what is Open Ldap and how to configure it?

Open LDAP:

LDAP stands for Lightweight Directory Access Protocol. As the name suggests, it is a lightweight client-server protocol for accessing directory services, specifically X.500-based directory services. LDAP runs over TCP/IP or other connection oriented transfer services. LDAP is defined in RFC2251 "The Lightweight Directory Access Protocol (v3).

In simple Words "LDAP is a protocol for managing related information from a centralized location through the use of a file and directory hierarchy. It functions in a similar way to a relational database in certain ways, and can be used to organize and store any kind of information. LDAP is commonly used for centralized authentication."

How Does Open LDAP Work:

An LDAP client connects to an LDAP server and asks it a question. The server responds with the answer, or with a pointer to where the client can get more information (typically, another LDAP server). No matter what LDAP server a client connects to, it sees the same view of the directory; a name presented to one LDAP server references the same entry it would at another LDAP server. This is an important feature of a global directory service, like LDAP.

OpenLDAP Installation and Configuration:

I'm using the following Network Details:

System name: ldap.example.com
System IP: 192.168.0.254
Domain Name: example.com

Use the following steps:

1. Add user accounts for testing the ldap server :

                               #useradd ldapuser1

             #passwd ldapuser1

             #useradd ldapuser2

                      #passwd ldapuser2

2. Install packages of ldap: 

                             #yum install openldap* -y 

following packages installed by this command:

    compat-openldap.i386 0:2.1.30-6.4E

    openldap-clients.i386 0:2.2.13-6.4E

    openldap-devel.i386 0:2.2.13-6.4E

    openldap-servers.i386 0:2.2.13-6.4E

    openldap-servers-sql.i386 0:2.2.13-6.4E

3. Create ldap root user password after installing the open ldap packages: 

                             #slappasswd

                              New password:

              Re-enter new password:

              {SSHA}cWB1VzxDXZLf6F4pwvyNvApBQ8G/DltW

4. Update /etc/openldap/slapd.conf for the root password:

                             #vim /etc/openldap/slapd.conf

              database bdb 

              suffix "dc=example,dc=com" 

              rootdn "cn=Manager,dc=example,dc=com" 

              rootpw {SSHA}cWB1VzxDXZLf6F4pwvyNvApBQ8G/DltW
save & exit.

5. Migrate local users to LDAP:

                 # grep root /etc/passwd > /etc/openldap/passwd.root

                 # grep test1 /etc/passwd > /etc/openldap/passwd.test1

                # grep test2 /etc/passwd > /etc/openldap/passwd.test2

 Note: Repeat the same for the rest of users

6. Update default settings on file /usr/share/openldap/migration/migrate_common.ph : 

                       DEFAULT_MAIL_DOMAIN = “example.com”;

                       DEFAULT_BASE = “dc=example,dc=com”;

7. Start ldap service:
              #service ldap restart
              #chkconfig ldap on

8. Create ldif file for domain (example.com). using .ldif extension with file (for example: test.ldif):
              #vim /etc/openldap/test.ldif

                    dn: dc=example,dc=com
                 dc: example
                 objectClass: top
                 objectClass: domain
                 dn: ou=users,dc=example,dc=com
                 ou: users
                 objectClass: top
                 objectClass: organizationalUnit
                 dn: ou=Group,dc=example,dc=com
                 ou: Group
                 objectClass: top
                 objectClass: organizationalUnit

 
 save & exit.

9. Create ldif file for all test users:

#cd /usr/share/openldap/migration/
#grep root /etc/passwd > /etc/openldap/passwd.root
#grep ldapuser1 /etc/passwd > /etc/openldap/passwd.ldapuser1
#grep ldapuser2 /etc/passwd > /etc/openldap/passwd.ldapuser2
#./migrate_passwd.pl /etc/openldap/passwd.root /etc/openldap/root.ldif
#./migrate_passwd.pl /etc/openldap/passwd.ldapuser1 /etc/openldap/ldapuser1.ldif
#./migrate_passwd.pl /etc/openldap/passwd.ldapuser1 /etc/openldap/ldapuser2.ldif

                              

