CSIS 82
Tutorial: Linux Web Server & Security Basics
Gagne Ch20,23,24
Terms:
Apache Web Server:
SSL:
Packet filtering:
A program that handles web traffic
Secure socket layer, secures web site for e-commerce
Technique of denying access to specific services from
different network addresses
Disable Firewall
su - (type your root password)
# chkconfig iptables off
# service iptables stop
OR: if you prefer gui tool:
1) Go to Main > System Settings > Security Level
2) Type root password
3) Choose Security Level > 'Disable firewall'
Apache Web Server can be compiled and installed manually, but is already on our system
login as supersuser su apachectl stop
stop [start] web server
open browser, enter http://xx.lobosmpc.org where xx is your hostname, appears at unix prompt
you get a test page
cd /var/http/www/html
and backup index.html, then change
httpd
the apache daemon
chkconfig --list | grep httpd what runlevel it runs on
chkconfig --level 5 httpd on turn on for runlevel 5
httpd -V
shows where apache files are /etc/httpd/conf location of config
-D DEFAULT_XFERLOG= /var/log/httpd location of log file
vi httpd.conf
to activate different web services, control access, set directories of web pages
more /var/log/httpd/log* to see activity
Controlling Access to your Machine using TCP Wrappers
log in to your neighbors machine using ssh
and ftp
xinetd
master daemon for certain services (ftp, ssh, finger, POP, IMAP (mail))
/etc/hosts.allow
put daemon list: client list for all allowed
or ALL: ALL
/etc/hosts.deny
""
denied
or ALL: ALL
service xinetd restart
restart the xinetd daemon
deny for ALL:ALL and see if new ssh and ftp can be made
try to specify IP#s only
services that will be blocked are in /etc/xinetd.d
check failed ssh logs in /var/logs/secure
and wrapped by TCP wrapper /usr/bin/tcpd
Firewall Management
/usr/sbin/lokkit
enable/disable rules
GUI: SystemSettings>Security Level menu
File Encrypting circumvent sniffers
sniffit at reptile.rug.ac.be
Clear text applications: telnet, mail, ftp
Public key systems: ssh, sftp
Pretty Good Privacy, PGP and GnuPGP www.gnupgp.org also need gmp or GNU MP
SSL Apache server: get apache package from www.apache.org/httpd.html or
and mod_ssl from www.modssl.org/source
Checking for vulnerabilities
nmap -sT terra.mpc.cc.ca.us
Checking for intruders
tripwire