RHEL6-46– BOOT PROCESS

                            RHEL6-46– BOOT PROCESS  

RHEL 6:

Have you ever thought what happen in between you switch on the power button and prompted for username/password?  

The tasks ran behind are collectively termed as BOOT PROCESS,

It starts after pressing power button,

LINUX-51 LVM REVIEW / RECAP

                                  LINUX-51  LVM REVIEW


                LINUX LVM REVIEW / RECAP:

                     

1. What is LVM
2. Why LVM is required
3. What is the difference between LVM & RAID
4. What is Physical Extent (PE) & Logical Extent (LE) 
5. Define PV, LV, VG
6. How to create PV
7. How to create VG
8. How to create LV

50 SECURITY & HARDENING (BASICS) -P5 (LOGS & LOG FILES SECURITY)

         LINUX- 50 SECURITY & HARDENING (BASICS) -P5

IN LINUX (RHEL6 & RHEL7),

USER/LOGIN SECURITY

NETWORK SECURITY

FILE / OPERATING SYSTEM SECURITY

PHYSICAL SECURITY

LOG EVERYTHING

LOG FILE SECURITY

We already covered USER, NETWORK, FILE/OPERATING SYSTEM SECURITY and PHYSICAL SECURITY.

Now it’s time to collect & secure evidence.

LOG EVERYTHING

LINUX- 49 SECURITY & HARDENING (BASICS) -P4 (PHYSICAL SECURITY)

              LINUX- 49 SECURITY & HARDENING (BASICS) -P4

IN LINUX (RHEL6 & RHEL7),

USER/LOGIN SECURITY

NETWORK SECURITY

FILE / OPERATING SYSTEM SECURITY

PHYSICAL SECURITY

LOG EVERYTHING

LOG FILE SECURITY

We already covered USER, NETWORK, & FILE/OPERATING SYSTEM SECURITY. Let’s start with PHYSICAL SECURITY.

User/Network/File & Operating system security is already implemented, then why physical security is required?

48 SECURITY & HARDENING (BASICS) -P3 (FILE/OPERATING SYSTEM SECURITY)

        LINUX- 48 SECURITY & HARDENING (BASICS) -P3

IN LINUX (RHEL6 & RHEL7),

USER/LOGIN SECURITY

NETWORK SECURITY

FILE / OPERATING SYSTEM SECURITY

PHYSICAL SECURITY

LOG EVERYTHING

LOG FILE SECURITY

We already covered USER SECURITY & NETWORK SECURITY. Let’s start FILE & OPERATING SYSTEM SECURITY.

LINUX- 47 SECURITY & HARDENING (BASICS) -P2 (NETWORK SECURITY)

         LINUX- 47 SECURITY & HARDENING (BASICS) -P2

 LINUX (RHEL6 & RHEL7),

USER/LOGIN SECURITY

NETWORK SECURITY

FILE / OPERATING SYSTEM SECURITY

PHYSICAL SECURITY

LOG EVERYTHING

LOG FILE SECURITY

We already covered USER SECURITY, Next is NETWORK SECURITY.

Once we connect to Network, it is now open for entire world. And we are not supposed to open for all, only trusted connections should be allowed.

LINUX- 46 SECURITY & HARDENING (BASICS) -P1 (USER SECURITY)

        LINUX- 46 SECURITY & HARDENING (BASICS) -P1

IN LINUX (RHEL6 & RHEL7),

WHAT IS SECURITY?

As I know, to protect something from unwanted or unauthorized access is security. Whatever is unauthorized its illegal because its done without my consent.

It’s a generalized statement. But very true in all aspects to secure our belongings from harm/damage.

Same is applicable here in case of our Systems.

Area of Concern,

USER/LOGIN SECURITY

NETWORK SECURITY

FILE / OPERATING SYSTEM SECURITY

PHYSICAL SECURITY

LOG EVERYTHING

LOG FILE SECURITY

LINUX- 42 TCPDUMP -P2

                           LINUX- 42 TCPDUMP -P2

TCPDUMP Part1
TCPDUMP-P1

WHAT IS TCPDUMP AND Its SIGNIFICANCE,

In previous post we learned about various switches used with tcpdump and here we will learn about expressions with tcpdump.

Type / Direction / Protocol

TYPE: host, net & port

DIRECTION: src & dst

PROTOCOL: tcp, udp, icmp, arp ……and more

TYPE:

LINUX- 42 TCPDUMP -P1

                              LINUX- 42 TCPDUMP -P1

TCPDUMP Part2
TCPDUMP-P2

WHAT IS TCPDUMP AND Its SIGNIFICANCE,

A Packet Sniffer or Network Analyzer or Trace Network traffic

Or Simply answer of Wireshark by UNIX.

Different parameters can be assigned to tcpdump for various results.

It works at Network layer and we know that network traffic travels in packets. Each packet having header which contains information which need to travel them across network. Most valuable info carried by TCP Header is source & destination address, state info and protocol identifiers. Rest of packet contains actual data.

LINUX- 41 AUDIT (RHEL-7) P4

                          LINUX- 41 AUDIT (RHEL-7) P4

Other Posts under audit,
Auditd P1
Auditd P2
Auditd P3

HOW TO REPORT & TRACE AUDIT LOGS:

There are three commands,

ausearch = to query audit logs, various criteria’s can be applied.

aureport = for summary report

autrace  = to generate audit records from a specific process

All above commands can run by “root” only.

aureport

tool that produces summary reports of the audit system logs from /var/log/audit/audit.log

LINUX- 40 AUDIT (RHEL-7) P3

                             LINUX- 40 AUDIT (RHEL-7) P3            

Other Posts under audit,
Auditd P1
Auditd P2
Auditd P4

HOW TO SEARCH AUDIT LOGS:

[root@rhel7-server ~]# ls -l /var/log/audit/audit.log

-rw-------. 1 root root 7523772 Sep  1 14:58 /var/log/audit/audit.log

There are three commands,

ausearch = to query audit logs, various criteria’s can be applied.

aureport = for summary report

autrace  = to generate audit records from a specific process

All above commands can run by “root” only.

