Skedaret e konfigurimit jane te ndjeshem persa i perket sigurise, per kete arsye duhet te jemi te kujdesshem me te drejtat e ketyre skedareve.
Pjesa me e madhe ketyre skedareve duhet te kete te drejta lexim shkrimi per perdoruesin, lexim per grupin dhe lexim per gjithe te tjeret.
Ndersa disa skedare qe jane shume e ndjeshem per sa i perket sigurise si /ect/shadow ku ruhen password e perdoruesit duhet te kene te drejte lexim shkrimi vetem per root.
[root@localhost student]# ls -l /etc/shadow
----------. 1 root root 1042 Oct 9 00:41 /etc/shadow
[root@localhost student]#
Skedaret e konfigurimit te sistemet mund te grupohen ne disa kategori:
konfigurime te sistemit si ruatja e logeve dhe ekzekutimi i jobeve ne CRON
konfigurime te progremave baze si sendmail dhe bash
konfigurime te nderfaqes se sistemit, si pesh ngjyrat e listimit te skedareve sipas llojit, etj
Skripte te konfigurimit te shell ne nivel sistemi
Keto skedare percaktojne parametrat baze te shell dhe cfare funksionesh therriten sa here qe nje perdorues hap nje shell te ri.
Keta skedaret ndodhen ne /etc dhe percaktojne konfigurimin e shell per te gjithe perdoruesit e sistemit.
Nje perdorues mundet qe te percaktoje parametra konfigurimi te personalizuara te shell duke krijuar skedare te tjere konfigurimit ne profilin e tij brenda dosjes home.
Ne kete rast emrat e skedareve jane te njejte por paraprihen nga nje pike:
[student@localhost ~]$ ls -l /etc/bashrc
-rw-r--r--. 1 root root 2681 Oct 2 2012 /etc/bashrc
[student@localhost ~]$
[student@localhost ~]$ ls -l ~/.bashrc
-rw-r--r--. 1 student student 124 Aug 29 2012 /home/student/.bashrc
[student@localhost ~]$
Skedari /etc/bashrc percakton konfigurimin e shell te hapur nga te gjithe perdoruesit ndersa /home/student/.bashrc percakton konfigurimin e shell te hapur nga perdoruesi student.
Skedaret e konfigurimit BASHRC, CSH.CSHRC, ZSHRC
Bashrc lexohet nga bash , csh.cshrc nga tcshn ndersa zshrc lexohet nga zsh. Keto skedaret lexohen sa here qe hapet nje shell jo vetem ne momentin e login, gje qe mundeson ndryshimin e konfigurimit te shell pa patur nevoje te rilogohet perdoruesi. Ne keto skedare vendosen funksione dhe aliase.
Skedari PROFILE
lexohet nga te gjithe SHELL me perjashtim te tch dhe csh ne momentin e loginit.
Bash kerkon fillimisht per skedarin bash_profile dhe nese nuk e gjen ate lexon skedarin profile.
ZSH kerkon fillimisht per skedarin zprofile dhe ne mungese te tij lexon skedarin profile.
