To configure the IPSec between servers following are the requirements:

• IPSec-tools package
• Static IP address for each system

IPSec-tools can be downloaded from http://ipsec-tools.sourceforge.net/.

Installation IPSec-tools package:

To install give the following commands:

# tar jxf ipsec-tools-x.y.z.tar.bz2
# cd ipsec-tools-x.y.z
# ./configure
# make
# make install

If you get error in compilation, please go through the comments. You will find the solution.

Replace x.y.z with the version of the downloaded sources.

Instead of compiling and installing IPSec-tools from source, it can be done using CentOS repository:

# yum install ipsec-tools

IPSec communication between two Linux systems

Using Pre-shared key authentication method:

Linux to Linux IPSec communication can be used to secure the communication between Server (IP address: 192.168.1.1) to Server (IP address: 192.168.1.2). It can also be used to encrypt the client-sever communication. For example: L2TP VPN Server and client communication, VNC server and client communication can be secured using ipsec-tools. For both cases following steps need to be followed.

The first step is to write a configuration file /etc/raccoon/setkey.conf with following entries on 192.168.1.1.

#!/usr/sbin/setkey -f
# Flush the SAD and SPD
flush;
spdflush;
spdadd 192.168.1.1 192.168.1.2 any -P out ipsec
        esp/transport//require;
spdadd 192.168.1.2 192.168.1.1 any -P in ipsec
        esp/transport//require;

The same /etc/setkey.conf can be created on the 192.168.1.2 host, with inverted -P in and -P out options.

#!/usr/sbin/setkey -f
# Flush the SAD and SPD
flush;
spdflush;
spdadd 192.168.1.1 192.168.1.2 any -P in ipsec
        esp/transport//require;
spdadd 192.168.1.2 192.168.1.1 any -P out ipsec
        esp/transport//require;

With the security policies set up you can configure racoon. We will add paths for the preshared key file, and certification directory. This is an example of /etc/racoon.conf with the paths and a general phase two policy set up:

path pre_shared_key "/etc/racoon/psk.txt";
path certificate "/etc/racoon/certs";
sainfo anonymous {
{
        pfs_group 2;
        lifetime time 1 hour;
        encryption_algorithm 3des, blowfish 448, rijndael;
        authentication_algorithm hmac_sha1, hmac_md5;
        compression_algorithm deflate;
}

The sainfo identifier is used to make a block that specifies the settings for security associations. Instead of setting this for a specific host, the anonymous parameter is used to specify that these settings should be used for all hosts that do not have a specific configuration. The pfs_group specifies which group of Diffie-Hellman exponentiations should be used. The different groups provide different lengths of base prime numbers that are used for the authentication process. Group 2 provides a 1024 bit length if you would like to use a greater length, for increased security, you can use another group (like 14 for a 2048 bit length). The encryption_algorithm specifies which encryption algorithms this host is willing to use for ESP encryption. The authentication_algorithm specifies the algorithm to be used for ESP Authentication or AH. Finally, the compression_algorithm is used to specify which compression algorithm should be used when IPcomp is specified in an association.

The next step is to add a phase one configuration for the key exchange with the other host to the racoon.conf configuration file.

remote 192.168.1.2
{
        exchange_mode aggressive, main;
        my_identifier address;
        proposal {
               encryption_algorithm 3des;
               hash_algorithm sha1;
               authentication_method pre_shared_key;
               dh_group 2;
        }
}

The remote block specifies a phase one configuration. The exchange_mode is used to configure what exchange mode should be used for phase. You can specify more than one exchange mode, but the first method is used if this host is the initiator of the key exchange. The my_identifier option specifies what identifier should be sent to the remote host. If this option committed address is used, this sends the IP address as the identifier. The proposal block specifies parameter that will be proposed to the other host during phase one authentication. The encryption_algorithm, and dh_group are explained above. The hash_algorithm option is mandatory, and configures the hash algorithm that should be used. This can be md5, or sha1. The authentication_method is crucial for this configuration, as this parameter is used to specify that a preshared key should be used, with pre_shared_key.