10. Modify all users ldif file like this:
                                      # vim /etc/openldap/ldapuser1.ldif

                   dn: uid=ldapuser1,dc=example,dc=com
                   uid: ldapuser1
                   cn: ldapuser1
                   objectClass: account
                   objectClass: posixAccount
                   objectClass: top
                   objectClass: shadowAccount
                   objectClass: radiusprofile  
                   description: 802.1x user
                   radiusFilterId: "Enterasys:version=1:policy=Enterprise User"
                   userPassword: {crypt}$1$rN6WLraT$9skdu7BpRUM6v7DiEhQXt1
                   shadowLastChange: 15419
                   shadowMin: 0
                   shadowMax: 99999
                   shadowWarning: 7 
                   loginShell: /bin/bash
                   uidNumber: 612
                   gidNumber: 612
                   homeDirectory: /home/ldapuser1

11.  Import all users in to the LDAP:

 

Add the Domain ldif file

#ldapadd -x -D “cn=Manager,dc=example,dc=com” -W -f  /etc/openldap/test.ldif

    Enter LDAP Password:

    adding new entry “dc=example,dc=com”

    adding new entry “ou=People, dc=example,dc=com”

Add the users:

#ldapadd -x -D “cn=Manager,dc=example,dc=com” -W -f  /etc/openldap/root.ldif

    Enter LDAP Password:

    adding new entry “uid=root,ou=People,dc=example,dc=com”

    adding new entry “uid=operator,ou=People,dc=example,dc=com”

#ldapadd -x -D “cn=Manager,dc=example,dc=com” -W -f  /etc/openldap/ldapuser1.ldif

    Enter LDAP Password:

    adding new entry “uid=ldapuser1,ou=People,dc=example,dc=com”

#ldapadd -x -D “cn=Manager,dc=example,dc=com” -W -f  /etc/openldap/ldapuser2.ldif

    Enter LDAP Password:

    adding new entry “uid=ldapuser2,ou=People,dc=example,dc=com”

 

 Note: Repeat the same for the rest of users.

12. Reastart the ldap service:

                            #service ldap restart

                            #chkconfig ldap on 

13. Test Ldap Server: 

       #ldapsearch -x -b 'dc=example,dc=com' '(objectclass=*)'

 

Add Monitoring targets to nagios server

Add Monitoring Targets To Nagios Server:

These Steps will perform on CLIENT MACHINE.

For adding monitor targets to nagios server, To do that you have to to install following two packages in your monitoring targets:

                                  

                                   1. nrpe

                                   2. nagios-plugin

These packages will not found in yum repository, so let us add the EPEL Repository to install packages.

Use the following command for installation:

                                   

                                   #yum install nrpe nagios-plugins-all -y

Configure Monitoring Targets:

For configure Monitoring targets edit /etc/nagios/nrpe.cfg and do this:

                                  #vim /etc/nagios/nrpe.cfg

                                  allow_hosts=127.0.0.1 192.168.0.220  ( Nagios server IP, add in line no. 81)

save & exit.

Start the nrpe service:

                                 #service nrpe restart

              #chkconfig nrpe on

Now come on NAGIOS SERVER MACHINE:

For add the clients:

                           #vim /etc/nagios/nagios.cfg

                            uncomment Line No. 52

                            cfg_dir=/etc/nagios/server

save & exit.

Create a directory "server", under "/etc/nagios":

                           #mkdir /etc/nagios/server

Create config file to the client to be monitored.

                            #vim /etc/nagios/server/clients.cfg

                               define host{

                               use                  linux-server

                               host_name      client

                               alias                client

                               address            192.168.0.200 (client ip)

                               check_period   24x7

                               notification_interval      30

                               notification_period        24x7

                               }

save & exit.

Restart Nagios service:

                             #service nagios restart

             #chkconfig nagios on

Open Nagios admin console in browser with server ip.
              If server ip is 192.168.0.220 then open browser and go to:

             http://192.168.0.220/nagios

and enter the username and password as administrator.

Click on "hosts". you will see the newly added client will be visible there.

You can define more clients by creating a seprate file under the "/etc/nagios/server" directory for each client.

sed command use in linux

"sed" Command in Linux:

sed is short for "stream editor" that allows you to filter and modifying text of any file.

Use of  "sed" command:

For examples first i'm creating here a file:

#cat > sample.txt

this is a package test file.

this is a script test file.

Press Ctrl+D after you finish entering the text.

 

Now read the file:

#cat sample.txt

this is a package test file.

this is a script test file.

Now, let's see the uses of "sed" command:

1. Replacing or substituting string:

"Sed" command is mostly used to replace the text in a file (sample.txt). The below simple "sed" command replaces the word "file" with "directory" in the file.

#sed 's/file/folder/' sample.txt

this is a package test directory.

this is a script test directory.

Here the "s" specifies the substitution operation. The "/" are delimiters. The "file" is the search pattern and the "directory" is the replacement string.