Me poshte po afishojme permbajtjen e nje skedari profile , ne /etc/profile
# /etc/profile
# System wide environment and startup programs, for login setup
# Functions and aliases go in /etc/bashrc
# It's NOT a good idea to change this file unless you know what you
# are doing. It's much better to create a custom.sh shell script in
# /etc/profile.d/ to make custom changes to your environment, as this
# will prevent the need for merging in future updates.
pathmunge () {
case ":${PATH}:" in
*:"$1":*)
;;
*)
if [ "$2" = "after" ] ; then
PATH=$PATH:$1
else
PATH=$1:$PATH
fi
esac
}
if [ -x /usr/bin/id ]; then
if [ -z "$EUID" ]; then
# ksh workaround
EUID=`id -u`
UID=`id -ru`
fi
USER="`id -un`"
LOGNAME=$USER
MAIL="/var/spool/mail/$USER"
fi
# Path manipulation
if [ "$EUID" = "0" ]; then
pathmunge /sbin
pathmunge /usr/sbin
pathmunge /usr/local/sbin
else
pathmunge /usr/local/sbin after
pathmunge /usr/sbin after
pathmunge /sbin after
fi
HOSTNAME=`/bin/hostname 2>/dev/null`
HISTSIZE=1000
if [ "$HISTCONTROL" = "ignorespace" ] ; then
export HISTCONTROL=ignoreboth
else
export HISTCONTROL=ignoredups
fi
export PATH USER LOGNAME MAIL HOSTNAME HISTSIZE HISTCONTROL
# By default, we want umask to get set. This sets it for login shell
# Current threshold for system reserved uid/gids is 200
# You could check uidgid reservation validity in
# /usr/share/doc/setup-*/uidgid file
if [ $UID -gt 199 ] && [ "`id -gn`" = "`id -un`" ]; then
umask 002
else
umask 022
fi
for i in /etc/profile.d/*.sh ; do
if [ -r "$i" ]; then
if [ "${-#*i}" != "$-" ]; then
. "$i"
else
. "$i" >/dev/null 2>&1
fi
fi
done
unset i
unset -f pathmunge
Sqarime:
$UID = user_id ( root $UID = 0)
$EUID - effective user_id ( root $UID =))
Skedari profile eshte nje vend i pershtatshem per te vendosur PATH-et pasi variablat e percaktuar ne kete skedare i kalohen shell dhe te gjithe proceseve bir te shell.
Perdoruesit ne menyre opsionale mund te percaktojne konfigurime individuale , per shembull te shtojne default path te tjera duke perdorur nje skedar .profile brenda dosjes se tyre home.
Skedari /etc/motd
Skedari /etc/motd permban nje mesazh qe i shfaqet perdoruesit sa here qe ai logohet ne sistem.
[root@localhost student]# cat > /etc/motd
This is a wellcome message written by ICT Education students
partecipating in the course Redhat Linux System Administration
Have a nice day!
Skedari /etc/issue dhe skedari /etc/issue.net
Skedari /etc/issue permban nje mesazh i cili i shfaqet perdoruesve qe hapin sistemin nga nje konsole lokale perpara se ata te logohen:
[root@localhost student]# cat >> /etc/issue
This is a prelogin message added by ICT Education students!
This message is displayed when accessing the system
through a local console
[root@localhost student]#
Ndersa skedar /etc/issue.net permban nje mesazh i cili i shaqet perdoruesve qe lidhen me sistemin nepermjet rrjetit nepermjet telnet.
Skedaret e CRON-it
Cron eshte nje sherbim ( daemon ) qe ekzekuron komanda nepermjet nje skeduli te parapercaktuar. Ai lexon vazhdimisht listne e puneve (cron jobs) qe ka per te kryer ne ate mement.
Skedaret ku perdoruesit vendosin cron job e tyre si regull vendosen ne /var/spool/cron. Ato emerohen sipas perdoruesit qe i krijon.
Ndersa skedaret e sistemit per konfigurimin e CRON-it ndodhen ne dosjen /etc dhe nendirektorite e saj:
[root@localhost etc]# ls -l cron*
-rw-r--r--. 1 root root 0 Mar 4 2011 cron.deny
-rw-r--r--. 1 root root 457 Jun 3 2011 crontab
cron.d:
total 12
-rw-r--r--. 1 root root 113 Mar 4 2011 0hourly
-rw-r--r--. 1 root root 108 Dec 6 2012 raid-check
-rw-r--r--. 1 root root 229 Mar 28 2012 sysstat
cron.daily:
total 32
-rwxr-xr-x. 1 root root 118 Nov 6 2012 cups
-rwxr-xr-x. 1 root root 196 Aug 6 2012 logrotate
-rwxr-xr-x. 1 root root 905 Nov 16 2012 makewhatis.cron
-rwxr-xr-x. 1 root root 174 Sep 24 2012 mlocate.cron
-rwxr-xr-x. 1 root root 2126 Apr 23 2010 prelink
-rwxr-xr-x. 1 root root 563 Mar 24 2010 readahead.cron
-rwxr-xr-x. 1 root root 256 Jan 21 2013 rhsmd
-rwxr-xr-x. 1 root root 365 Oct 16 2009 tmpwatch
cron.hourly:
total 4
-rwxr-xr-x. 1 root root 424 Mar 4 2011 0anacron
cron.monthly:
total 4
-rwxr-xr-x. 1 root root 111 Mar 24 2010 readahead-monthly.cron
cron.weekly:
total 0
[root@localhost etc]#
Skedari /etc/crontab eshte nje skedar qe eshte konfiguruar per te ekzekutuar te gjithe skriptet qe ndodhen ne dosjen cron.daily cdo dite , skriptet qe ndodhen ne dosjen cron.hourly ti ekzekutoje cdo ore e keshtu me rradhe per cron.monthly dhe cron.weekly.
cron.d
Dosja cron.d eshte vendi ku mbahen skriptet per mirembajtjen e sistemit.
