[Quick Tips: SSL WebServer]: Secure web Server using SSL certification in RHEL 7

Secure web Server using SSL certification in RHEL 7

Installing and configuring Secure web Server in RHEL 7. SSL Certificates are small data files that digitally bind a cryptographic key to an organization’s details. When we installed an web server with SSL (Secure Socket Later) certificate it shows an padlock in starting of the address bar and HTTPS protocol. As shown in the below figure.

For an standard SSL it will not show an PadLcok but it will show an https protocol.

How SSL certificate provides more security to website

1. A browser attempts to connect a web site secured with SSL. The browser requests that the we server identify itself.
2. There are two types of keys will be placed in server one is public key, Second one is private key. Public key of copy will be installed with the browser installation itself because most of CA (Certification authorities) will be listed in web browsers. When client request for an web page request first reach to DNS server it will verify the IP address details then transfer the request to Web server web server will send an SSL certificate (Public key token) client launches with HTTPS website.
3. Now server and client data will be encrypted with 2048 
4. If you would like to see an listed Certificate authorities in Google chrome Settings → Show Advanced Settings → HTTPS/SSL → Manage Certificates (Screenshot is shown below)

Above listed certificates are pre-loaded when you install an browser

Now Let’s Go back our real installation and configuration of Secure web server using SSL certification in RHEL 7

First install an http packages

[root@TechTutorial ~]# yum install http*
[root@TechTutorial ~]# systemctl enable httpd.service
[root@TechTutorial ~]# systemctl start httpd.service
[root@TechTutorial ~]# systemctl status httpd.service 
httpd.service - The Apache HTTP Server
Loaded: loaded (/usr/lib/systemd/system/httpd.service; enabled)
Active: active (running) since Tue 2016-03-08 15:39:00 IST; 6s ago
Main PID: 6694 (httpd)

Now create an sample html file in default web location /var/www/html/ directory 

[root@TechTutorial html]# vim /var/www/html/index.html 
<h1>Secure Site</h1>
</h2> Secure Site is Opened </h2>

:wq (Save & Exit)

Permit Firewall to connect web server from client

[root@TechTutorial html]# firewall-cmd --permanent --add-service=https
success
[root@TechTutorial html]# firewall-cmd --reload
success

In RHEL 7 we can mention directly the service name which will automatically enables the appropriate port number in the backend

This is purely demo purpose only (Generating an SSL Certificate)

[root@TechTutorial private]# openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout /etc/pki/tls/private/apache.key -out /etc/pki/tls/certs/apache.crt
Generating a 2048 bit RSA private key
............................................+++
.......................................................................................+++
writing new private key to '/etc/pki/tls/private/apache.key'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:IN
State or Province Name (full name) []:Telangana
Locality Name (eg, city) [Default City]:Hyderabad
Organization Name (eg, company) [Default Company Ltd]:ArkIT
Organizational Unit Name (eg, section) []:IT
Common Name (eg, your name or your server's hostname) []:TechTutorial.arkit.com
Email Address []:

After you enter the request, you will be taken to a prompt where you can enter information about your website. Before we go over that, let’s take a look at what is happening in the command we are issuing:

openssl: This is the basic command line tool for creating and managing OpenSSL certificates, keys, and other files.
req -x509: This specifies that we want to use X.509 certificate signing request (CSR) management. The “X.509” is a public key infrastructure standard that SSL and TLS adhere to for key and certificate management.
-nodes: This tells OpenSSL to skip the option to secure our certificate with a passphrase. We need Apache to be able to read the file, without user intervention, when the server starts up. A passphrase would prevent this from happening, since we would have to enter it after every restart.
-days 365: This option sets the length of time that the certificate will be considered valid. We set it for one year here.
-newkey rsa:2048: This specifies that we want to generate a new certificate and a new key at the same time. We did not create the key that is required to sign the certificate in a previous step, so we need to create it along with the certificate. The rsa:2048 portion tells it to make an RSA key that is 2048 bits long.
-keyout: This line tells OpenSSL where to place the generated private key file that we are creating.
-out: This tells OpenSSL where to place the certificate that we are creating.