2. Replacing all the occurrence of the pattern in a line:

The substitute flag /g (global replacement) specifies the "sed" command to replace all the occurrences of the string in the line.

#sed 's/file/directory/g' sample.txt

this is a package test directory.

this is a script test directory.

3. Replacing the nth occurrence of a pattern in a line:

Use the /1, /2, /3 etc flags to replace the first, second, third occurrence of a pattern in a line. The below command replaces the second occurrence of the word "file" with "directory" in a line.

#sed 's/file/directory/2' sample.txt

this is a package test file.

this is a script test directory.

4. Duplicating the replaced line with /p flag:

The /p print flag prints the replaced line twice on the terminal. If a line does not have the search pattern and is not replaced, then the /p prints that line only once.

#sed 's/file/directory/p' sample.txt

this is a package test directory.

this is a script test directory.

this is a package test directory.

this is a script test directory.

nagios installation and configuration in linux

                             NAGIOS

Nagios is an open software that can used for networkl monitoring and infrastructure monitoring.

Nagios wil monitoring servers, switches, applications, and services. it alerts the system administrator when something went wrong and also alert back when the issues has been rectified.

with the help of Nagios you can do the following things:

1. Detect security braches.

2. Know immediately when problem arise.

3. Identify problems before they occur.

4. Share availability data with stackholders, hypothetical question.

5. Reduce downtime and business losses.

6. Plan and budget for IT upgrades.

7. And most important that Monitor your entire IT infrastructure.

Installation of Nagios Server in RHEL:

Before installing Nagios make sure that you have a properly installed and configured LAMP stack in your server.

Run the following command as root user for installing required package:

      #yum install gd gd-devel gcc glibc-common

Nagios will not be found in yum repositories, so let us add the EPEL repository to install Nagios.
Install Nagios with all plugins and nagios agents (nrpe-agent) using command:

              #yum install nagios

If you got any error relating SELinux or IP tables then:
Add the following line in /etc/sysconfig/iptables
      
               #vim /etc/sysconfig/iptables
                -A INPUT -m state NEW -m tcp -p tcp --dport 80 -j ACCEPT
                 #service iptables restart

Configuration of Nagios:

Add the Admin mail Address in the nagios contact file to receive alerts from nagios server. To do that edit file:

                 #vim /etc/nagios/objects/contacts.cfg
                  email          server.nagios@example.com
Save it.
                  #vim /etc/httpd/conf.d/nagios.conf
comment lines 15,16 and uncomment and change lines 17,18,19 :
                        #order allow,deny
                   #Allow for all
                   order deny,allow
                   Deny from all
                   Allow from 127.0.0.1  192.168.1.0/24 (network address)

Save it.

Set Nagios admin Password:

Run the following command to set the password of nagios administrator:

                  #htpasswd /etc/nagios/passwd nagiosadmin
            New Password:
            Re-Type new Password:
            updating password for user nagiosadmin.

start nagios and httpd services:
                    #service nagios restart
            #chkconfig nagios on

            #service httpd restart
            #chkconfig httpd on

How to access Nagios Admin Console:

Open Nagios admin console with server ip.
              If server ip is 192.168.0.220 then open browser and go to:

             http://192.168.0.220/nagios

and enter the username and password as administrator.

encrypt and decrypt files in linux

GnuPG:

GnuPG stands for GNU Privacy Guard. GnuPG is an open implementation of OpenPGP ( Pretty Good Privacy ) standard as defined in RFC 4880. it is GNU's tool for secure communication and data storage. It can be used to encrypt data and to create digital signatures. It includes an advanced key management facility.

Using GnuPG gpg command you can generate public and private keys. To encrypt and decrypt files with a password, use gpg command.

How to check Gnu PG Package On Linux:

Most Linux distributions today include GnuPG by default. To find out if this is the case, open a command prompt and type

                                            #gpg --version

If output is GnuPG x.y.z or some later version, then GnuPG package already installed.

How to install GnuPG on Linux:

use the following command to install GnuPg tool.

                                           #yum install gnupg

Encrypting a file in linux:

To encrypt a single file, use command gpg as follows:

                                     #gpg -c filename

For example:

To encrypt anshuamn.txt file, type the command:

                                     #gpg -c anshuman.txt

                     Enter passphrase:<Password For Encrypt the File>

                     Repeat passphrase:<Password For Encrypt The File>

if you ever forgot your password (passphrase), you cannot recover the data as it use very strong encryption.

