====== RHCE "Cheat Sheet" ======

This document attempts to provide answers to all study points on the [[http://www.redhat.com/certification/rhce/prep_guide/|RHCE and RHCT Exam Preparation Guide]] in a single-page (and thus, printable) format. This is **not** a "brain dump" or an attempt to cheat the [[https://www.redhat.com/courses/rh302_rhce_exam/|RH302]] exam in any way. These are just my self-study notes. Use them at your own risk.

:!: Note: Study points last updated on 2009-08-11. This list may become out of date without notice (especially after I pass the test ;-)).

===== Testing Environment with Sun VirtualBox =====

install guest additions:
<code>
yum install gcc kernel-devel
sh /media/VBOXADDITIONS*/VBoxLinuxAdditions-x86.run
reboot
</code>

===== Prerequisite skills for RHCT and RHCE =====

Candidates should possess the following skills, as they may be necessary in order to fulfill requirements of the RHCT and RHCE exams:

==== use standard command line tools (e.g., ls, cp, mv, rm, tail, cat, etc.) to create, remove, view, and investigate files and directories ====

==== use grep, sed, and awk to process text streams and files ====

==== use a terminal-based text editor, such as vim or nano, to modify text files ====

==== use input/output redirection ====

^ operator ^ description ^
| > | redirect STDOUT to a file |
| 2> | redirect STDERR to a file |
| &> | redirect all output to a file |
| 2>&1 | redirect all output to a pipe |

  * use **>>** to append instead of overwrite

==== understand basic principles of TCP/IP networking, including IP addresses, netmasks, and gateways for IPv4 and IPv6 ====

==== use su to switch user accounts ====

<code bash>
su - <user>
</code>

==== use passwd to set passwords ====

<code bash>
passwd <user>
</code>

==== use tar, gzip, and bzip2 ====

<code bash>
# compress (tar/gzip)
tar cvzf <file>.tgz <directory>

# extract (tar/gzip)
tar xvzf <file>.tgz

# compress (tar/bzip)
tar cvjf <file>.tbz <directory>

# extract (tar/bzip)
tar xvjf <file>.tbz
</code>

==== configure an email client on Red Hat Enterprise Linux ====

<code bash>
echo "message" | mail <email> -s "subject"
mail <email> -s "subject" < <file>
</code>

==== use text and/or graphical browser to access HTTP/HTTPS URLs ====

  * elinks
  * lynx

==== use lftp to access FTP URLs ====

===== RHCT skills =====

==== Troubleshooting and System Maintenance ====

RHCTs should be able to:

=== boot systems into different run levels for troubleshooting and system maintenance ===

append the desired runlevel to grub's kernel line:
  * **1-5** runs appropriate rc and init scripts
  * **single** only runs rc.sysinit
  * **emergency** skips all rc and init scripts

=== diagnose and correct misconfigured networking ===

  - check **/etc/sysconfig/network**
  - check **/etc/sysconfig/network-scripts/ifcfg-<interface>**
  - service network restart
  - chkconfig network on
  - ifconfig
  - ping <localhost ip>
  - netstat -r
  - ping <default gateway>
  - ping 4.2.2.2

redhat network config tool:
<code bash>
system-config-network
</code>

=== diagnose and correct hostname resolution problems ===

  - check **/etc/nsswitch.conf**
  - check **/etc/resolv.conf**
  - check **/etc/hosts**
  - dig @<dns server> google.com

redhat network config tool:
<code bash>
system-config-network
</code>

=== configure the X Window System and a desktop environment ===

install x:
<code bash>
yum groupinstall "x window system"
</code>

  * init respawns **/etc/X11/prefdm -nodaemon** to keep x running in runlevel 5
  * **startx** to start manually

xfs is supposedly required for x windows (even though i can run x fine without it...):
<code bash>
service xfs on
chkconfig xfs on
</code>

x environment config:
  * /etc/sysconfig/desktop
  * /etc/X11/xinit/xinitrc
  * /etc/X11/xinit/Xclients
  * ~/.xinitrc
  * ~./Xclients

redhat display config tool:
<code bash>
system-config-display [--reconfig]
</code>

install gnome desktop:
<code bash>
yum groupinstall "gnome desktop environment"
</code>

switchdesk allows you to change your desktop environment:
<code bash>
yum install switchdesk
switchdesk
</code>

if switchdesk is not available, edit **/etc/sysconfig/desktop**:
<code bash>
DISPLAYMANAGER=<GNOME|KDE|XDM>
DESKTOP=<GNOME|KDE>
</code>