Fill out the prompts appropriately. The most important line is the one that requests the Common Name. You need to enter the domain name that you want to be associated with your server. You can enter the public IP address instead if you do not have a domain name.

Ensure that file are generate and kept under the below directory path

/etc/pki/tls/certs/

Now Copy the ssl.conf file from /etc/httpd/conf.d/ssl.conf to any temp location (Example /tmp) then edit the file.

[root@TechTutorial ~]# cp /etc/httpd/conf.d/ssl.conf /opt/

in Default ssl.conf file delete lines from 1 to 69 until ‘SSLEngine on‘ Key word appears 

below is the finall configuration file for configuring the SSL certificate

[root@TechTutorial opt]# vim /etc/httpd/conf.d/arkit.conf
<VirtualHost *:443>
ServerAdmin root@localhost
ServerName TechTutorial.arkit.com
DocumentRoot /var/www/html
SSLEngine on
SSLProtocol all -SSLv2
SSLCipherSuite HIGH:MEDIUM:!aNULL:!MD5
SSLHonorCipherOrder on
SSLCertificateFile /etc/pki/tls/certs/arkit.com.crt
SSLCertificateKeyFile /etc/pki/tls/private/arkit.com.key
SSLCertificateChainFile /etc/pki/tls/certs/arkit.com.csr
</VirtualHost>

:wq (Save & Exit)

Restart the web service (http.service) to reflect the changes

Client Side

Browse the website which should load with https://arkit.co.in

That’s it. you successfully configure secure web server with SSL certificate in RHEL 7 / Centos 7

[Quick Install: Syslog Server]: rsyslog server installation and configuration in RHEL 7 and Centos 7

rsyslog server installation and configuration in RHEL 7 and Centos 7

rsyslog server

rsyslog server is used to collaborate all server logs to centralized place. System administrator no need to login each and every device to collect logs, just install and configure rsyslog server and watch all server logs using single command. Linux labels (auth, cron, ftp, lpr, authpriv, news, mail, syslog, etc ,..) the log messages to indicate the type of software that generated the messages with severity (Alert, critical, Warning, Notice, info, etc ,..).

What is syslog 

In computing, syslog is a standard for message logging. It permits separation of the software that generates messages, the system that stores them, and the software that reports and analyzes them. Each message is labeled with a facility code, indicating the software type generating the message, and assigned a severity label.

Required Hardware and Software

rsyslog server should have at-least 4GB of RAM. 2CPU cores. 1Giga byte Network card. Installed with RHEL 7 (Redhat Enterprise Linux 7, 7.1, 7.2 OR Centos 7).

Server Profile

 Packages: rsyslog*

Service / Daemon Name: rsyslog.service

Port number: 514

Config File: /etc/rsyslog.conf

In this article we are using Server IP: 192.168.4.20   Client IP: 192.168.4.21 for demonstrate

Server side configuration

[root@server ~]# hostname
server.arkit.co.in

Installing rsyslog packages

[root@server yum.repos.d]# yum install rsyslog*
Installed:
rsyslog-gnutls.x86_64 0:7.4.7-7.el7_0 rsyslog-gssapi.x86_64 0:7.4.7-7.el7_0 rsyslog-mysql.x86_64 0:7.4.7-7.el7_0
rsyslog-pgsql.x86_64 0:7.4.7-7.el7_0 rsyslog-relp.x86_64 0:7.4.7-7.el7_0
Dependency Installed:
librelp.x86_64 0:1.2.0-3.el7 postgresql-libs.x86_64 0:9.2.7-1.el7
Complete!

Enable and start the services

We have to enable the service first because whenever you restart the rsyslog server it should automatically start after the reboot. If you did not enable the service it will not start we have to start service manually.

[root@server ~]# systemctl enable rsyslog.service
[root@server ~]# systemctl start rsyslog.service
[root@server ~]# systemctl status rsyslog.service
rsyslog.service - System Logging Service
Loaded: loaded (/usr/lib/systemd/system/rsyslog.service; enabled)
Active: active (running) since Sat 2016-04-23 15:07:12 IST; 41min ago
Main PID: 984 (rsyslogd)
CGroup: /system.slice/rsyslog.service
└─984 /usr/sbin/rsyslogd -n
Apr 23 15:07:12 server.arkit.co.in systemd[1]: Started System Logging Service.
Apr 23 15:48:35 server.arkit.co.in systemd[1]: Started System Logging Service.