With racoon set up there is one thing left to do, the preshared key has to be added to /etc/racoon/psk.txt. The syntax is very simple, each line contains a host IP address and a key. These parameters are separated with a tab. For example:

192.168.1.2    somekey

Now time to test the security policies & raccoon configuration.

$ setkey -f /etc/setkey.conf
$ racoon -F

For instance, you could ping the other host to start with. The first time you ping the other host, this will fail:

$ ping 192.168.1.2
connect: Resource temporarily unavailable

But after some time you will get reply. Now all the communication between IP addresses 192.168.1.1 and 192.168.1.2 is secured with IPSec. Instead of making complete secure communication, it can be changed port specific, which can be used for client-server secure communication. It just need to modify /etc/setkey.conf file for port specific configuration.

Check related posts: how to configure L2TP VPN on CentOS using rp-l2tpd and how to configure L2TP VPN on CentOS using xl2tpd

Why it is required? If you want to set up your Linux box as a web hosting server for its users, you may need to give SFTP access. But they can get access to whole system Linux tree, just for reading but still very unsecure. So it is mandatory to lock them in their home directory.

There are many other applications, it’s just a common example, so lets start its configuration.

Linux Box Detail:

Its mine Linux Box, your Linux system may vary. Only thing to take care is the openssh-server version, because openssh-server-5.3p1 support SFTP chroot. Older version supports but its tricky, please let me k now if you want to know that too.

Operating System: CentOS 6.3/x86_64

Kernel Version: 2.6.32-279.19.1.el6/x86_64

Openssh Server Version: openssh-server-5.3p1-81.el6_3/x86_64

sshd Server Configuration:

Add the following tail output to your Linux box’s SSH

server configuration file /etc/ssh/sshd_config.

[rahulpanwar@myhost ~]# tail -6 /etc/ssh/sshd_config
#Subsystem sftp /usr/libexec/openssh/sftp-server
Subsystem sftp internal-sftp
Match Group www-hosting
ChrootDirectory %h
ForceCommand internal-sftp
AllowTcpForwarding no

Then restart sshd service to enable this configuration.

[rahulpanwar@myhost ~]# sudo /etc/init.d/sshd restart

Create Chroot Users:

[rahulpanwar@myhost ~]# sudo mkdir /etc/skel/public_html
[rahulpanwar@myhost ~]# sudo groupadd www-hosting
[rahulpanwar@myhost ~]# sudo useradd -s /sbin/nologin -g www-hosting linuxexplore.com

Setting Permissions:

[rahulpanwar@myhost ~]# sudo chown root:www-hosting /home/linuxexplore.com
[rahulpanwar@myhost ~]# sudo chmod 755 /home/linuxexplore.com

That’s all now create multiple users for web hosting, and offer the secure sftp access to your customers.

Shell Script to Create Web Hosting Users:

#!/bin/bash
HOSTING_DIR="/etc/skel/public_html"
CHROOT_GRP="www-hosting"
USR_NAME="$1"

[ ! -d "$HOSTING_DIR" ] && mkdir -p $HOSTING_DIR
grep ^"${CHROOT_GRP}:" /etc/group || /usr/sbin/groupadd www-hosting
grep ^"${USR_NAMEP}:" /etc/passwd || /usr/sbin/useradd -s /sbin/nologin -g $CHROO_GRP $USR_NAME
chown root:$CHROOT_GRP /home/$USR_NAME
chmod 755 /home/$USR_NAME

Selinux Configuration:

Disable the selinux permanently or configure it for read write user’s home directory in SSH chroot.

[rahulpanwar@myhost ~]# sudo setsebool -P ssh_chroot_rw_homedirs on
[rahulpanwar@myhost ~]# sudo restorecon -R /home/$USERNAME

Troubleshooting

From: https://wiki.archlinux.org/index.php/SFTP-chroot

sshd[3505]: fatal: bad ownership or modes for chroot directory "/home/linuxexplore.com"

It’s ChrootDirectory ownership problem, sshd will reject sftp connections to accounts that are set to chroot into any directory that has ownership/permissions that sshd doesn’t consider secure. sshd’s apparently strict ownership/permissions requirements dictate that every directory in the chroot path must be owned by root and only writable for the owner. So, for example, if the chroot environment is in a user’s home directory both /home and /home/username must be owned by root and have permissions like 755 or 750 ( group ownership should allow user to access ).