=== add new partitions, filesystems, and swap to existing systems ===

== partitions ==

manage partitions:
<code bash>
fdisk <device>
partprobe
</code>

== filesystems ==

make filesystems:
<code bash>
mkfs.<ext2|ext3>
</code>

label filesystems:
<code bash>
e2label <partition> <label>
blkid
</code>

manage filesystem settings:
<code bash>
tune2fs <partition>
dumpe2fs <partition>
</code>

== swap ==

note that it's possible to create a swap **file** instead of a partition:
<code bash>
dd if=/dev/zero of=<file> bs=1024 count=<size>
</code>

format the file/partition:
<code bash>
mkswap <partition|file>
nano -w /etc/fstab
swapon -va
cat /proc/swaps
</code>

=== use standard command-line tools to analyze problems and configure system ===

  * check for full filesystems, quotas
  

==== Installation and Configuration ====

RHCTs must be able to:

=== perform network OS installation ===

at boot prompt:
<code bash>
linux askmethod
</code>

=== implement a custom partitioning scheme ===

=== configure printing ===

printing support is provided by cups:
<code bash>
service cups start
chkconfig cups on
</code>

redhat printer config tool:
<code bash>
system-config-printer
</code>

web config tool:
<code>
http://localhost:631
</code>

printing via command line:
<code bash>
# print
lpr <file>
# view print queue
lpq
# remove print job
lprm <job number>
</code>

=== configure the scheduling of tasks using cron and at ===

== cron ==

make sure vixie cron is installed and running:
<code bash>
yum install vixie-cron
service crond start
chkconfig crond on
</code>

  - if **/etc/cron.allow** exists, only these users are allowed (**/etc/cron.deny** is ignored)
  - if **/etc/cron.allow** does not exist, everyone allowed except users in **/etc/cron.deny**
  - if neither exists, only root allowed
  - empty **/etc/cron.deny** means all users allowed (default)  

edit your cron jobs:
<code bash>
crontab -e 
</code>

crontab format:
<code>
<minute> <hour> <day of month> <month> <day of week> <command>
</code>

:!: **/etc/crontab** has additional **user** field before command.

== at/batch ==

make sure at is installed and running:
<code bash>
yum install at
service atd start
chkconfig atd on
</code>

  - if **/etc/at.allow** exists, only these users are allowed (**/etc/at.deny** is ignored)
  - if **/etc/at.allow** does not exist, everyone allowed except users in **/etc/at.deny**
  - if neither exists, only root allowed
  - empty **/etc/at.deny** means all users allowed (default)  

<code bash>
# add jobs
at now + 1 hour
at> <command>

at 09:00 2009-07-23
at> <command>

batch
at> <command>
</code>

<code bash>
# list jobs
atq
</code>

<code bash>
remove jobs
atrm <job>
</code>

=== attach system to a network directory service, such as NIS or LDAP ===

redhat config tools:
<code bash>
system-config-authentication
authconfig-tui
</code>

required packages for nis:
<code bash>
yum install ypbind portmap
</code>

required packages for ldap:
<code bash>
yum install nss-ldap openldap
</code>

=== configure autofs ===

make sure the autofs service is running:
<code bash>
service autofs start
chkconfig autofs on
</code>

ensure the following line in **/etc/nsswitch.conf**:
<code bash>
automount: files nis
</code>

define an autofs-controlled mountpoint called **test** by adding the following to **/etc/auto.master**:
<code bash>
/test /etc/auto.test
</code>

create **/etc/auto.test**:
<code bash>
blah example.com:/pub/something
* example:/home/&
</code>