Si rregull cdo 10 minuta nje skript brend cron.d, systat mbledh statistika te sistemit.
permbajtja e sysstat :
[root@localhost etc]# cat /cron.d/sysstat
cat: /cron.d/sysstat: No such file or directory
[root@localhost etc]# cat cron.d/sysstat
# Run system activity accounting tool every 10 minutes
*/10 * * * * root /usr/lib/sa/sa1 1 1
# 0 * * * * root /usr/lib/sa/sa1 600 6 &
# Generate a daily summary of process accounting at 23:53
53 23 * * * root /usr/lib/sa/sa2 -A
[root@localhost etc]#
SYSLOG.CONF
Daemon syslog ruan evente te sistemit ne skedare lokal ne server. Gjithashtu ai mund te dergoje evente e log-ut ne nje server tjeter per nje siguri me te larte.
Syslog-u i nje serveri mund te konfigurohet si log-server dhe ne kete rast ai do te pranoje loget nga servera te tjere ne rrjet per ti ruajtur lokalisht.
Keto opsione si edhe disa konfigurime qe kane te bejne me percaktimin se cilat evente duhet te ruhen dhe cilat jo ruhen ne skedarin /etc/syslog.conf.
Shenim
Me instalimin e serverit baze te Redhat 6 , syslog nuk eshte i instaluar si default.
Per ta perdorur do te duhet ta instalojme paraprakisht
[root@localhost student]# yum install -y syslog
Loaded plugins: product-id, refresh-packagekit, security, subscription-manager
This system is receiving updates from Red Hat Subscription Management.
rhel-6-server-cf-tools-1-rpms | 2.8 kB 00:00
rhel-6-server-rhev-agent-rpms | 3.1 kB 00:00
rhel-6-server-rpms | 3.7 kB 00:00
^XSetting up Install Process
Package rsyslog-5.8.10-7.el6_4.i686 already installed and latest version
Nothing to do
[root@localhost student]#
Gjithashtu nese duam ta konfigurojme serverin si nje server qendror per loget do te duhet te instalojme rsylog
[root@localhost student]# yum install -y rsyslog
Me poshte afishohet per ilustrim permbatjtja e nje skedari rsyslog.conf
[root@localhost student]# cat /etc/rsyslog.conf
# rsyslog v5 configuration file
# For more information see /usr/share/doc/rsyslog-*/rsyslog_conf.html
# If you experience problems, see http://www.rsyslog.com/doc/troubleshoot.html
#### MODULES ####
$ModLoad imuxsock # provides support for local system logging (e.g. via logger command)
$ModLoad imklog # provides kernel logging support (previously done by rklogd)