Edit config file 

Before enabling the config

[root@server ~]# vi /etc/rsyslog.conf
# rsyslog configuration file
# Provides UDP syslog reception
#$ModLoad imudp
#$UDPServerRun 514
# Provides TCP syslog reception
#$ModLoad imtcp
#$InputTCPServerRun 514

After the Change

# Provides UDP syslog reception
$ModLoad imudp
$UDPServerRun 514
# Provides TCP syslog reception
$ModLoad imtcp
$InputTCPServerRun 514
:wq! (Save & Exit)

Restart the service to effect the change

[root@server ~]# systemctl restart rsyslog.service

Allow firewall ports from server

Default port number for syslog is 514

[root@server ~]# firewall-cmd --permanent --add-port=514/tcp
success
[root@server ~]# firewall-cmd --permanent --add-port=514/udp
success
[root@server ~]# firewall-cmd --reload
success

Verify Service is listening

[root@server ~]# netstat -antup | grep 514
tcp 0 0 0.0.0.0:514 0.0.0.0:* LISTEN 4300/rsyslogd
tcp6 0 0 :::514 :::* LISTEN 4300/rsyslogd
udp 0 0 0.0.0.0:514 0.0.0.0:* 4300/rsyslogd
udp6 0 0 :::514 :::* 4300/rsyslogd

Client Side

ping to server and verify server is reachable from client

[root@desktop ~]# hostname
desktop.arkit.co.in
[root@desktop ~]# ping 192.168.4.20
PING 192.168.4.20 (192.168.4.20) 56(84) bytes of data.
64 bytes from 192.168.4.20: icmp_seq=1 ttl=64 time=0.481 ms
64 bytes from 192.168.4.20: icmp_seq=2 ttl=64 time=0.385 ms
^C
--- 192.168.4.20 ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 1000ms
rtt min/avg/max/mdev = 0.385/0.433/0.481/0.048 ms

Edit the config file

[root@desktop ~]# vi /etc/rsyslog.conf
*.* @@192.168.4.20:514
:wq! (Save & Exit)

As shown above we have to point the client to send logs. . means all the logs. if would like to specify only particular logs then do not specify . in client config.

# Log anything (except mail) of level info or higher.
# Don't log private authentication messages!
*.info;mail.none;authpriv.none;cron.none /var/log/messages
# The authpriv file has restricted access.
authpriv.* /var/log/secure
# Log all the mail messages in one place.
mail.* -/var/log/maillog
# Log cron stuff
cron.* /var/log/cron
# Everybody gets emergency messages
*.emerg :omusrmsg:*
# Save news errors of level crit and higher in a special file.
uucp,news.crit /var/log/spooler

Restart the service

[root@desktop ~]# systemctl restart rsyslog.service
[root@desktop ~]# systemctl status rsyslog.service
rsyslog.service - System Logging Service
Loaded: loaded (/usr/lib/systemd/system/rsyslog.service; enabled)
Active: active (running) since Sat 2016-04-23 16:08:34 IST; 15s ago
Main PID: 4336 (rsyslogd)
CGroup: /system.slice/rsyslog.service
└─4336 /usr/sbin/rsyslogd -n

Test logs

open log file in server and switch the users in client machine

[root@server log]# tail -f /var/log/secure
Apr 23 16:16:02 desktop su: pam_unix(su-l:session): session closed for user atkit
Apr 23 16:16:34 desktop su: pam_unix(su-l:session): session opened for user atkit by root(uid=0)
Apr 23 16:16:40 desktop su: pam_unix(su-l:session): session closed for user atkit

[Quick Install: SSH Passwordless]: Password less authentication to run scripts an remote server – Linux

Password less authentication to run scripts an remote server – Linux

Background Information: Public key cryptography, also known as asymmetric cryptography uses two keys, each of which can be used to encrypt a message. If one key is used to encrypt a message, then the other must be used to decrypt it. This makes it possible to receive secure messages by simply publishing one key (the public key) and keeping the other secret (the private key).