  - local **/test/blah** => remote **example.com:/pub/something**
  - local **/test/user** => remote **example:/home/user** (:!: this method can be used to automount home directories)

test automounting:
<code bash>
ls /test/blah
ls /test/user

# redhat defaults
ls /net/<hostname>
ls /misc/cd
</code>

=== add and manage users, groups, quotas, and File Access Control Lists ===

redhat user/group config tool:
<code bash>
system-config-users
</code>

== users ==

**/etc/passwd** file format:
<code>
username:password:uid:gid:gecos:homedir:shell
</code>

**/etc/shadow** file format:
<code>
username:password:lastpwchange:minpwchange:maxpwage:pwchangewarn:inactive:expire
</code>

command line user management:
<code bash>
useradd <user>
usermod <user>
chage <user>
userdel <user>
pwck
</code>

  * default account expiration settings in **/etc/login.defs**

== groups ==

**/etc/group** file format:
<code>
groupname:password:gid:members
</code>

command line group management:

<code bash>
groups <user>
groupadd <user>
groupmod <user>
groupdel <user> 
grpck
</code>

== quotas ==

install quota package
<code bash>
yum install quota
</code>

add fs options to **/etc/fstab**:
<code bash>
usrquota,grpquota
</code>

remount device
<code bash>
mount -o remount <mount point>
</code>

init quota database:
<code bash>
quotacheck -cugm <device>
</code>

enable/disable quotas
<code bash>
quotaon <device>
quotaoff <device>
</code>

edit quotas
<code bash>
edquota -u <user>
edquota -g <group>
</code>

edit grace time
<code bash>
edquota -ut <user>
edquota -gt <group>
</code>

check/report quotas
<code bash>
quota <user>
repquota -aug
</code>

== Access Control Lists ==

install acl package
<code bash>
yum install acl
</code>

add fs options to **/etc/fstab**:
<code bash>
acl
</code>

remount device:
<code bash>
mount -o remount <mount point>
</code>

manage acls:
<code bash>
# set acls
setfacl -m [d:]u:<user>:<r|w|x|-> <file>
setfacl -m [d:]g:<group>:<r|w|x|-> <file>

# get acls
getfacl <file>

# remove acls
setfacl -x u:<user> <file>
setfacl -x g:<user> <file>
setfacl --remove-all <file>
setfacl --remove-default <file>
</code>

=== configure filesystem permissions for collaboration ===

  - create new group
  - add users to group
  - chown folder to root.<group>
  - chmod folder to 2770 (g+s)

=== install and update packages using rpm ===

<code bash>
# install
rpm -ivh <package>.rpm

# update
rpm -Uvh <package>.rpm

# freshen 
rpm -Fvh <package>.rpm

# remove
rpm -e <package>

# query by file name
rpm -qf <full path of file>

# verify a file
rpm -Vf > <full path of file>

# verify status of all packages
rpm -Va > /tmp/rpmverify
</code>

:!: while inside the rescue environment, use the --root option to specify the **real** location of your root file system (e.g. --root=/mnt/sysimage).

=== properly update the kernel package ===

  - **always** do an install (i.e. rpm -ivh <kernel package>) rather than an update
  - check **/boot/grub/grub.conf** for proper configuration

=== configure the system to update/install packages from remote repositories using yum or pup ===

yum config goes in **/etc/yum.repos.d/**

<code>
[id]
name=my repo
baseurl=http://example.com/centos/
enabled=1
</code>

=== modify the system bootloader ===

  * production config is in **/boot/grub/grub.conf**
  * see examples in **/usr/share/doc/grub-*/menu.lst**

=== implement software RAID at install-time and run-time ===

to start, we need at least two devices/partitions of type "linux raid autodetect" (use fdisk to set partition type to "fd")

create raid device:
<code bash>
mdadm --create /dev/md0 --level=<0|1|4|5|6|10> --raid-devices=<num> <device list>
</code>

fail disk in array:
<code bash>
mdadm /dev/md0 -f <device>
</code>

remove disk from array:
<code bash>
mdadm /dev/md0 -r <device>
</code>

add disk to array:
<code bash>
mdadm /dev/md0 -a <device>
</code>

stop array:
<code bash>
mdadm --stop /dev/md0
</code>

check raid status:
<code bash>
mdadm --detail /dev/md0
</code>
<code bash>
cat /proc/mdstat
</code>

format works as usual:
<code bash>
mkfs.ext3 /dev/md0
</code>

:!: don't forget to configure **/etc/fstab** appropriately.