LINUX- 39 AUDIT (RHEL-7) P2

                         LINUX- 39 AUDIT (RHEL-7) P2

Other Posts under audit,
Auditd P1
Auditd P3
Auditd P4

WHAT IS AUDIT AND IT’s SIGNIFICANCE,

HOW TO CREATE/DELETE/EDIT/DISABLE/REMOVE AUDIT LOGS:

Apart from default auditing we can configure the rules to direct auditd to keep watch on particular file/action.

The Audit system operates on a set of rules that define what is to be captured in the log files. There are three types of Audit rules that can be specified:

LINUX- 38 AUDIT (RHEL-7) P1

                   LINUX- 38 AUDIT (RHEL-7) P1

Other Posts under audit,
Auditd P2
Auditd P3
Auditd P4

WHAT IS AUDIT AND IT’s SIGNIFICANCE,

What is Audit and why it is required?

If we consider the term Audit in general then it means inspection of something by independent body to validate the authenticity of that thing.

Here in case of Linux, the term Audit is used for inspection of every action on server like,

LINUX- 37 SAR (RHEL-7) P2

                         LINUX- 37 SAR (RHEL-7) P2

**Its same for RHEL6 as well as RHEL7.

Other posts under SAR,

SAR - P1
SAR - P2

Cron Entry:

/etc/cron.d/sysstat

Log Dir:

/var/log/sa

Let’s start working with SAR,

VERSION,

LINUX- 36 SAR (RHEL-7) P1

                              LINUX- 36 SAR (RHEL-7) P1

**Its same for RHEL6 as well as RHEL7**

Other posts under SAR,

SAR - P1
SAR - P2

System Activity Report (SAR)

Detailed overview of system to call every performance/utilization data, even can retrieve historical data as well.

The sar command produces system utilization reports based on the data collected by sadc. “sadc” used to collect the performance/utilization related files and “sar” processes those files to refine the result as per our requirement.

LINUX- 33 LINUX LOGS (RHEL-7) P3

                   LINUX- 33 LINUX LOGS (RHEL-7) P3

HOW TO VIEW LINUX LOG’s,

All Posts under Linux Logs:

LINUX LOGS (RHEL-7) P1

LINUX LOGS (RHEL-7) P2

LINUX LOGS (RHEL-7) P3

Well, got idea about almost all logs under /var/log and their significance.

GREAT….

Now let’s check, how to view them.

LINUX- 32 LINUX LOGS (RHEL-7) P2

                   LINUX- 32 LINUX LOGS (RHEL-7) P2

LINUX LOG’s AND IT’s SIGNIFICANCE,

All Posts under Linux Logs:

LINUX LOGS (RHEL-7) P1
LINUX LOGS (RHEL-7) P2
LINUX LOGS (RHEL-7) P3

Still we are roaming under /var/log, almost all individual log files are covered, now time to directories under /var/log.

SUBDIRECTORIES UNDER /VAR/LOG

LINUX- 31 LINUX LOGS (RHEL-7) P1

                   LINUX- 31 LINUX LOGS (RHEL-7) P1

LINUX LOG’s AND IT’s SIGNIFICANCE,

All Posts under Linux Logs:

LINUX LOGS (RHEL-7) P1
LINUX LOGS (RHEL-7) P2
LINUX LOGS (RHEL-7) P3

When every thing is green and all are Happy Happy, then nobody bothers about anything. Even they don’t know the name of person who is responsible to manage their system. But when there is any issue with system then the magic start…

Everyone is thinking about…

Who is looking in to the issue?

Who is managing our system?

what’s his/her name & extension?

what is the ETR?

Where is update?

Chaos depends upon how bigger the issue is. You are the sys admin and now you are the center of attraction…

CHEERS and CONGRATS ……

RHEL6–45– IP TABLES IN LINUX -P7

                         RHEL6–45– IP TABLES IN LINUX -P7

IP Tables digging deeper,

Other Posts under IPTABLES series,

IP TABLES IN LINUX -P1

IP TABLES IN LINUX -P2

IP TABLES IN LINUX -P3

IP TABLES IN LINUX -P4

IP TABLES IN LINUX -P5

IP TABLES IN LINUX -P6

IP TABLES IN LINUX -P7

CONFIGURE IPTABLE LOGGING-2:

Great, our requirement is fulfilled.

But still I think that collecting garbage is not wise, also putting all at /var/log/messages will create annoyance while searching something really serious.

RHEL6–44– IP TABLES IN LINUX -P6

                         RHEL6–44– IP TABLES IN LINUX -P6

IP Tables digging deeper,

Other Posts under IPTABLES series,

IP TABLES IN LINUX -P1

IP TABLES IN LINUX -P2

IP TABLES IN LINUX -P3

IP TABLES IN LINUX -P4

IP TABLES IN LINUX -P5

IP TABLES IN LINUX -P6

IP TABLES IN LINUX -P7

CONFIGURE IPTABLE LOGGING-1:

We already learned there is a target called LOG. Now time to use it,

So, what it will do? Let’s configure and find out ourselves…

I want to know what firewall is doing with ssh,