If you are using sftp with public key check the following link:

http://www.centos.org/modules/newbb/viewtopic.php?topic_id=37903&forum=59

If chroot environment is in user’s home directory, make sure user have access to its home directory, or user would not be able to access its publickey, produce the error given in above CentOS forum link.

Preparation of installation of LibreOffice 4.0.0:

First of all download the newer version of LibreOffice 4.0.0 using wget command as follows.

wget http://download.documentfoundation.org/libreoffice/stable/4.0.0/rpm/x86/LibreOffice_4.0.0_Linux_x86_rpm.tar.gz

This tar file contains RPMs of LibreOffice 4.0.0 package. Extract this tar file to some location, I like /opt.

tar -xf Libreoffice_4.0.0_Linux_x86_rpm.tar.gz -C /opt

Uninstall Previous version of LibreOffice Package:

Previously existing installation of LibreOffice package must be removed before proceeding to installation of newer version. You can use yum erase command to remove old LibreOffice package.

yum erase libreoffice*

You can use any method to uninstall earlier LibreOffice package but it must be uninstalled first. Check my earlier post How to use yum for package management.

Installation of LibreOffice 4.0.0 RPMs:

To install the RPM, you can use yum command again.

cd /opt/LibreOffice_4.0.0.3_Linux_x86_rpm/RPMS/
yum localinstall *.rpm

It will install all LibreOffice RPMs from RPMS directory.

Finalizing the installation:

The above command(s) does the first part of the installation process. To complete the process, you also need to install the desktop integration packages. To do this, change directory to the desktop-integration directory that is within the RPMS directory, by entering the following command at the command line of a terminal window:

cd desktop-integration

Now run the installation command again:

yum localinstall libreoffice4.0-freedesktop-menus-4.0.0-103.noarch.rpm

The installation process is now completed, and you should have icons for all the LibreOffice.

Now you are ready to enjoy the power of opensource. Try this version, you will feel proud to be an Open Source user or supporter. Thanks a lot to Document Foundation for such a great product.

If you like this please don't forget to share this with others, Thanks.

Download the PAM Radius Module

To download the PAM Radius module, click here.

Installing & configuring PAM Radius Module

To install PAM radius module, give the following commands:

[root@rahul-pc]# tar -xvf pam_radius-1.3.17.tar.gz

[root@rahul-pc]# cd pam_radius-1.3.17

[root@rahul-pc]# make

It will generate a library file pam_radius_login.so. Copy that file to /lib/security/ directory.

[root@rahul-pc]# cp pam_radius_login.so /lib/security/

Create a directory /etc/raddb/. Copy the file pam_radius_auth.conf to /etc/raddb/ directory named as server.

[root@rahul-pc]# mkdir /etc/raddb/

[root@rahul-pc]# cp pam_radius_auth.conf /etc/raddb/server

Change the file /etc/raddb/server according to your configuration.

# Radius Server IP address           Secret                                   Timeout

192.168.2.43                                       yoursecret                          3

Configure PAM Applications for Radius Server

After doing the above configurations, edit the PAM application’s files to authenticate from radius server.

SSH server configuration

To authenticate the SSH server request from radius server, edit the file /etc/pam.d/sshd.  Add a new line

auth                       sufficient                             pam_radius_auth.so

above the following line

auth                       include                                 system-auth

After changing the PAM file, the authentication request for SSH server will go to the configured radius server (192.168.2.43 in our example) first. If the request is not accepted from radius server, then it will check the system-authentication.

Password change configuration

Similarly, to change the password of any SSH user, change the file /etc/pam.d/passwd. Add a new line

password                            sufficient                             pam_radius_auth.so

above the following line

password                            include                 system-auth

After this password change request will go to the radius server.

FTP Server Configuration

Similarly do the above changes for vsftpd file in /etc/pam.d/ directory. Then the entire authentication request for FTP server will go to radius server.

In the same way do the changes for other required applications.

PAM with Radius Authentication.

If you are familiar with CentOS, you know that out of the box, it is not really designed as a desktop distribution. Stella changes all that, as it is primarily aimed at desktop users, while retaining the core enterprise features and capabilities of CentOS.

