Transcript Document

Chapter 15:
Advanced Topics and
Troubleshooting
The Complete Guide to Linux System
Administration
Objectives
• Understand X window system scripts and remote
access
• Implement basic system security
• Use simple features of common network services
• Troubleshoot common hardware and software
problems
The Complete Guide to Linux System Administration
2
X Window System Advanced
Configuration
• Challenges configuring graphical system are rare
due to improvements in:
– XFree86 X server
– Installation programs
The Complete Guide to Linux System Administration
3
Configuring X
• X software normally located in directory
/usr/X11R6
– Sometimes called X-root directory
– Version 11, release 6
– Configuration file for Red Hat Linux and Fedora
called xorg.conf located in /etc/X11 directory
– Commercial X servers use different configuration
files
The Complete Guide to Linux System Administration
4
Configuring X (continued)
• xvidtune program
– Adjust finer details of display
– Can damage monitor if used carelessly
• system-config-display program configures:
– Screen resolution
– Number of colors
The Complete Guide to Linux System Administration
5
Configuring X (continued)
The Complete Guide to Linux System Administration
6
Using X Window System
Start-up Scripts
• X Window System starts automatically every time
user logs in at graphical prompt
• startx command
–
–
–
–
Start X Window System from command line
Script located in /usr/X11R6/bin
Starts xinit program
Place scripts in user’s home directory to define
graphical configuration for user
The Complete Guide to Linux System Administration
7
Using X Window System Start-up
Scripts (continued)
• Background application
– Does not prevent program that started it from
going on to other tasks
– xinit scripts can start X client then go on to start
another
• Window manager
– Responsible for controlling graphical screen
– Started last by xinit
The Complete Guide to Linux System Administration
8
Using X Window System Start-up
Scripts (continued)
The Complete Guide to Linux System Administration
9
Adjusting the Display
of Graphical Applications
• X resource
– Separate screen elements such as:
•
•
•
•
Scroll bars
Text fonts
Mouse pointers
Title bars for windows or dialog boxes
– Collection of default X resource settings applies to
all X applications
The Complete Guide to Linux System Administration
10
Adjusting the Display of Graphical
Applications (continued)
• Resource database file
– Settings apply only when specific user runs
specific application
– Main file app-defaults located at
/usr/X11R6/lib/X11
– User’s home directory can contain additional
settings
• .Xresources
• .Xdefaults
The Complete Guide to Linux System Administration
11
Adjusting the Display of Graphical
Applications (continued)
• xrdb command
– Loads initial X database resource file
– Adds resource configuration details from files
– xrdb -load $HOME/.Xresources
• xfontsel command
– See fonts supported by X Window System
• xset command
– Adjust behavior of X to suit preferences
The Complete Guide to Linux System Administration
12
Using a Graphical Login Screen
• Most Linux distributions start in run level 5
– Graphical environment
• xdm program
– Graphical login screen provided by X display
manager
– Versions specific to KDE and GNOME called:
• kdm
• Gdm
• Session defines set of graphical programs to run
when user logs in
The Complete Guide to Linux System Administration
13
Using a Graphical Login Screen
(continued)
• Xsession file specifies which programs started by
particular session name
• xdm executes file /etc/x11/xdm/Xsession to
determine which X clients to run
• Xsession file
– Placed in user home directory
– Controls which sessions specific user has
available
• /etc/X11/xdm subdirectory files configure features
of xdm
The Complete Guide to Linux System Administration
14
Using a Graphical Login Screen
(continued)
• Any type of computer can run X server
• Graphical application decides which X server to
use
– By default uses X server on same computer
– Specify different server
• DISPLAY environment variable
• Add display option to command
• Configuring remote display security
– X server on remote host configured to allow other
computers to display programs there
The Complete Guide to Linux System Administration
15
Using a Graphical Login Screen
(continued)
• xhost command specifies name of remote
computer permitted to use local X server
– Insecure
• xauth command restricts access to users on
remote system who have specific token
– Commonly called cookie
• MIT magic cookie
The Complete Guide to Linux System Administration
16
Using a Graphical Login Screen
(continued)
• .Xauthority files
– Stored in user’s home directory
– User-to-user security system
• Remote graphical login
– Log in to Linux system, use graphical environment
as if sitting at Linux system
– Uses XDMCP
The Complete Guide to Linux System Administration
17
Displaying X Clients Remotely
• X protocol
– X Window System uses own protocol to
communicate between X server and each X client
– Can be used over network connections
The Complete Guide to Linux System Administration
18
Displaying X Clients Remotely
(continued)
The Complete Guide to Linux System Administration
19
Security Issues:
The Structure of a Secure Network
• Security divided into areas:
–
–
–
–
Physical security
User security
File security
Network security