#$ModLoad immark # provides --MARK-- message capability
# Provides UDP syslog reception
#$ModLoad imudp
#$UDPServerRun 514
# Provides TCP syslog reception
#$ModLoad imtcp
#$InputTCPServerRun 514
#### GLOBAL DIRECTIVES ####
# Use default timestamp format
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
# File syncing capability is disabled by default. This feature is usually not required,
# not useful and an extreme performance hit
#$ActionFileEnableSync on
# Include all config files in /etc/rsyslog.d/
$IncludeConfig /etc/rsyslog.d/*.conf
#### RULES ####
# Log all kernel messages to the console.
# Logging much else clutters up the screen.
#kern.* /dev/console
# Log anything (except mail) of level info or higher.
# Don't log private authentication messages!
*.info;mail.none;authpriv.none;cron.none /var/log/messages
# The authpriv file has restricted access.
authpriv.* /var/log/secure
# Log all the mail messages in one place.
mail.* -/var/log/maillog
# Log cron stuff
cron.* /var/log/cron
# Everybody gets emergency messages
*.emerg *
# Save news errors of level crit and higher in a special file.
uucp,news.crit /var/log/spooler
# Save boot messages also to boot.log
local7.* /var/log/boot.log
# ### begin forwarding rule ###
# The statement between the begin ... end define a SINGLE forwarding
# rule. They belong together, do NOT split them. If you create multiple
# forwarding rules, duplicate the whole block!
# Remote Logging (we use TCP for reliable delivery)
#
# An on-disk queue is created for this action. If the remote host is
# down, messages are spooled to disk and sent when it is up again.
#$WorkDirectory /var/lib/rsyslog # where to place spool files
#$ActionQueueFileName fwdRule1 # unique name prefix for spool files
#$ActionQueueMaxDiskSpace 1g # 1gb space limit (use as much as possible)
#$ActionQueueSaveOnShutdown on # save messages to disk on shutdown
#$ActionQueueType LinkedList # run asynchronously
#$ActionResumeRetryCount -1 # infinite retries if host is down
# remote host is: name/ip:port, e.g. 192.168.0.1:514, port optional
#*.* @@remote-host:514
# ### end of the forwarding rule ###
# A template to for higher precision timestamps + severity logging
$template SpiceTmpl,"%TIMESTAMP%.%TIMESTAMP:::date-subseconds% %syslogtag% %syslogseverity-text%:%msg:::sp-if-no-1st-sp%%msg:::drop-last-lf%\n"
:programname, startswith, "spice-vdagent" /var/log/spice-vdagent.log;SpiceTmpl
[root@localhost student]#
Ne kete seksion do te trajtojme disa ceshtje qe kane te bejne me konfigurimin e rrjetit:
Skedaret qe duhet te ndryshojme kur konfigurojme sherbimet e rrjetit ne nje sistem
Si te aktivizojme sherbimet e rrjetit nga xinetd
Si te aktivizojme sherbimet e rrjetit nepermjet skripteve rc
Skedare te tjere te konfigurimit te rrjetit ne dosjen /etc/sysconfig
Nese duam te konfigurojme rrjetin ne nje server te sapo instaluar apo nese jemi duke e zhvendosur serverin ne nje tjeter rrjet eshte e nevojshme te modifikojme permbajtjen e disa skedareve per te konfigururar sherbimet e rrjetit.
Me konkretisht:
Per te vendosur adresen IP ne kartat e rrjetit do te ndryshojme permbajtjen e skedareve:
/etc/sysconfig/network-scripts/ifcfg-eth0
/etc/sysconfig/network-scripts/ifcfg-eth1
...
Per te vendosur emrin e kompjuterit
/etc/sysconfig/network
/etc/hosts
Per te vendosur default gateway
/etc/sysconfig/network
Per te konfiguruar serverat DNS
/etc/resolv.conf
Te konfigurojme nje tabele statike lokale qe lidh IP me emer
/etc/hosts
Per te konfiguruar rradhen qe percakton menyren e perkthimit te emrave ne IP
/etc/nsswitch.conf
Te konfigurojme adresen IP
Per kete duhet te editojme skedarin /etc/sysconfig/network-scripts/ifcfg-eth0.
Si konfigurim baze karta eshte konfiguruar qe te perdore DHCP per te kerkuar nje adrese IP nga nje server DNS.
Me poshte shfaqet permbatja e skedarit /etc/sysconfig/network-scripts/ifcfg-eth0
GNU nano 2.0.9 File: /etc/sysconfig/network-scripts/ifcfg-eth0
DEVICE=eth0
HWADDR=00:0C:29:FD:69:52
TYPE=Ethernet
UUID=c6a3b291-0d92-4ac0-8b36-0316c3e5d107
ONBOOT=no
NM_CONTROLLED=yes
BOOTPROTO=dhcp
Nese doni qe ti vendosni nje adrese fikse duhet te beni none boot protocol ( BOOTPROTO=none) dhe me pas te vendosni nje IP statike.