Anyone may encrypt a message using the public key, but only the owner of the private key is able to read it. In this way, Alice may send private messages to the owner of a key-pair (the bank) by encrypting it using their public key. Only the bank can decrypt it.
For more information, visit this page.
SSH pubkey authorization

Step 1
Make yourself a pubkey/privkey pair:

$ ssh-keygen -t dsa

Step 2
Rename the pubkey to authorized_keys:

$ cd ~/.ssh 
$ mv id_dsa.pub authorized_keys

Step 3
Scp the authorized_keys file into ~/.ssh/ on all machines you want to be able to connect to. you can also use below mentioned command to copy the pubkey to remote host.

$ ssh-copy-id <Remote Host IP>

Step 4
Run the ssh-agent and load your privkey into it. Use the following script, which is called “sshrun”, to do that.

#!/bin/sh eval `ssh-agent` ssh-add ~/.ssh/id_dsa bash ssh-agent -k exec clear

Step 5
Try ssh into one of the boxes in question. If it doesn’t let you in without a password, it’s probably a file or directory permissions problem.

[Quick Tips: Linux Security]: Mail me when someone runs command using sudo – Linux Security

Mail me when someone runs command using sudo – Linux Security

There is situation that i wanted to monitor all the sudo users activity, When ever they type an command using sudo i should get an email. This is very important when your working as a Linux Security Administrator / Security analyst.  As a Linux Administrator you should have an evidence to prove somebody is screed up something in your environment.

Restrict your Administrator’s to use sudo for all the important commands by writing an restriction in /etc/sudoers file then change the permission of the /etc/sudoers to 600 using root. No user will able to see the

:: Prerequisites ::

1. Restrict users by adding restrictions to /etc/sudoers
2. Create an distribution list and add that to configuration – because every time we are not going to modify config file

Most of the time what we will do is we will provide an full rights to the administrator based an there designation and level of exportation, but we don’t know what he / she is doing an the production environment. In order to monitor the typed commands with sudo, We have to add below lines to the configuration file.

Add the entry to the /etc/sudoers as mentioned below, It will send you an alert whenever user type the command using sudo. Providing the the path of the log file it will save an every executed command as shown in below:

~]# vi /etc/sudoers
###### Get every alert when user fired an command with sudo ####
Defaults        syslog=auth, insults, syslog_goodpri=alert
Defaults        logfile=/var/log/sudo.log
Defaults        timestamp_timeout=0, log_year, tty_tickets
Defaults        mailto="aravikumar48@gmail.com", mail_always, mail_badpass, mail_no_user

Some times we need an exceptional cases that we don’t want to get alert when particular user types and commands with sudo before the command.

we have to modify the configuration as shown in below.

~]#vi /etc/sudoers
User_Alias NoMail = goodboy, goodgirl
User_Alias MailUsers = ALL, !NoMail
Defaults           mailto="aravikumar48@gmail.com"
Defaults:MailUsers mail_always
Defaults:NoMail    !mail_badpass

Where User_Alias NoMail it will not send a mail for that specified users.

[Quick Tips: Change Ports]: How to Change default port to a custom port

How to Change default port to a custom port

 

Keeping your Linux server secure is the vital duty of a system administrator. While there are many ways to make sure your server is as secure as possible, there are few basic steps you must do first. It is changing the ports of frequently used services to custom ports. Here we will be seeing how to change the defaults ports of Apache, FTP and SSH to something different that is hard to guess.

Let us break down this topic in three small parts. First, we will see how to change the default port Apache web server.

Why do we need to change the default port?

Before get to the topic, you might ask changing port will increase the security? To be honest, No, it won’t. Changing the default port alone doesn’t provide any serious security defense. Yes, there are many port scanners which will find out which port you’re using eventually. But you can, at least, protect your servers from any amateur attacks, and also you can reduce the number of attacks. That’s why we need to change the default ports.