=== use /proc/sys and sysctl to modify and set kernel run-time parameters ===

config is in **/etc/sysctl.conf**

<code bash>
# search through parameters
sysctl -a | grep <whatever>
# apply changes from config file immediately
sysctl -p
</code>

=== use scripting to automate system maintenance tasks ===

=== configure NTP for time synchronization with a higher-stratum server ===

redhat config tool:
<code>
system-config-date
</code>

  * config is in **/etc/ntp.conf**

synchronization configuration example:
<code>
server 0.pool.ntp.org
server 1.pool.ntp.org
server 2.pool.ntp.org
</code>

apply changes:
<code>
service ntpd restart
chkconfig ntpd on
</code>

verify changes:
<code bash>
ntpq -p
</code>

===== RHCE skills =====

==== Troubleshooting and System Maintenance ====

RHCEs must demonstrate the RHCT skills listed above, and should be able to:

=== use the rescue environment provided by first installation CD ===

<code bash>
linux rescue
</code>

  * when working in non-chrooted rescue mode:
    * mount /dev/hdc /mnt/source (to access install files on the cd/dvd)
    * rpm commands should use the **--root=/mnt/sysimage** option    

manually make /dev and /proc available in chrooted mode:
<code bash>
mount -o bind /dev /mnt/sysimage/dev
mount -o bind /proc /mnt/sysimage/proc 
</code>

=== diagnose and correct boot failures arising from bootloader, module, and filesystem errors ===

check in order:
  - mbr
  - /boot/grub/grub.conf
  - /etc/fstab
  - /etc/inittab
  - /etc/rc.d/rc.sysinit
  - /etc/rc.d/rc*.d
  - /etc/rc.d/init.d/*
  - /etc/rc.d/rc.local

== grub errors ==

  * in general, use the last line before the error message to see where grub error'd out
  * to find correct value for **root** option, type **find /grub/stage1** at the grub command line (:!: remember that all file names in **grub.conf** are relative to the **root** option)
  * check for missing files in kernel and/or initrd lines

== kernel errors ==

  * missing/corrupt initrd file results in: **kernel panic - not syncing: vfs: unable to mount root fs on unknown-block**
  * invalid **root** parameter for kernel results in: **setuproot: error mounting /proc: No such file or directory**

=== ===

reinstall grub to mbr:
<code bash>
grub-install <device>
</code>

recreate initrd:
<code bash>
mkinitrd <filename> <kernel version>
</code>

fix corrupt filesystem:
<code bash>
fsck <partition>
</code>

if fsck is unable to locate a superblock, you can specify an alternative one:

<code bash>
dumpe2fs <partition>
fsck -b <block#> <partition>
</code>


=== diagnose and correct problems with network services (see Installation and Configuration below for a list of these services) ===

see what's listening on what port:
<code bash>
netstat -ntaupe
</code>

=== add, remove, and resize logical volumes ===

redhat lvm config tool:
<code bash>
yum install system-config-lvm
system-config-lvm
</code>

create physical volume:
<code bash>
pvcreate <device>
</code>

create volume group:
<code bash>
vgcreate <name> <pv device> [pv device]
</code>

extend volume group:
<code bash>
vgextend <name> <pv device>
</code>

create logical volume:
<code bash>
lvcreate --size <size>M --name <lv name> <vg name>
</code>

extend logical volume:
<code bash>
lvextend --size <size>M <device>
resize2fs <device>
</code>

shrink logical volume:
<code bash>
resize2fs <device> <size>M
lvreduce --size <size>M <device>
</code>

remove logical volume:
<code bash>
lvremove <device>
</code>

=== diagnose and correct networking services problems where SELinux contexts are interfering with proper operation. ===

enable/disable selinux in **/etc/sysconfig/selinux**:
<code>
SELINUX=enforcing
SELINUXTYPE=targeted
</code>

install selinux troubleshooter:
<code bash>
yum install setroubleshoot
service setroubleshoot start
chkconfig setroubleshoot on
</code>

install selinux management tool:
<code bash>
yum install policycoreutils-gui
</code>

list selinux errors:
<code bash>
sealert -a /var/log/audit/audit.log | less
</code>

launch gui browser:
<code bash>
sealert -b
</code>

list selinux booleans:
<code bash>
getsebool -a
</code>

set selinux boolean:
<code bash>
setsebool -P <boolean> = <0|1>
</code>

list security contexts:
<code bash>
ls -Z <file>
</code>

change security contexts:
<code bash>
# using reference (copy contexts from existing known-good file)
chcon -R --reference <old file> <new file>