The Complete Guide to Linux System Administration
20
Types of Security Attacks
•
•
•
•
•
•
Password cracking
Trojan horse
Buffer overflow attacks
Denial-of-service (DoS)
Port scanning
Packet sniffing
The Complete Guide to Linux System Administration
21
Security Tools
• nmap
– Most widely used port-scanning utility
– Can use variety of different scanning methods
– nmap -ss www.myplace.net
• nmapfe utility
– Graphical interface
• IPTraf program
– Popular tool for viewing network activity on LAN
The Complete Guide to Linux System Administration
22
Security Tools (continued)
• tcpdump utility
– Similar to IPTraf program
– Also includes more detailed information about
packets on network
• Ethereal
– One of the best packet-sniffing tools
– Network traffic analysis tool
The Complete Guide to Linux System Administration
23
Security Tools (continued)
• Intrusion detection system (IDS) watches
network for activity that may indicate attacker is
looking for way to enter server
• Linux Intrusion Detection System (LIDS)
– Adds module to Linux kernel
– Blocks access to resources for all users except as
configured by LIDS
The Complete Guide to Linux System Administration
24
Security Tools (continued)
• Security audit
– Review or test of how secure system really is
– What needs to be done to improve its security
• Security Administrator’s Integrated Network Tool
(SAINT) utility
– Uses Web browser interface to manage “attack”
on network
– Reports vulnerabilities it finds
The Complete Guide to Linux System Administration
25
Viruses and Worms
• Security threats designed to replicate themselves
once installed on system
• Virus tries to replicate as part of another program
• Worm attempts to infiltrate other systems on its
own
• Linux rarely subject of virus attacks
• Worms pose greater threat than viruses
The Complete Guide to Linux System Administration
26
Security Organizations
• CERT Coordination Center (CERT/CC)
– U.S. Federal government-funded software
engineering institute
– Maintains lists of security vulnerabilities, alerts,
incident reports
• System Administration, Networking, and Security
(SANS) Institute
– Education and research organization
– Visiting web site www.sans.org
The Complete Guide to Linux System Administration
27
Security Organizations
(continued)
• Global Information Assurance Certification
(GIAC) program
– Certification program for security professionals
from SANS
The Complete Guide to Linux System Administration
28
Using Network Services
• Most network services installed by default
– Controlled using script in /etc/rc.d/init.d directory
or using service command
The Complete Guide to Linux System Administration
29
Using NetFilter for Firewalls
• Firewall
– Hardware device or software program that
prevents unintended network access
• Packet filter
– Firewall that examines each packet
– Decides how to process it based on firewall rules
• NetFilter defines rules in IP tables
The Complete Guide to Linux System Administration
30
Using NetFilter for Firewalls
(continued)
• Packet stages
– Input
– Forward
– Output
• iptables command creates and manages firewall
rules
• Rules executed in order defined in chain
The Complete Guide to Linux System Administration
31
Using NetFilter for Firewalls
(continued)
• Network address translation (NAT)
– Routing technique
– Alters addresses or other information in packet
• IP masquerading
– Type of network address translation
– Packets from many computers on LAN altered to
appear as if they came from single computer
The Complete Guide to Linux System Administration
32
Using NetFilter for Firewalls
(continued)
• system-config-securitylevel program sets up
reasonable rules based on:
– How secure system should be
– Specific protocols to leave more open
• Other graphical firewall programs that use IP
tables
–
–
–
–
Firestarter
Mason
KMyFirewall
GuardDog
The Complete Guide to Linux System Administration
33
Setting Up a DNS Name Server
• Root name servers
– DNS servers designated as starting point for DNS
queries
• Master DNS server or primary DNS server
– Provides information on domain
• Slave DNS server or secondary DNS server
– Contains backup copy of DNS information
• Named
– Daemon that implements DNS
The Complete Guide to Linux System Administration
34
Setting Up a DNS Name Server
(continued)
• Caching name server
– Queries other DNS servers and caches results
• Zone
– DNS server maintains information for at least part
of domain
• Zone information files
– Define host names and corresponding IP
addresses
• rndc utility
– Control named daemon from command line
The Complete Guide to Linux System Administration
35
Setting Up a DNS Name Server
(continued)
• dig utility
– Query any DNS server
• whois
– Information about organization that registered
domain name
The Complete Guide to Linux System Administration
36
File Sharing with NFS
• Work with hard disks located all over local
network ss if part of local directory structure
• NFS protocol implemented by several daemons
–
–
–
–
rpc.mountd
nfsd
rpc.rquotad
rpc.statd
The Complete Guide to Linux System Administration
37
File Sharing with NFS (continued)
• /etc/exports file defines which local directories
should be accessible to remote users
• exportfs command activates contents of
/etc/exports
• Squashing prevents user from gaining access to
user account on NFS server because user has
same ID on NFS client
The Complete Guide to Linux System Administration
