SELinux Policy for Your Parallels Plesk Panel Server
To configure SELinux you need to know the rules that should be added into the system policy.
SELinux reports all denied messages into the /var/log/audit/audit.log file and these messages can be easily converted into the rules using the /usr/bin/audit2allow utility.
cat /var/log/messages | /usr/bin/audit2allow
Also, /var/log/messages.* files can be examined for the SELinux deny messages.
Protect Server Files by Default
One aspect of Apache which is occasionally misunderstood is the feature of default access. That is, unless you take steps to change it, if the server can find its way to a file through normal URL mapping rules, it can serve it to clients.
For instance, consider the following example:
1. # cd /; ln -s / public_html
2. Accessing http://localhost/~root/
This would allow clients to walk through the entire filesystem. To work around this, add the following block to your server’s configuration:
Order Deny,Allow
Deny from all
Protect a server within a network by using a TCP Wrapper.
The Xinetd super server that comes with most Linux distributions includes a built-in TCP wrapper.
It can be used to explicitly define network services to accept incoming connections from specified servers and networks.
The TCP wrappers implements access control through the use of two files, /etc/hosts.allow and /etc/hosts.deny
A recommended security-strategy is to block all incoming requests by default, but allow specific hosts or networks to connect.
To deny everything by default, add the following line to /etc/hosts.deny:
To accept incoming SSH connections from e.g. nodes lab1, lab2 and lab3, add the following line to /etc/hosts.allow
To accept incoming SSH connections from all servers from a specific network, add the name of the subnet to /etc/hosts.allow.
For example:
sshd: lab1 lab2 lab3 .subnet.lab.com
To accept incoming ssh connections from IP address 192.168.0.1 and subnet 192.168.5, add the following line to /etc/hosts.allow:
sshd: 192.168.0.1 192.168.5.
You can even tell xinetd to limit the rate of incoming connections. The TCP wrapper is quite flexible. And xinetd provides its own set of host-based and time-based access control functions.
Upgrading Your Redhat Server.
Check your kernel release before upgrade.
If run without any packages, update will update every currently installed package.
After the upgrade check the kernel release.
yum update
If run without any packages, update will update every currently installed package.
If one or more packages are specified,Yum will only update the listed packages. While updating packages, yum will ensure that all dependencies are satisfied.
If no package matches the given package name(s), they are assumed to be a shell glob and any matches are then installed. If the –obsoletes flag is present yum will include package obsoletes in its calculations - this makes it better for distro-version changes, for example: upgrading from somelinux 8.0 to somelinux 9.
yum upgrade : Is the same as the update command with the –obsoletes flag set.
yum is an interactive, automated update program which can be used for maintaining systems.
Yum Options:
* install package1 [package2] [...]
* update [package1] [package2] [...]
* check-update
* upgrade [package1] [package2] [...]
* remove | erase package1 [package2] [...]
* list [...]
* info [...]
* provides | whatprovides feature1 [feature2] [...]
* clean [ packages | headers | metadata | cache | dbcache | all ]
* makecache
* groupinstall group1 [group2] [...]
* groupupdate group1 [group2] [...]
* grouplist [hidden]
* groupremove group1 [group2] [...]
* groupinfo group1 [...]
* search string1 [string2] [...]
* shell [filename]
* resolvedep dep1 [dep2] [...]
* localinstall rpmfile1 [rpmfile2] [...]
* localupdate rpmfile1 [rpmfile2] [...]
* deplist package1 [package2] [...]
FILES
/etc/yum.conf
/etc/yum/repos.d/
/etc/yum/pluginconf.d/
/var/cache/yum/
SEE ALSO
yum.conf (5)
http://linux.duke.edu/yum/
http://wiki.linux.duke.edu/YumFaq
The File Transport Protocol, or FTP, is an older TCP protocol designed to transfer files over a network. Because all transactions with the server, including user authentication, are unencrypted, it is considered an insecure protocol and should be carefully configured.
vsftpd - A standalone, security oriented implementation of the FTP service.
Change the FTP Greeting Banner:
To change the greeting banner for vsftpd, add the following directive to the /etc/vsftpd/vsftpd.conf file:
ftpd_banner=[insert_greeting_here]
To simplify management of multiple banners, place all banners in a new directory called /etc/banners/.
To reference this greeting banner file for vsftpd, add the following directive to the /etc/vsftpd/vsftpd.conf file:
banner_file=/etc/banners/ftp.msg