# manual
chcon -R -u <user> <file>
chcon -R -t <type> <file>
</code>

==== Installation and Configuration ====

RHCEs must demonstrate the RHCT-level skills listed above, and they must be capable of configuring the following network services. For each of these services, RHCEs must be able to:

  * install the packages needed to provide the service
  * configure SELinux to support the service
  * configure the service to start when the system is booted
  * configure the service for basic operation
  * Configure host-based and user-based security for the service

=== HTTP/HTTPS ===

== install ==

<code bash>
yum install httpd mod_ssl
</code>

== selinux ==

make new DocumentRoot match default DocumentRoot (:!: this applies to any directory that apache will serve files from):
<code bash>
chcon -R --reference /var/www /www
</code>

== start at boot ==

<code bash>
chkconfig httpd on
</code>

== basic config ==

  * requirements for ~user/ directories:
    * **UserDir** directive
    * **chmod 701** the user's home directory
    * change security context on the user's **UserDir**

  * requirements for .htaccess file usage:
    * **AllowOverride All** directive

  * requirements for name-based virtual hosts:
    * **NameVirtualHost *:80** and **NameVirtualHost *:443** directives
    * each virtual host requires appropriate **ServerName** and **ServerAlias** directives
    * :!: a single virtual host cannot span multiple ports (i.e. 80 and 443).  two separate **VirtualHost *:<port>** sections are needed to do this.

self-signed ssl cert:
<code bash>
cd /etc/pki/tls/certs
rm localhost.crt
make testcert
</code>

check virtual host config:
<code bash>
httpd -D DUMP_VHOSTS
</code>

== host-based security ==

firewall config:
^ protocol ^ ports ^
| tcp | 80, 443 |

hosts are allowed by default and must be explicitly denied:
<code>
<Directory /var/www/html>     
     Order deny,allow
     Deny from 192.168.0.0/255.255.255.0
     Deny from badguys.example.com
</Directory>
</code>

hosts are denied by default and must be explicitly allowed:
<code>
<Directory /var/www/html>     
     Order allow,deny
     Allow from 192.168.0.0/255.255.255.0
     Allow from goodguys.example.com
</Directory>
</code>

== user-based security ==

create web password file:
<code bash>
htpasswd -c /etc/httpd/webusers testuser1
htpasswd /etc/httpd/webusers testuser2
</code>

create web group file (**/etc/httpd/webgroups**):
<code bash>
testgroup: testuser1 testuser2
</code>

allow access by group:
<code>
<Directory /var/www/html>     
     AuthType Basic
     AuthName "top secret area"
     AuthUserFile /etc/httpd/webusers
     AuthGroupFile /etc/httpd/webgroups
     Require group testgroup
</Directory>
</code>

== verify service functionality ==

test http/https:
<code bash>
elinks <http|https>://<hostname>/[path]
</code>

=== SMB ===

== install ==
<code bash>
yum install samba samba-client
</code>

== selinux ==

allow samba to share home directories:
<code bash>
setsebool -P samba_enable_home_dirs=1
</code>

mark a directory as sharable with samba:
<code bash>
chcon -R -T samba_share_t <directory>
</code>

== start at boot ==
<code bash>
chkconfig smb on
</code>

== basic config ==

redhat samba config tool:
<code bash>
yum install system-config-samba
system-config-samba
</code>

set workgroup/domain:
<code>
workgroup = <workgroup>
</code>

security modes:
<code>
# connections check local pwdb (default)
security = user

# member server on a domain, uses pwdb on a dc
security = domain
workgroup = EXAMPLE

# member server on an ad domain using kerberos, uses pwdb on a dc
security = ads
realm = EXAMPLE.COM
password server = kerberos.example.com