Decrypt a file in linux:

To decrypt file use the gpg command as follow:

                                       #gpg <encrypt file name>

For example:

To decrypt anshuamn.txt.gpg file, type the command:

                                     #gpg -c anshuman.txt.gpg

                     gpg anshuman.txt.gpg

                     gpg: CAST5 encrypted data

                  Enter passphrase:<enter encrypt password for decrypt the file>

Decrypt file and write output to file linux.txt you can run command:

                                       #gpg anshuman.gpg –o linux.txt

Nmap (network Mapper)

Nmap Commands for Linux:

The Nmap ( Network Mapper ) is an open source and a very versatile tool for Linux system/network administrators. It is a security tool for network exploration, security scanning and auditing.

Nmap security tool scans for Live hosts, Operating systems, packet filters and open ports running on remote hosts.

Significant effort has been put into decent nmap performance  for  non- root  users.   Unfortunately,  many critical kernel interfaces (such as raw sockets) require root privileges.  nmap should be run as root when-ever possible (not setuid root, of course).

The Nmap command syntax is:

                         # nmap [Scan Type(s)] [Options] {target specification}

How To install Nmap :

To install Nmap on distribution specific use the following command.

                        # yum install nmap

1. Scan using IP Address:

 #nmap 192.168.0.0/24

 Starting Nmap 5.21 ( http://nmap.org ) at 2014-09-18 11:44 EST

 Nmap scan report for 192.168.0.1

 Host is up (0.0043s latency).

 Not shown: 998 closed ports

 PORT STATE SERVICE

 80/tcp open http

 443/tcp open https

2. Scan using “-v” command:

# nmap -v 192.168.0.1

Starting Nmap 4.11 ( http://nmap.org/ ) at 2014-06-14 15:43 EST

Initiating ARP Ping Scan against 192.168.0.1 [1 port] at 15:43

The ARP Ping Scan took 0.01s to scan 1 total hosts.

Initiating SYN Stealth Scan against server2.tecmint.com (192.168.0.1) [1680 ports] at 15:43

Discovered open port 22/tcp on 192.168.0.1

Discovered open port 80/tcp on 192.168.0.1

The SYN Stealth Scan took 0.30s to scan 1680 total ports.

Host server2.tecmint.com (192.168.0.1) appears to be up ... good.

Interesting ports on server2.tecmint.com (192.168.0.1):

Not shown: 1674 closed ports

PORT     STATE SERVICE

22/tcp   open  ssh

80/tcp   open  http

111/tcp  open  rpcbind

Nmap finished: 1 IP address (1 host up) scanned in 0.485 seconds

               Raw packets sent: 1681 (73.962KB) | Rcvd: 1681 (77.322KB)

3. Scan a whole Subnet:

[root@server1 ~]# nmap 192.168.0.*

Starting Nmap 4.11 ( http://nmap.org ) at 2013-11-11 16:11 EST

Interesting ports on test1.example.com (192.168.0.1):

Not shown: 1677 closed ports

PORT    STATE SERVICE

22/tcp  open  ssh

111/tcp open  rpcbind

851/tcp open  unknown

Interesting ports on test2.example.com (192.168.0.2):

Not shown: 1674 closed ports

PORT     STATE SERVICE

22/tcp   open  ssh

80/tcp   open  http

111/tcp  open  rpcbind

Nmap finished: 256 IP addresses (2 hosts up) scanned in 5.550 seconds

You have new mail in /var/spool/mail/root

4. Scan a Host to check its protected by Firewall:

To scan a host if it is protected by any packet filtering software or Firewalls.

[root@server1 ~]# nmap -PN 192.168.0.1

Starting Nmap 4.11 ( http://nmap.org ) at 2013-11-11 16:30 EST

Interesting ports on test2.tecmint.com (192.168.0.1):

Not shown: 1674 closed ports

PORT     STATE SERVICE

22/tcp   open  ssh

80/tcp   open  http

111/tcp  open  rpcbind

Nmap finished: 1 IP address (1 host up) scanned in 0.399 seconds

5. Enable OS Detection with Nmap:

Use the option “-O” and “-osscan-guess” also helps to discover OS information.

[root@test1 ~]# nmap -O server2.tecmint.com

Starting Nmap 4.11 ( http://nmap.org ) at 2014-11-11 17:40 EST

Interesting ports on server2.tecmint.com (192.168.0.1):

Not shown: 1674 closed ports

PORT     STATE SERVICE

22/tcp   open  ssh

80/tcp   open  http

111/tcp  open  rpcbind

No exact OS matches for host (If you know what OS is running on it, see http://nmao.org).

