Advanced Linux systems administration with a a focus on security. This is a custom course based on topics from the GL615 and GL550. Derived for UNM.
Prerequisites:
Fundamental to intermediate Linux systems administration experience.
Supported Distributions:
Red Hat Enterprise Linux 6
Course Outline:
- Linux Kernel & Hardware
- Kernel Hardware Info - /sys/
- /sys/ Structure
- udev
- Kernel Modules
- Configuring Kernel Components and Modules
- Handling Module Dependencies
- Configuring the Kernel via /proc/
- System Tools
- Software Maintenance
- Using the YUM command
- YUM package groups
- Configuring YUM
- YUM Repositories
- Rebuilding Source RPM Packages
- Software Tools Comparison Matrix
- Rebuilding Source RPM Packages
- Patching Software
- Revising a Package
- Creating Support Files
- Typical SysV Init Script
- Creating Menu Entries
- The Spec file
- The Header Stanza
- Prep, Build, and Install
- The Files Section
- Optional Script Section(s)
- The Changelog Section
- Advanced Packaging
- Building Packages
- Digitally Signing Packages
- Other RPM Resources
- Using YUM
- Building from Source RPMs
- Updating RPMs for New Software Releases
- Creating a New RPM Package
- Digital Signatures and RPM
- LVM & RAID
- Logical Volume Management
- Implementing LVM
- Creating Logical Volumes
- Manipulating VGs & LVs
- Advanced LVM Concepts
- system-config-lvm
- RAID Concepts
- Array Creation with mdadm
- Software RAID Monitoring
- Software RAID Control and Display
- LVM and RAID: Unix Tool Comparison
- Creating and Managing LVM Volumes
- Creating and Managing a RAID-5 Array
- Remote Storage Administration
- Remote Storage Overview
- Remote Filesystem Protocols
- Remote Block Device Protocols
- NFS Clients
- Implementing NFSv4
- AutoFS
- AutoFS Configuration
- SAN Multipathing
- Multipath Configuration
- Multipathing Best Practices
- iSCSI Architecture
- Open-iSCSI Initiator Implementation
- iSCSI Initiator Discovery
- iSCSI Initiator Node Administration
- Mounting iSCSI Targets at Boot
- iSCSI Multipathing Considerations
- Using autofs
- NFS Server Configuration
- iSCSI Initiator Configuration
- User/Group Administration
- User and Group Concepts
- User Administration
- Modifying Accounts
- Group Administration
- Unix Passwords
- Password Aging
- Auditing Passwords
- Default User Files
- Controlling Logins
- Manual DS Client Configuration
- system-config-authentication
- User/Group Administration Comparison Matrix
- John the Ripper
- User and Group Administration
- Using LDAP for Centralized User Accounts
- Troubleshooting Practice: Account Management
- Restricting superuser access to wheel group membership
- Setting Limits with the pam_limits Modules
- Using pam_limits to Restrict Simultaneous Logins
- PAM
- PAM Overview
- PAM Module Types
- PAM Order of Processing
- PAM Control Statements
- PAM Modules
- pam_unix
- pam_cracklib.so
- pam_env.so
- pam_xauth.so
- pam_tally2.so
- pam_wheel.so
- pam_limits.so
- pam_nologin.so
- pam_deny.so
- pam_warn.so
- pam_securetty.so
- pam_time.so
- pam_access.so
- pam_listfile.so
- pam_lastlog.so
- pam_console.so
- Using pam_listfile to Implement Arbitrary ACLs
- Using pam_limits to Restrict Simultaneous Logins
- Using pam_nologin to Restrict Logins
- Using pam_access to Restrict Logins
- su & pam
- Security Administration
- Security Concepts
- Tightening Default Security
- Security Advisories
- File Access Control Lists
- Manipulating FACLs
- Viewing FACLs
- Backing Up FACLs
- File Creation Permissions with umask
- User Private Group Scheme
- Alternatives to UPG
- TCP Wrappers Concepts
- TCP Wrappers Concepts
- Xinetd
- Basic Firewall Activation
- Netfilter Concepts
- Using the iptables Command
- Common match_specs
- Connection Tracking
- SELinux Security Framework
- SELinux Modes
- SELinux Commands
- Choosing an SELinux Policy
- SELinux Booleans
- SELinux Policy Tools
- (X)INETD and Firewalls
- User Private Groups
- Using Filesystem ACLs
- Securing xinetd Services
- Enforcing Security Policy with xinetd
- Securing Services with TCP Wrappers
- Securing Services with Netfilter
- Exploring SELinux Modes
- SELinux File Contexts
- Accountability with Kernel Auditd
- Accountability and Auditing
- Simple Session Auditing
- Simple Process Accounting & Command History
- Kernel-Level Auditing
- Configuring the Audit Daemon
- Controlling Kernel Audit System
- Creating Audit Rules
- Searching Audit Logs
- Generating Audit Log Reports
- Audit Log Analysis
- Auditing Login/Logout
- Auditing File Access
- Auditing Command Execution
- SELinux