# used when samba was not capable of being a domain member server (DO NOT USE)
security = server
encrypt passwords = yes
password server = <netbios name of dc>

# each share requires a password (DO NOT USE)
security = share
</code>

share options:
<code>
[<share name>]
# path for share
path = <path> 

# share is visible 
browseable = <yes|no>

# rw enabled
writeable = <yes|no>

# this is a shared printer
printable = <yes|no>

# all users connecting to this share use <group> as their primary group
group = <group name>
</code>

join domain:
<code bash>
net rpc join -U root
</code>

fstab example:
<code bash>
//<hostname>/<share> <mountpoint>    cifs    user=<username>,pass=<password>    0 0
</code>

:!: **mount.cifs** and **umount.cifs** need to be chmod'ed u+s in order to be used by non-root users

== host-based security ==

firewall config:
^ protocol ^ ports ^
| tcp | 139, 445 |
| udp | 137, 138 |

hosts allow/deny can be used per-server or per-share:
<code>
hosts allow = 127.0.0.1 192.168.2.0/24 192.168.3.0/24
hosts deny = 0.0.0.0/0
</code>

== user-based security ==

account maintenance:
<code bash> 
# add account (local linux account must exist first, or be translated via /etc/samba/smbusers):
smbpasswd -a <username>

# enable/disable account:
smbpasswd -e <username>
smbpasswd -d <username>

# remove account:
smbpasswd -x <username>
</code>

:!: **service smb reload** may be needed after account changes

share access:
<code>
valid users = <user1> @<group1>
</code>

  * share access is also controlled by unix file permissions

== verify service functionality ==

list shares:
<code bash>
smbclient -L <hostname> -U <username>
</code>

browse shares:
<code bash>
smbclient //<hostname>/<share> -U <username>
</code>

test allow/deny statements for a host:
<code bash>
testparm /etc/samba/smb.conf <hostname> <ip address>
</code>

=== NFS ===

== install ==

<code bash>
yum install portmap nfs-utils
</code>

== start at boot ==

<code bash>
chkconfig portmap on
chkconfig nfs on
chkconfig nfslock on
chkconfig netfs on
</code>

== basic config ==

redhat config tool:
<code bash>
yum install system-config-nfs
system-config-nfs
</code>

format of **/etc/exports**:
<code>
<mountpoint> <host>(<options>) [<host>(<options>) ...]
</code>

activate new exports:
<code bash>
/etc/init.d/nfs restart
</code>

== host-based security ==

:!: edit **/etc/sysconfig/nfs** and restart nfs to set static ports

firewall config:
<code bash>
# see ports 
rpcinfo -p
</code>

host based security is intrinsic to the format of the exports file

== user-based security ==

use standard file permissions

== verify service functionality ==

list exports:
<code>
showmount -e <host>
</code>

=== FTP ===

== install ==

<code bash>
yum install vsftpd
</code>

== selinux ==

allow local users to log in and cd into home directories:
<code bash>
setsebool -P ftp_home_dir=1
</code>

== start at boot ==

<code bash>
chkconfig vsftpd on
</code>

== basic config ==

== host-based security ==

  * use ipchains with **-[!]s** option

firewall config:
^ protocol ^ ports ^
| tcp | 21 |

:!: ftp data transfers will not work unless **ip_conntrack_ftp** is added to **IPTABLES_MODULES** in **/etc/sysconfig/iptables-config**

tcp_wrappers example:
<code>
vsftpd : 192.168.0.
</code>

== user-based security ==

  * allow/deny controlled via **/etc/vsftpd/user_list** (:!: users in **/etc/vsftpd/ftpusers** are always denied via pam)
  * default allow/deny is configured by **userlist_deny** statement in **vsftpd.conf**

== verify service functionality ==

test ftp:
<code bash>
ftp <server>
</code>

=== Web proxy ===

== install ==

<code bash>
yum install squid
</code>

== selinux ==

allow squid to connect to the network (this is recommended, but was not needed in my testing):
<code bash>
setsebool -P squid_connect_any=1
</code>

== start at boot ==

<code bash>
chkconfig squid on
</code>

== host-based security ==

firewall config:
^ protocol ^ ports ^
| tcp | 3128 |

allow access from local networks:
<code>
acl our_networks src 192.168.1.0/24 192.168.2.0/23
http_access allow our_networks
</code>