And you can see that just by looking at the package manager. The package categories tell you that everything you can find in CentOS is also available in Stella. Plus desktop applications that you will not find in any default installation of CentOS. For example, an application listed in the screen shot below, is ROSA Media Player (ROMP), the default media player in ROSA Desktop, a distribution based on Mandriva Linux.

Because it is loaded with desktop applications and media codecs not available in CentOS, you can play most audio and video file formats out of the box. Here it shows a favorite online video playing in Firefox.

The next few screen shots show what the desktop looks like and some of the applications accessible from the menu. This one shows installed Internet applications.

Installed Office applications.

Installed multimedia applications.

Updates manager.

Read full story.

We’ve seen this Ubuntu installer for Windows before, but now it has new features and a new name: Wubi Beta. It uses no confusing lingo, and even lets you choose a variety of options that similar applications don’t offer:

• Choose the drive to install Ubuntu (should have at least 10GB available)
• Choose how much room to reserve for Ubuntu (minimum is 4GB while 8GB is recommended)
• Chose whether to install Ubuntu (GNOME), Kubuntu (KDE), Xubuntu (XFCE), or UbuntuStudio (for multimedia workstations).
• Choose your language
• Pick your username and password

Read full story

To encrypt your files use the command:

openssl des3 -salt -in $FILENAME -out ${FILENAME}.des3

To decrypt the file use the command:

openssl des3 -d -salt -in ${FILENAME}.des3 -out ${FILENAME}

You can also use my script ‘tarcrypt.sh’ to encrypt/decrypt files. This script is using tar to compress/decompress with encryption/decryption functionality.

#!/bin/sh
#
# 'tarcrypt.sh' script can used to compress/decompress the data with encryption.
#
# This script is created & tested by Rahul Panwar.
# WARNING!!! Use it at your own risk.
# Please report the bugs or queries to panwar.rahul@gmail.com

VERSION="Version 1.1.0.1nCreated by: Rahul Panwar"
PASS=""
PASS_OPTION=""
EXT_OPTION=""
COMP_FILE="encrypted_file"

DATA_FILES_ALL=""

# Usage
usage ()
{
	echo "Usage:"
	echo "	${0##*/} -c " [  ... "  [-p ]"
	echo "	${0##*/} -x  [-C ] [-p ]"
	echo "	${0##*/} -h"
	echo "	${0##*/} -v"
	echo "OPTIONS:"
	echo "	-c|--compress	: Compress and encrypt the file(s) or directory(ies)
					for multiple files use double quotes (for example "file1 file2 dir1")."
	echo "	-x|--decompress	: Decrypt and uncompress the file"
	echo "	-p|--password	: Password to encrypt/decrypt the file"
	echo "	-C|--extract	: Change directory, to extract the compressed file, default is current directory"
	echo "	-h|--help	: To see this help"
	echo "	-v|--version	: Check the version"
}
[ $# = 0 ] && usage && exit 1

# to encrypt files using openssl
encrypt_file()
{
	FNAME=$1

	#openssl des3 -salt -in "$FNAME" -out "$FNAME.des3"
	openssl des3 -salt -out "$FNAME" ${PASS_OPTION}
}

# to decrypt the files using openssl
decrypt_file()
{
	FNAME=$1

	#openssl des3 -d -salt -in "$FNAME" -out "${FNAME%.[^.]*}"
	openssl des3 -d -salt -in "$FNAME" ${PASS_OPTION}
}