TCP/IP fingerprint:

SInfo(V=4.11%P=i686-redhat-linux-gnu%D=11/11%Tm=52815CF4%O=22%C=1%M=080027)

TSeq(Class=TR%IPID=Z%TS=1000HZ)

T1(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)

T2(Resp=N)

T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)

T4(Resp=Y%DF=Y%W=0%ACK=O%Flags=Option -O and -osscan-guess also helps to discover OS

R%Ops=)

T5(Resp=Y%DF=Y%W=0%ACK=S++%Flags=AR%Ops=)

T6(Resp=Y%DF=Y%W=0%ACK=O%Flags=R%Ops=)

T7(Resp=Y%DF=Y%W=0%ACK=S++%Flags=AR%Ops=)

PU(Resp=Y%DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Uptime 0.221 days (since Mon Nov 11 12:22:16 2014)

Nmap finished: 1 IP address (1 host up) scanned in 11.064 seconds

You have new mail in /var/spool/mail/root

6. Find Nmap version:

[root@server1 ~]# nmap -V

Nmap version 4.11 ( http://nmap.org )

You have new mail in /var/spool/mail/root

linux file structure

Linux File Structure:

In the Linux file structure files are grouped according to purpose. The Linux system contains thousand of files located within many directories. All directories are organized in a tree-structure like manner.

• The 'trunk' of the tree is the root directory.
• The root directory is simply identified as a "/".
• All other directories 'branch' off from the trunk.

/bin/

This is where all your programs that are accessible to all users will be stored once installed. If you search this directory, you will find that both ls and pwd reside here. The cd command is actually built into the shell we are using (bash), which is in this directory too.

/dev/

This is a virtual directory where your devices are 'stored.' Devfs allows Linux to list devices (hard drives, input devices, modems, sound cards, etc.) as 'files.' For instance, for a device that represents a hard drive, like /dev/sda, you can mount it to the filesystem to access it. On the other hand, if you have a file that represents a line printer like /dev/lpr, you can write directly to it to send the information to the printer.

/etc/

This is where you'll find all your global settings. Daemons such as ssh, telnet, and smtp/pop3 mail servers find their configuration files here. Also in /etc/ is the system's password file, group lists, user skeletons, and cron jobs.

/home/

This is the default directory where non-root users' homes are created. When you add a user, the default home directory is created as /home/username. You can change this default in the proper file in /etc/.

/lib/

This is where shared libraries (perl, python, C, etc.) are stored. Also in /lib/ are your kernel modules.

/mnt/

This is the default location for mounting cdroms, floppy disk drives, USB memory sticks, etc. You can mount anything anywhere, but by default there is a /mnt/floppy (if you have a floppy drive) and /mnt/cdrom.

/proc/

This virtual folder contains information about your system. You can view processor statistics/specifications, PCI bus information, ISA bus information, and pretty much anything else you want to know about the hardware on your system.

/root/

This is the home directory of the administrative user (called "root"). It functions exactly like the normal home directories, but is housed here instead.

/sbin/

This is where system programs are installed. These include fdisk, tools to make partitions, certain network tools, and other things that normal users shouldn't have a need for.

/tmp/

This is the default location to place files for temporary use. When you install a program, it uses /tmp/ to put files during installation that won't be needed once the program is installed.

/usr/

This contains various programs, non-daemon program settings and program resources.

/var/

This is where your log files, system mail messages and database of installed programs are stored.

At the time a new file is created, it gets a free inode. In that inode is the following information:

·         Owner and group owner of the file.

·         File type (regular, directory, ...)

·         Permissions on the file 

·         Date and time of creation, last read and change.

·         Date and time this information has been changed in the inode.

·         Number of links to this file (see later in this chapter).

·         File size

·         An address defining the actual location of the file data.

# ls -l

total 80
-rw-rw-r--   1 root   root   31744 Feb 21 17:56 intro.doc
-rw-rw-r--   1 root   root   41472 Feb 21 17:56 Linux.doc
drwxrwxr-x   2 root   root    4096 Feb 25 11:50 course

File types in a long list:



 


   

    Symbol

   

   Meaning

  

 


  

   -

  

 Regular
  file

 

  

   d

  

 Directory

 

  

   l

  

 Link

 

  

   c

  

 Special
  file

 

  

   s

  

 Socket

 

  

   p

  

 Named
  pipe

 

  

   b

  

 Block
  device