== user-based security ==

FIXME

== verify service functionality ==

test proxy:
<code bash>
HTTP_PROXY=<server>:3128 elinks
</code>

=== SMTP ===

== install ==

<code bash>
yum install postfix
alternatives --config mta
service sendmail stop
</code>

== start at boot ==

<code bash>
chkconfig postfix on
</code>

== basic config ==

listen on public interfaces:
<code>
inet_interfaces = all
</code>

specify all destination hostnames/domains:
<code>
mydestination = <hostname1>, <hostname2>, ...
</code>

specify origin domain:
<code>
myorigin = $mydomain
</code>

local aliases in **/etc/aliases** (:!: dont forget to run **newaliases** to apply changes):
<code>
<alias>: <user1>[, user2]
</code>

virtual aliases in **/etc/postfix/virtual** (:!: dont forget to run **postmap /etc/postfix/virtual** to apply changes):
<code>
<virtual alias>: <user>
</code>

enable virtual aliases:
<code>
virtual_alias_maps = hash:/etc/postfix/virtual
</code>

outbound address rewriting in **/etc/postfix/generic** (:!: dont forget to run **postmap /etc/postfix/generic** to apply changes):

<code>
<outbound alias>: <user>
</code>

enable outbound aliases:
<code>
smtp_generic_maps = hash:/etc/postfix/generic
</code>

== host-based security ==

  * use ipchains with **-[!]s** option

firewall config:
^ protocol ^ ports ^
| tcp | 25 |

== user-based security ==

FIXME use smtp auth?

== verify service functionality ==

test smtp:
<code bash>
telnet <server> 25
</code>

=== IMAP, IMAPS, and POP3 ===

== install ==

<code bash>
yum install dovecot
</code>

== start at boot ==

<code bash>
chkconfig dovecot on
</code>

== basic config ==

enable protocols:
<code>
protocols = <protocol list>
</code>

create custom ssl cert:
<code>
nano -w /etc/pki/dovecot/dovecot-openssl.cnf
/usr/share/doc/dovecot-*/examples/mkcert.sh
service dovecot restart
</code>

== host-based security ==

use ipchains with **-[!]s** option

^ protocol ^ ports ^
| tcp | 143, 110, 995, 993 |

== user-based security ==

use pam_listfile in **/etc/pam.d/dovecot**

== verify service functionality ==

test mailbox acess:
<code bash>
mutt -f <imap|imaps|pop|pops>://<user>@<server>
</code>


=== SSH ===

== install ==

<code bash>
yum install openssh-server
</code>

== start at boot ==

<code bash>
chkconfig sshd on
</code>

== user-based security ==

allow/deny user access:
<code>
AllowUsers user1 user2 user3@example.com
DenyUsers user4 user5 user6@example.com
</code>

== host-based security ==

  * use ipchains with **-[!]s** option

firewall config:
^ protocol ^ ports ^
| tcp | 22 |

tcp_wrappers example:
<code>
sshd : 192.168.0.
</code>

== verify service functionality ==

test logging in:
<code bash>
ssh <user>@<server>
</code>

=== DNS (caching name server, slave name server) ===

== install ==

<code bash>
yum install bind-chroot caching-nameserver
</code>

== start at boot ==

<code bash>
chkconfig named on
</code>

== basic config ==

copy sample config:
<code bash>
cp -a /var/named/chroot/etc/named.caching-nameserver.conf /var/named/chroot/etc/named.conf
</code>

caching-only nameserver:
  * edit **listen-on** directives (comment out to listen on all interfaces)
  * edit **allow-query** directives (comment out allow queries from everyone)
  * edit **match-clients** and **match-destinations** directives to allow recursive queries from other hosts

slave nameserver:
  * get slave example from **/usr/share/doc/bind-*/sample/etc/named.conf**