Me poshte paraqitet nje konfigurim shembull :
DEVICE=eth0
HWADDR=00:0C:29:FD:69:52
TYPE=Ethernet
UUID=c6a3b291-0d92-4ac0-8b36-0316c3e5d107
ONBOOT=no
NM_CONTROLLED=yes
BOOTPROTO=none
IPADDR=192.168.1.123
NETMASK=255.255.255.0
NETWORK=192.168.1.0
Disa sqarime mbi opsionet e konfigurimit
BOOTPROTO=<protocol>ku, <protocol> eshte:
none — Nuk perdoret ndonje protokol.
bootp — protokolli BOOTP .
dhcp — perdoret protokolli dhcp
BROADCAST=<address>ku, <address>eshte adresa e broadcast .
DEVICE=<name> ku, <name> eshte emri i device.
DHCP_HOSTNAME — ky opsion perdoret atehere ku DHCP serveri kerkon qe klienti qe percaktoje nje emer perpara se te marre nje IP address.
HWADDR=<MAC-address>ku , <MAC-address>
IPADDR=<address>
NETMASK=<mask>ku, <mask> eshte maska e rrjetit.
NETWORK=<address>ku , <address> eshte adresa e rrjetit.
ONBOOT=<answer>ku , <answer>eshte:
yes — This device should be activated at boot-time.
no — This device should not be activated at boot-time.
USERCTL=<answer>, where <answer> is one of the following:
yes — Non-root users are allowed to control this device.
no — Non-root users are not allowed to control this device.
Te vendosim emrin e kompjuterit
Per te vendosur emrin e kompjuterit duhet te editojme dy skedare:
/etc/sysconfig/network
/etc/hosts
/etc/sysconfig/network
Me poshte eshte nje version i skedarit:
GNU nano 2.0.9 File: /etc/sysconfig/network
NETWORKING=yes
HOSTNAME=localhost.localdomain
Duhet te vendosim emrin e kompjuterit tek HOSTNAME
Per shembull per ti vendosur kompjuterit emrin myserver:
GNU nano 2.0.9 File: /etc/sysconfig/network
NETWORKING=yes
HOSTNAME=myserver
Gjithashtu duhet modifikuar skedari /etc/hosts ku duhet percaktuar qe loopback adresa shenon tek emri i ri myserver.
GNU nano 2.0.9 File: /etc/hosts
127.0.0.1 myserver localhost localhost.localdomain localhost4 localhost4.localdomain4
::1 localhost localhost.localdomain localhost6 localhost6.localdomain6
pas ketij konfigurimi nese restart-ojme network:
[root@localhost /]# /etc/init.d/network restart
Shutting down loopback interface: [ OK ]
Bringing up loopback interface: [ OK ]
[root@localhost /]#
nese i bejme ping myserver do te pergjigjet adresa loopback e serverit.
[root@localhost /]# ping myserver
PING myserver (127.0.0.1) 56(84) bytes of data.
64 bytes from myserver (127.0.0.1): icmp_seq=1 ttl=64 time=0.110 ms
64 bytes from myserver (127.0.0.1): icmp_seq=2 ttl=64 time=0.110 ms
^C
--- myserver ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 1310ms
rtt min/avg/max/mdev = 0.110/0.110/0.110/0.000 ms
[root@localhost /]#
Te percaktojme default gateway
Per te percaktuar default gateway editojme skedarin /etc/network duke shtuar direktiven GATEWAY
GNU nano 2.0.9 File: /etc/sysconfig/network Modified
NETWORKING=yes
HOSTNAME=myserver
GATEWAY=192.168.1.1
Po te afishojme rrugezimin nepemjet route -v do te veme re qe default gateway eshte 192.168.1.1
Te vendosim serverin DNS
GNU nano 2.0.9 File: /etc/resolv.conf
# Vendosen adresat e DNS
domain localdomain
search localdomain
nameserver 80.78.66.66
nameserver 80.78.66.67
Te konfigurojme /etc/hosts per te perkthyer disa adresa lokalisht
GNU nano 2.0.9 File: /etc/hosts
127.0.0.1 myserver localhost localhost.localdomain localhost4 localhost4.localdomain4
::1 localhost localhost.localdomain localhost6 localhost6.localdomain6
127.0.0.1 www.facebook.com
Po te provojme te bejme ping tani drejt www.facebook.com do te marrim reply nga 127.0.0.1
[root@localhost /]# ping www.facebook.com
PING www.facebook.com (127.0.0.1) 56(84) bytes of data.
