Pass the RedHat RHCE RH302 Questions and answers with ValidTests

Do the following steps as:

1.vi /etc/hosts.deny

sshd: 192.168.0. EXCEPT 192.168.0.4

We can secure the services using tcp_wrappers. There are main two files, /etc/hosts.allow and /etc/hosts.deny.

There will be three stage access checking

-Is access explicitly permitted? Means permitted from /etc/hosts.allow?

- Otherwise, Is access explicitly denied? Means denied from /etc/hosts.deny?

- Otherwise, by default permit access if neither condition matched.

To deny the services we can configure /etc/hosts.deny file using ALL and EXCEPT operation. Pattern of /etc/hosts.allow and /etc/hosts.deny file is:

Demon_list:client_list:options

In Client list can be either domain name or IP address.

Do the following steps as:

1. Rename the file named.caching-nameserver.conf into named.conf file located into /var/named/chroot/etc

#mv /var/named/chroot/etc/named.caching-nameserver.conf /var/named/chroot/etc/named.conf

2. Check the permission and ownership as well as SELinux Context should be like as:

-rw-r----- root named system_u:object_r:named_conf_t /var/named/chroot/etc/named.conf

If selinux context is mismatch use the restorecon –R /var command

3.vi /etc/named.conf

zone “example.com” IN {

type master;

file “example.com.zone”;

};

/var/named/chroot/etc/named.conf file is used to register the zone as well as specify the global option for DNS server. There are two types of zone, i. Master, which contains the original data. ii. Slave, backup of master. Here is the example of master zone configuration.

4.vi /var/named/chroot/var/named/example.com.zone

$TTL 345345

@ IN SOA @ webmaster.example.com.(

101;Serial Number

1H;Refresh Time

1M;Retry Time

1W;Expire Time

1D;Minimum Time to Live

)

@ IN NS 192.100.0.X

www 0 IN A 192.100.0.1

www 0 IN A 192.100.0.2

www 0 IN A 192.100.0.3

www 0 IN A 192.100.0.4

www 0 IN A 192.100.0.5

3.service named start

4.rndc reload

5.chkconfig named on

6. Check the permission as well as SELinux Context should like this:

-rw-r--r-- root named root:object_r:named_zone_t /var/named/chroot/var/named/example.com.zone

If selinux context is mismatch use the restorecon –R /var command

7.service named start

8.rndc reload

9.chkconfig named on

Zone file should create on /var/named/chroot/var/named. Default Directory Path is specified on /var/named/chroot/etc/named.conf file.

$TTLTime To Live, How much seconds cache server stores the information about DNS. And Five Parameters specified Serial Number used by slave to synchronize withmaster server. Refresh and Retry Time used by slave server. NS is the Name (DNS) server where lookup the domain. A (Associated IP) for particular host.

Do the following steps as:

1.vi /etc/samba/smb.conf

[global]

netbios name=station?

workgroup=station?

security=user

smb passwd file=/etc/samba/smbpasswd

encrypt passwords=yes

hosts allow= .example.com

[data]

path=/data

public=no

writable=no

browsable=yes

2.smbpasswd -a jeff

3.service smb start

4.chkconfig smb on

/etc/samba/smb.conf. There are some pre-defined section, i. globaluse to define the global options, ii. Printersuse to share the printers, iii. homesuse the share the user’s home directory.

Security=uservalidation by samba username and password. May be there are other users also. To allow certain share to certain user we should use valid users option.

smbpasswdHelps to change user’s smb password. –a option specifies that the username following should be added to the local smbpasswd file.

Do the following steps as:

1.vi /etc/hosts.deny

sshd:ALL EXCEPT .example.com

or

1.vi /etc/hosts.deny

sshd:ALL

2.vi /etc/hosts.allow

sshd:.example.com

We can secure the services using tcp_wrappers. There are main two files, /etc/hosts.allow and /etc/hosts.deny.

There will be three stage access checking

- Is access explicitly permitted? Means permitted from /etc/hosts.allow?

- Otherwise, Is access explicitly denied? Means denied from /etc/hosts.deny?