Change Apache default port to a custom port

1. Change Apache port on Debian/Ubuntu

Edit /etc/apache2/ports.conf file,

sudo vi /etc/apache2/ports.conf

Find the following line:

Listen 80

And change it to a random number of your choice, for example 8090.

Listen 8090

This entry make the server to accept connections on port 8090 on all interfaces. To make the server accept connections on port 8090 for a specific interface, just include the corresponding network interface’s IP address as shown below.

Listen 192.168.1.101:8090

This will be helpful if your server has multiple IP addresses or network interfaces.

Save and close the file.

Additionally, in Ubuntu and Debian, you will likely also have to change the port number in /etc/apache2/sites-enabled/000-default.conf file too.

sudo vi /etc/apache2/sites-enabled/000-default.conf

Find the following line and change the port number.

<VirtualHost *:8090>

Save and close the file.

Then, restart Apache service to take effect the changes.

sudo systemctl restart apache2

Or

sudo service apache2 restart

Now let us verify the port settings:

sudo netstat -tulpn | grep :8090

Sample output:

tcp6       0      0 :::8090                 :::*                    LISTEN      4066/apache2

Then, open your web browser and navigate to URL: http://IP-address:8090.

You should see the following screen:

Next we will see how to change Apache port in RHEL based systems.

2. Change Apache port on RHEL/CentOS

Make sure you have installed Apache webserver first.

Then, edit /etc/httpd/conf/httpd.conf file,

sudo vi /etc/httpd/conf/httpd.conf

Find the following line:

Listen 80

And change it to a random number of your choice, for example 8090.

Listen 8090

This entry make the server to accept connections on port 8090 on all interfaces. To make the server accept connections on port 8090 for a specific interface, just include the corresponding network interface’s IP address as shown below.

Listen 192.168.1.150:8090

This will be useful if your server has multiple IP addresses or network interfaces.

Save and close the file.

In RHEL/CentOS systems, make sure the new port number 8090 is not blocked in SELinux and Firewall.

sudo semanage port -a -t http_port_t -p tcp 8090

If semanage command is not found, install the following package:

sudo yum install policycoreutils-python

To allow port 8090 via firewall do the following steps.

In RHEL 7/ CentOS 7:

sudo firewall-cmd --permanent --add-port=8090/tcp

sudo firewall-cmd --reload

In RHEL 6/ CentOS 6:

sudo vi /etc/sysconfig/iptables

And add the new custom port line:

-A INPUT -m state --state NEW -m tcp -p tcp --dport 8090 -j ACCEPT

Save and exit the file and restart iptables service.

sudo service iptables restart

Finally restart Apache service.

sudo systemctl restart httpd

Or

sudo service httpd restart

Now verify the port using command:

sudo netstat -tulpn | grep :8090

Sample output:

tcp6       0      0 :::8090                 :::*                    LISTEN      17636/httpd

If netstat command is not found, install the following package.

sudo yum install net-tools

Then, verify the Apache test page from the browser using URL: http://IP-address:8090.

You should see the following screen:

Congratulations! Apache default port has been changed.

In this brief tutorial, let us see how to change FTP default port 21 to any custom port.

Change FTP default port to a custom port

Make sure you have installed VSFTPD server and started the appropriate services.

Then, we need to edit VSFTPD configuration file and change the default port.

On Debian / Ubuntu :

Edit /etc/vsftpd.conf file,

sudo vi /etc/vsftpd.conf

On RHEL / CentOS / Fedora / Scientific Linux:

Edit /etc/vsftpd/vsftpd.conf file,

sudo vi /etc/vsftpd/vsftpd.conf

Find the following line. If it is not found, add it.

listen_port=21

And change the FTP default port 21 to a custom port, for example 210.

listen_port=210

Save and close the file. Restart vsftpd service to take effect the changes.

In RHEL / CentOS /Scientific Linux systems, make sure the port number 210 is not blocked in SELinux and Firewall.

sudo semanage port -a -t ftp_port_t -p tcp 210

If semanage command is not found, install the following package:

sudo yum install policycoreutils-python

To allow port 210 via firewall do the following steps.

