 9 ■ WORKING WITH TEXT IN
Page 223 and 224: C H A P T E R 10■ ■ ■Things G
Page 225 and 226: CHAPTER 10 ■ THINGS GO IN, THINGS
Page 233 and 234:
C H A P T E R 11■ ■ ■Tracking
Page 235 and 236:
CHAPTER 11 ■ TRACKING DOWN BUGSTh
Page 237 and 238:
CHAPTER 11 ■ TRACKING DOWN BUGS01
Page 239 and 240:
CHAPTER 11 ■ TRACKING DOWN BUGS
Page 241 and 242:
Page 243 and 244:
Page 245 and 246:
CHAPTER 11 ■ TRACKING DOWN BUGSTh
Page 247 and 248:
CHAPTER 11 ■ TRACKING DOWN BUGSAn
Page 249 and 250:
CHAPTER 11 ■ TRACKING DOWN BUGS#
Page 251 and 252:
C H A P T E R 12■ ■ ■Managing
Page 253 and 254:
CHAPTER 12 ■ MANAGING TIME AND PE
Page 255 and 256:
Page 257 and 258:
Page 259 and 260:
Page 261 and 262:
Page 263 and 264:
Page 265 and 266:
Page 267 and 268:
APPENDIX■ ■ ■Perl TipsSee rec
Page 269 and 270:
APPENDIX ■ PERL TIPS• Date::Par
Page 271 and 272:
APPENDIX ■ PERL TIPSPerl Syntax N
Page 273 and 274:
■ ■ ■Index■Symbols$CDPATH,
Page 275 and 276:
■ INDEXenscript option (printing)
Page 277 and 278:
■ INDEX■NNagiosadding hosts to,
Page 279 and 280:
■ INDEXsyslogcentralized logging
Page 281 and 282:
Download at WoweBook.Com
show all

Linux System Administration Recipes A Problem-Solution Approach

Create successful ePaper yourself

Delete template?

Save as template?