64 bytes from myserver (127.0.0.1): icmp_seq=1 ttl=64 time=0.174 ms
64 bytes from myserver (127.0.0.1): icmp_seq=2 ttl=64 time=0.153 ms
64 bytes from myserver (127.0.0.1): icmp_seq=3 ttl=64 time=0.138 ms
^C
--- www.facebook.com ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 2913ms
rtt min/avg/max/mdev = 0.138/0.155/0.174/0.014 ms
[root@localhost /]#
Percaktimi i rradhes nga do kerkohet perkthimi i emrave
Duhet ti tregojme serverit ne cfare rradhe do ti perdore mekanizmat e perkthimit te emrave.
Per kete duhet te editojme skedarin /etc/nsswitch.conf
GNU nano 2.0.9 File: /etc/nsswitch.conf
hosts: files dns
files: nenkupton qe ne fillim kerkohet tek skedaret lokale ( /etc/hosts) dhe nese nuk e perkthen dot kerkon tek
dns: qe nenkupton serverat DNS qe percaktuam me lart tek skedari /etc/resolv.conf
xinetd starton ne bootup dhe degjon ne portat e rrjetit te percaktuara ne /etc/xinetd.conf for incoming network con-
nections. When a new connection is made, xinetd starts up the corresponding network service.
Eshte e nevojshme qe ta instalojme xinetd.
[root@localhost /]# yum install xinetd
Loaded plugins: product-id, refresh-packagekit, security, subscription-manager
This system is receiving updates from Red Hat Subscription Management.
rhel-6-server-cf-tools-1-rpms | 2.8 kB 00:00
rhel-6-server-rhev-agent-rpms | 3.1 kB 00:00
rhel-6-server-rpms | 3.7 kB 00:00
Setting up Install Process
Resolving Dependencies
--> Running transaction check
---> Package xinetd.i686 2:2.3.14-39.el6_4 will be installed
--> Finished Dependency Resolution
Dependencies Resolved
=================================================================================================================================================================================
Package Arch Version Repository Size
=================================================================================================================================================================================
Installing:
xinetd i686 2:2.3.14-39.el6_4 rhel-6-server-rpms 122 k
Transaction Summary
=================================================================================================================================================================================
Install 1 Package(s)
Total download size: 122 k
Installed size: 258 k
Is this ok [y/N]: Y
Downloading Packages:
xinetd-2.3.14-39.el6_4.i686.rpm | 122 kB 00:00
Running rpm_check_debug
Running Transaction Test
Transaction Test Succeeded
Running Transaction
Installing : 2:xinetd-2.3.14-39.el6_4.i686 1/1
Verifying : 2:xinetd-2.3.14-39.el6_4.i686 1/1
Installed:
xinetd.i686 2:2.3.14-39.el6_4
Complete!
[root@localhost /]#
Pas instalimit nese verifikojme permbajtjen e skedarit xinetd.conf verejme qe aty konfigurohen sherbimet e rrjetit:
[root@localhost /]# cat /etc/xinetd.conf
#
# This is the master xinetd configuration file. Settings in the
# default section will be inherited by all service configurations
# unless explicitly overridden in the service configuration. See
# xinetd.conf in the man pages for a more detailed explanation of
# these attributes.
defaults
{
# The next two items are intended to be a quick access place to
# temporarily enable or disable services.
#
# enabled =
# disabled =
# Define general logging characteristics.
log_type = SYSLOG daemon info
log_on_failure = HOST
log_on_success = PID HOST DURATION EXIT
# Define access restriction defaults
#
# no_access =
# only_from =
# max_load = 0
cps = 50 10
instances = 50
per_source = 10
# Address and networking defaults
#
# bind =
# mdns = yes
v6only = no
# setup environmental attributes
#
# passenv =
groups = yes
umask = 002
# Generally, banners are not used. This sets up their global defaults
#
# banner =
# banner_fail =
# banner_success =
}
includedir /etc/xinetd.d
[root@localhost /]#
Vini re direktiven e fundit includedir /etc/xinetd.d
qe perfshin te gjithe skedaret e konfigurimit qe ndodhen tek xinetd.d per sejcilin nga sherbimet.
Per te konfiguruar ne menyre te vecante sejcilin nga sherbimet duhet te konfigurojme skedarin perkates ne /etc/xinetd.d.