In RHEL 7/ CentOS 7 /Scientific Linux 7:

sudo firewall-cmd --permanent --add-port=210/tcp

sudo firewall-cmd --reload

In RHEL 6/ CentOS 6 /Scientific Linux 6:

sudo vi /etc/sysconfig/iptables

And add the new custom port line:

-A INPUT -m state --state NEW -m tcp -p tcp --dport 210 -j ACCEPT

Save and exit the file and restart iptables service.

sudo service iptables restart

Finally restart vsftpd service.

sudo systemctl restart vsftpd

Or

sudo service vsftpd restart

Now verify the port using command:

sudo netstat -tulpn | grep :210

Sample output:

tcp6       0      0 :::210                  :::*                    LISTEN      2610/vsftpd

If netstat command is not found in CentOS/RHEL, install the following package.

sudo yum install net-tools

Now, you can access the FTP server from all clients using URL: ftp <ftp-server-ip> <port-number>

Example:

$ ftp 192.168.1.150 210

Here, 192.168.1.150 is my FTP server’s IP address and 210 is the FTP custom port.

Sample output:

Connected to 192.168.1.150 (192.168.1.150).

220 (vsFTPd 3.0.2)

Name (192.168.1.150:root): ostechnix

331 Please specify the password.

Password:

230 Login successful.

Remote system type is UNIX.

Using binary mode to transfer files.

ftp>

As you see in the above output, we have accessed the ftp server using the custom port 210. You can use any port number of your choice. But, just make sure that custom port is not used by any other services.

Access FTP server using FTP client or Web browser

Similar to CLI method, you need to mention the custom port number while accessing the FTP server via a FTP client or a web browser.

The following screenshots shows how to access the FTP server from a FTP client or browser.

Access FTP server from a FTP client called FileZilla:

Access FTP server from a web browser using a custom port:

To access the FTP server from a browser, the URL must be:

ftp://<IP-Address>:<port-number>

Or

ftp://<login>:<passwd>@IP-Address:<port-number>/

In this tutorial, we will discuss how to change SSH default port to any random port. Similar to part 1 and part 2, It is also easy to implement. Read on.

Change SSH default port to a custom port

Changing ssh default port is pretty easy and it is almost same on all modern Linux operating systems.

To change the SSH default port, edit /etc/ssh/sshd_config file,

sudo vi /etc/ssh/sshd_config

As you probably know, the SSH default port is 22. So, we will change it to any random number, for example 2022.

To do so, edit or add the following line:

Port 2022

Save and close the file. Restart ssh service.

sudo systemctl restart sshd

Or

sudo service sshd restart

In RHEL/CentOS systems, adjust SELinux and Firewall settings to allow the new port.

sudo semanage port -a -t ssh_port_t -p tcp 2022

If semanage command is not found, install the following package:

sudo yum install policycoreutils-python

In RHEL 7 / CentOS 7:

sudo firewall-cmd --permanent --add-port=2022/tcp

sudo firewall-cmd --reload

In RHEL 6 / CentOS 6:

sudo vi /etc/sysconfig/iptables

Comment out the default port 22 line:

# -A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT

And add the new custom port line:

-A INPUT -m state --state NEW -m tcp -p tcp --dport 2022 -j ACCEPT

Save and close the file.

Restart iptables to take effect the changes.

sudo service iptables restart

Finally, restart ssh service:

sudo service sshd restart

Verify the port settings using command:

sudo netstat -tulpn | grep :2022

Sample output:

tcp        0      0 0.0.0.0:2022            0.0.0.0:*               LISTEN      18680/sshd          

tcp6       0      0 :::2022                 :::*                    LISTEN      18680/sshd

Now, try to SSH from any client systems using the port number as shown below.

ssh -p 2022 ostechnix@192.168.1.150

Sample Output:

ostechnix@192.168.1.150's password: 

Last login: Wed Jan 20 15:45:16 2016

[ostechnix@server ~]$

Conclusion

Like I said in the first part, these methods alone will not keep your server safe and secure. There are many tasks you need to consider such as firewall implementation, DDoS, Brute-force attacks prevention, installing security patches, updating your server and applications regularly etc. But these are the first and foremost things you should do before implementing any security methods. Now, your Linux server is bit more secure than before.