38
Setting Up a Samba Server
• Samba suite
– File and print sharing using SMB and CIFS
protocols
• Server daemons
– nmbd
– smbd
• smb.conf
– Main configuration file
The Complete Guide to Linux System Administration
39
Setting Up a Samba Server
(continued)
• Common to allow everyone with Linux user
account to log in via Samba
• SWAT
– Graphical configuration tool for Samba
– Runs as network service managed by superserver
– Access SWAT: http//localhost:901/
The Complete Guide to Linux System Administration
40
Creating a Proxy Server with
Squid
• Proxy server
– Lets one server make request for another server
– Done to improve efficiency and security of network
• Squid requires significant configuration before
use
– In file /etc/squid/squid.conf
• Transparent proxy redirects network packet
based on port to which packet addressed
The Complete Guide to Linux System Administration
41
Creating a Linux Web Server
with Apache
• Daemon named httpd
– Control with apachectl program
• /etc/httpd/conf directory
– Configuration files
• Many features implemented as loadable modules
• Container activates other directives only if
condition is met or only within particular context
The Complete Guide to Linux System Administration
42
Configuring a Basic E-mail Server
• Mail Transfer Agent (MTA) moves mail between
e-mail servers
• Mail Delivery Agent (MDA) examines messages
and delivers them to user’s mailbox file
• Mail User Agent (MUA) lets user:
– View messages stored in mailbox
– Create new messages
The Complete Guide to Linux System Administration
43
Configuring a Basic E-mail Server
(continued)
• sendmail
– Most widely known e-mail server
– Managed using standard script in /etc/rc.d/init.d
– /etc/sendmail.cf
• Configuration file
• Considered to be single most difficult Linux
configuration file to master
– m4 program
• Configure sendmail
The Complete Guide to Linux System Administration
44
Configuring a Basic E-mail Server
(continued)
• E-mail alias
– Another name that can deliver e-mail messages to
user
– Configured in sendmail with /etc/aliases file
• Monitor sendmail
–
–
–
–
/var/log/maillog file
hoststat
mailq
mailstats
The Complete Guide to Linux System Administration
45
Using Superservers for Network
Services
• Superserver
– Listens on multiple network ports and starts
appropriate service when client connection arrives
for port
– Programs
• inetd
• xinetd
The Complete Guide to Linux System Administration
46
Using Superservers for Network
Services (continued)
• tcpd
– TCP wrappers
– Examines incoming network connection
– Compares it to configuration file to determine
whether connection allowed
– Configured by
• /etc/hosts.allow
• /etc/hosts.deny
The Complete Guide to Linux System Administration
47
Troubleshooting and Recovery
• Having appropriate methodology makes it easier
to locate and fix problems
• Basic methodology for troubleshooting
– What system or service is causing the problem?
– Can I eliminate other possible causes to limit the
scope of the problem?
The Complete Guide to Linux System Administration
48
Troubleshooting Linux Installation
• Installation program doesn’t boot
– Boot disk created incorrectly
– Bios configured to start operating system from
hard disk without first checking floppy disk or
CD-ROM
– Installation program not able to detect video card
The Complete Guide to Linux System Administration
49
Troubleshooting Linux Installation
(continued)
• After Linux installed system doesn’t boot
– Another boot manager installed in MBR
– Trouble identifying hardware on system that was
not detected during installation process
• Graphical interface doesn’t work
– Some video cards not supported by XFree86
– Supported by commercial X Window System
products
The Complete Guide to Linux System Administration
50
Troubleshooting Linux Installation
(continued)
• Device or part of memory isn’t available
– Hardware not correctly configured
– Linux does not access all of available system
RAM because of limitations in computer’s BIOS
The Complete Guide to Linux System Administration
51
Diagnosing Device Status
• Utilities to learn about devices
–
–
–
–
/proc file system
lspci
setserial
usbmodules
The Complete Guide to Linux System Administration
52
Troubleshooting Network
Connections
The Complete Guide to Linux System Administration
53
Troubleshooting Network
Connections (continued)
The Complete Guide to Linux System Administration
54
Creating Rescue Disks
• Rescue disk
– 3.5-inch disk used to boot Linux-based computer
– Create when installing Linux
• Rescue mode
– Boots from CD
– Searches for Fedora installations
– Launches console to repair problems
The Complete Guide to Linux System Administration
55
Summary
• Scripts used by X Window System to determine
exactly what programs to start
• Graphical login screen handled by xdm
• Graphical programs can be displayed remotely
• Computer security often divided into categories
• Linux uses firewalling and packet-filtering system
called NetFilter
The Complete Guide to Linux System Administration
56
Summary (continued)
• DNS server on Linux implemented using named
daemon
• NFS permits remote users to mount file system
on NFS server as part of directory structure
• Apache Web server included with most Linux
distributions
• Systematically eliminating possible problems
good methodology for troubleshooting
The Complete Guide to Linux System Administration
57