- Otherwise, by default permit access if neither condition matched.

To deny the services we can configure /etc/hosts.deny file using ALL and EXCEPT operation. Pattern of /etc/hosts.allow and /etc/hosts.deny file is:

Demon_list:client_list:options

In Client list can be either domain name or IP address.

Do the following steps as:

1.vi /etc/samba/smb.conf

[global]

netbios name=station?

workgroup=station?

security=user

smb passwd file=/etc/samba/smbpasswd

encrypt passwords=yes

hosts allow= .example.com

[data]

path=/data

public=no

writable=no

browsable=yes

2.smbpasswd -a eric

3.service smb start

4.chkconfig smb on

/etc/samba/smb.conf. There are some pre-defined section, i. globaluse to define the global options, ii. Printersuse to share the printers, iii. homesuse the share the user’s home directory.

Security=uservalidation by samba username and password. May be there are other users also. To allow certain share to certain user we should use valid users option.

smbpasswdHelps to change user’s smb password. –a option specifies that the username following should be added to the local smbpasswd file.

Do the following steps as:

1.touch /etc/nologin

2.vi /etc/securetty

comment all available terminall then first.

If /etc/nologin file is created, then pam modules pan_nologin deny to all non-root users to login locally.

/etc/pam.d/login file calls the module.

#%PAM-1.0

auth requiredpam_securetty.so

auth requiredpam_stack.so service=system-auth

auth requiredpam_nologin.so

account requiredpam_stack.so service=system-auth

password requiredpam_stack.so service=system-auth

# pam_selinux.so close should be the first session rule

session requiredpam_selinux.so close

session requiredpam_stack.so service=system-auth

session optionalpam_console.so

# pam_selinux.so open should be the last session rule

session requiredpam_selinux.so multiple open

pam_securetty modules checks the /etc/securetty file, which terminal are available to root. If terminal is not available in this file then pam_securetty module deny to login on unavailable terminal to root user.

Do the following steps as:

1.vi /etc/hosts.deny

nfs,portmap:ALL EXCEPT .example.com, trusted.cracker.org

We can secure the services using tcp_wrappers. There are main two files, /etc/hosts.allow and /etc/hosts.deny.

There will be three stage access checking

-Is access explicitly permitted? Means permitted from /etc/hosts.allow?

- Otherwise, Is access explicitly denied? Means denied from /etc/hosts.deny?

- Otherwise, by default permit access if neither condition matched.

To deny the services we can configure /etc/hosts.deny file using ALL and EXCEPT operation. Pattern of /etc/hosts.allow and /etc/hosts.deny file is:

Demon_list:client_list:options

In Client list can be either domain name or IP address.

Do the following steps as:

vi /etc/mail/virtusertable

@cracker.orgeric

service sendmail restart

/etc/mail/virtusertable file is used to send the mail coming for virtual user to real user. According to question, all mail to cracker.org should get by eric user so

@cracker.orgeric : Which sends all mail of cracker.org to eric user.

Do the following steps as:

1.vi /etc/security/limits.conf

user1hardnproc7

2.vi /etc/pam.d/system-auth

sessionrequired/lib/security/pam_limits.so

To limit the number of process or number of logins, we should configure on /etc/security/limits.conf. First Columns contains the username separated by comma or @group name. Second column either hard or soft limits. Third columns called the item, maxloigns or nproc etc.

To identify the session of users we should call the pam_limits module in /etc/pam.d/system-auth.

Do the following steps as:

1.vi /etc/samba/smb.conf

[global]

netbios name=station?

workgroup=linuxgroup

security=share

printcap name=/etc/printcap

load printers=yes

printing=cups

[printers]

path=/var/spool/samba

browsable=yes

printable=yes

guest ok=no

writable=no

Samba servers helps to share the data between linux and windows. Configuration file is /etc/samba/smb.conf. There are some pre-defined section, i. globaluse to define the global options, ii. Printersuse to share the printers, iii. homesuse to share the user’s home directory.

/etc/printcap file contains all installed printers name. Printing is print system used on server.