- DAC vs. MAC
- Shortcomings of Traditional Unix Security
- SELinux Goals
- SELinux Evolution
- SELinux Modes
- Gathering Information
- SELinux Virtual Filesystem
- SELinux Contexts
- Managing Contexts
- The SELinux Policy
- Choosing an SELinux Policy
- Policy Layout
- Tuning and Adapting Policy
- Booleans
- Permissive Domains
- Managing File Contexts
- Managing Port Contexts
- SELinux Policy Tools
- Examining Policy
- SELinux Troubleshooting
- SELinux Troubleshooting Continued
- Exploring SELinux Modes
- SELinux Contexts in Action
- Managing SELinux Booleans
- Creating Policy with Audit2allow
- Creating & Compiling Policy from Source
- Networking
- Linux Network Interfaces
- Ethernet Hardware Tools
- Network Configuration with ip Command
- Configuring Routing Tables
- IP to MAC Address Mapping with ARP
- Starting and Stopping Interfaces
- NetworkManager
- DNS Clients
- DHCP Clients
- Network Diagnostics
- Information from netstat and ss
- Managing Network-Wide Time
- Continual Time Sync with NTP
- Configuring NTP Clients
- Multiple IP Addresses
- Enabling IPv6
- Interface Bonding
- Interface Bridging
- 802.1q VLANS
- Network Configuration Tools
- Network Discovery
- Basic Client Networking
- NTP Client Configuration
- Multiple IP Addresses Per Network Interface
- Configuring IPv6
- Troubleshooting Practice: Networking
- Monitoring & Troubleshooting
- System Status - Memory
- System Status - I/O
- System Status - CPU
- Performance Trending with sar
- Troubleshooting Basics: The Process
- Troubleshooting Basics: The Tools
- System Logging
- Rsyslog
- /etc/rsyslog.conf
- Log Management
- Log Anomaly Detector
- strace and ltrace
- Troubleshooting Incorrect File Permissions
- Inability to Boot
- Typos in Configuration Files
- Corrupt Filesystems
- RHEL6 Rescue Environment
- Process Tools
- Setting up a Full Debug Logfile
- Remote Syslog Configuration
- Recovering Damaged MBR
- BIND DNS
- The Domain Name Space
- Delegation and Zones
- Server Roles
- Resolving Names
- Resolving IP Addresses
- Basic BIND Administration
- Configuring the Resolver
- Testing Resolution
- LDAP Concepts and Clients
- LDAP: History and Uses
- LDAP: Data Model Basics
- LDAP: Protocol Basics
- LDAP: Applications
- LDAP: Search Filters
- LDIF: LDAP Data Interchange Format
- OpenLDAP Client Tools
- Alternative LDAP Tools
- Querying LDAP
- vsFTPd & Apache
- vsftpd
- Anonymous FTP with vsftpd
- Configuring vsftpd
- HTTP Operation
- Apache Architecture
- Apache Configuration Files
- httpd.conf - Server Settings
- httpd.conf - Main Configuration
- httpd.conf - VirtualHost Configuration
- Virtual Hosting DNS Implications
- Adding Modules to Apache
- Apache Logging
- Configuring vsftpd
- Apache Architecture
- Apache Content
- Configuring Virtual Hosts
- Apache Security
- Apache Overview
- Configuring CGI
- Turning Off Unneeded Modules
- Delegating Administration
- Apache Access Controls (mod_access)
- HTTP User Authentication
- Standard Auth Modules
- HTTP Digest Authentication
- SSL Using mod_ssl.so
- Authentication via SQL
- Authentication via LDAP
- Scrubbing HTTP Headers
- Metering HTTP Bandwidth
- Hardening Apache by Minimizing Loaded Modules
- Scrubbing Apache & PHP Version Headers
- Protecting Web Content
- Using the suexec Mechanism
- Create a TLS CA key pair
- Using SSL CA Certificates with Apache
- Enable Apache SSL Client Certificate Authentication
- SQUID Proxy Server
- Squid Overview
- Squid File Layout
- Squid Access Control Lists
- Applying Squid ACLs
- Tuning Squid & Configuring Cache Hierarchies
- Bandwidth Metering
- Monitoring Squid
- Proxy Client Configuration
- Installing and Configuring Squid
- Squid Cache Manager CGI
- Proxy Auto Configuration
- Configure a Squid Proxy Cluster
- Local Storage Administration
- Partitioning Disks with fdisk
- Partitioning Disks with parted
- Filesystem Creation
- Mounting Filesystems
- Extended Filesystem Maintenance
- Resizing Filesystems
- Managing an XFS Filesystem
- Swap
- Configuring Disk Quotas
- Setting Quotas
- Viewing and Monitoring Quotas
- Filesystem Attributes
- Backup Software
- Backup Examples
- Filesystem Creation and Management
- Creating and Managing Filesystems
- Hot Adding Swap
- Setting User Quotas
- Using tar and cpio for Backups
- Using rsync and ssh for Backups
- Using dump and restore for Backups
- Spacewalk
- Spacewalk
- Hierarchical organization model
- Logging
- Hardware and software inventory
- Software Management
- Configuration File Control
- Provisioning Systems
- Spacewalk Installation
- Spacewalk Channels