# compress and encrypt the files
en_comp()
{
	tar -czp ${DATA_FILES} | encrypt_file ${COMP_FILE}
}

# decrypt and uncompress the files
de_comp()
{
	decrypt_file ${COMP_FILE} | tar ${EXT_OPTION} -xz
}

# main function
main_function()
{
	compress=""
	decompress=""
	extract=""
	password=""
	while test "$1" != "" ; do
		OPT=$1
		OPT_VAL1=$2
		OPT_VAL2=$3
		case "$OPT" in
			--compress|-c)
				DATA_FILES_ALL="${OPT_VAL1}"
				[ ! "${OPT_VAL2}" ] && echo -e "No encrypt filename, using default name: ${COMP_FILE}"
				COMP_FILE=${OPT_VAL2:-$COMP_FILE}
				compress=1
				shift
				[ "$OPT_VAL2" ] && shift
			;;
			--decompress|-x)
				COMP_FILE=${OPT_VAL1:-$COMP_FILE}
				decompress=1
				shift
			;;
			--password|-p)
				PASS=${OPT_VAL1}
				[ "$PASS" ] && password=1 && PASS_OPTION="-pass pass:${PASS}"
				shift
			;;
			--extract|-C)
				[ ! -d "$OPT_VAL1" ] && echo -e "Extract directory not exists" && exit 1
				EXT_OPTION="-C ${OPT_VAL1:-$PWD}"
				extract=1
				shift
			;;
			--help|-h)
				usage
				exit 0
			;;
			--version|-v)
				echo -e "${VERSION}"
				exit 0
			;;
			-*)
				echo "Error: no such option $OPT"
				usage
				exit 1
			;;
			*)
				echo -e "Error: invalid option $OPT"
				usage
				exit 1
		esac
		shift
	done

	if [ "$compress" ] && [ "$decompress" ]; then
		echo -e "n-c and -x can't be used simultaneouslyn" && usage && exit 1
	elif [ "$extract" ] && [ "$compress" ]; then
		echo -e "n-C can only use with -x optionn" && usage && exit 1
	fi
}

main_function "$@"
if [ "$compress" ]; then
	for FILES in ${DATA_FILES_ALL}; do
		[ -e "${FILES}" ] && DATA_FILES="${DATA_FILES} ${FILES}"
	done
	if [ ! "${DATA_FILES}" ]; then
		echo -e "No file(s) found to compress" && exit 2
	fi
	echo "==> compressing"
	en_comp &>/dev/null && echo "success" || echo "failure"
elif [ "$decompress" ]; then
	[ ! -e "${COMP_FILE}" ] && echo -e "No file to decrypt" && exit 2
	echo "==> decompressing"
	de_comp &>/dev/null && echo "success" || echo "failure"
fi

If you found any bug in the script, please write your comment. I like to improve this, so suggestions are most welcome.

STEP 1: Do your task manually & prepare the steps.

If you know the basic Linux commands, it will help you to write a shell script. I am not writing the basic Linux commands here, you can see check here http://www.comptechdoc.org/os/linux/usersguide/linux_ugbasics.html

View full topic

Download the PAM Radius Module

To download the PAM Radius module, click here.

Installing & configuring PAM Radius Module

To install PAM radius module, give the following commands:

[root@rahul-pc]# tar -xvf pam_radius-1.3.17.tar.gz

[root@rahul-pc]# cd pam_radius-1.3.17

[root@rahul-pc]# make

Read full topic…

SSH server can’t work independently, it require SSH server (like dropbear) to run. Dropbear require libz & libcrypto to run, so please first install them (if not install already). To install the dropbear SSH server, follow the steps given below.

-bash-3.2# tar –xvf dropbear-0.52.tar.bz2

-bash-3.2# cd dropbear-0.52

-bash-3.2# ./configure

-bash-3.2# make PROGRAMS=”dropbear dbclient dropbearkey dropbearconvert scp”

-bash-3.2# make PROGRAMS=”dropbear dbclient dropbearkey dropbearconvert scp” install

It will install the dropbear SSH server. Now you can create the softlink of dbclient as ssh. It is not mandatory, you can also use dbclient instead of ssh command.

-bash-3.2# ln –s /usr/local/bin/dbclient /usr/bin/ssh

To start the dropbear SSH server, first create the dss & rsa keys (for the encryption of SSH packets) in /etc/dropbear directory. SSH server does work without encryption, so it is mandatory to create the keys.

-bash-3.2# dropbearkey –t dss –f /etc/dropbear/dropbear_dss_host_key

-bash-3.2# dropbearkey –t rsa –f /etc/dropbear/dropbear_rsa_host_key

Now dropbear can be started simply by following command.

-bash-3.2# dropbear

If above will done properly you can connect your system via SSH.

View Complete Topic