== host-based security ==

firewall config:
^ protocol ^ ports ^
| tcp | 53 |
| udp | 53 |

allow-query example:
<code>
allow-query { 192.168.0.0/16; localnets; };
</code>

== user-based security ==
N/A

== verify service functionality ==

test query:
<code bash>
dig @<server> <domain>
</code>

test zone transfer:
<code bash>
dig @<server> <domain> axfr
</code>

=== NTP ===

== install ==

<code bash>
yum install ntp
</code>

== start at boot ==

<code bash>
chkconfig ntpd on
</code>

== host-based security ==

firewall config:
^ protocol ^ ports ^
| udp | 123 |

allow other servers to sync with us:
<code>
restrict 192.168.1.0 mask 255.255.255.0 nomodify notrap
</code>

== user-based security ==
N/A

== verify service functionality ==

show peers:
<code bash>
ntpq -p
</code>

==== ====
RHCEs must also be able to:

=== configure hands-free installation using Kickstart ===

<code bash>
yum install system-config-kickstart
</code>

  - make installation tree available
  - create kickstart file (use **system-config-kickstart** to create **ks.cfg**) and validate (using **ksvalidator**)
  - validate kickstart file
  - make kickstart file available
    * bootable diskette (place in top level directory)
    * bootable cdrom (place in top level directory)
    * network (http, ftp, nfs)
  - use bootable media and supply appropriate kernel parameter

<code bash>
ks=floppy:/ks.cfg
ks=cdrom:/ks.cfg
ks=http://example.com/ks.cfg
ks=nfs:example.com:/ks.cfg
</code>

=== implement logical volumes at install-time === 

=== use iptables to implement packet filtering and/or NAT === 

:!: do **not** use system-config-securitylevel, as it will overwrite your custom iptables rules. the following method seems to be the best way to go:

  - make changes in **/etc/sysconfig/iptables**
  - run **/etc/init.d/iptables restart** to apply changes

== packet filtering ==

packet filtering example:
<code bash>
-A <chain> -p <tcp/udp> -m <tcp/udp> [-s[!] <source address>] --dport <destination port> -j ACCEPT
</code>

== NAT ==

enable ip forwarding in **/etc/sysctl.conf**:
<code>
net.ipv4.ip_forward = 1
</code>

to test from another machine:
<code bash>
ip route replace default via <ip address>
</code>

inbound dnat:
<code bash>
iptables -t nat -A PREROUTING -p <tcp/udp> --dport <destination port> -j DNAT --to-dest <private server>:<port>
</code>

outbound dnat:
<code bash>
iptables -t nat -A OUTPUT -p <tcp/udp> --dport <destination port> -j DNAT --to-dest <private server>:<port>
</code>

masquerading:
<code bash>
iptables -t nat -A POSTROUTING -o <outbound interface> -j MASQUERADE
</code>

snat:
<code bash>
iptables -t nat -A POSTROUTING -j SNAT --to-source <public server>:<port>
</code>

FIXME

=== use PAM to implement user-level restrictions === 

== module documentation == 
  * **/usr/share/doc/pam-*/txts**

== module configuration == 
  * **/etc/pam.d**
  * **/etc/security**

<code>
<module interface> <control flag> <module name> <module arguments>
</code>

^ module interface ^ description ^
| auth | user authentication (e.g. verifies password, set group membership or kerberos tickets, etc.) |
| account | verifies that access is allowed (e.g. expired account?, check group membership, etc.) |
| password | handles password changes |
| session | manages user sessions (e.g. mount home dir, create mailbox, logging, etc.) |

^ control flag ^ description ^
| required | must pass, **continue** testing on failure |
| requisite | must pass, **stop** testing on failure |
| sufficient | failure is ignored, but if passing so far, return success at this point |
| optional | pass or failure is irrelevant |
| include | include another file |

== pam_listfile.so example ==

allow/deny users if listed in **/etc/special**:
<code>
auth required pam_listfile.so onerr=success item=user sense=<allow|deny> file=/etc/special
</code>

===== Additional Notes =====

==== tcp_wrappers  ====

file format:
<code>
<daemon list> : <client list> [except <client list>] [: <option>]
</code>

search order:
  - /etc/hosts.allow
  - /etc/hosts.deny
  - allow by default

:!: searching stops on first match

==== Troubleshooting ====

=== unable to log in ===

  * password wrong or expired?
  * account locked?
  * shell set to **/sbin/nologin**, **/bin/false**, etc.?
  * root user and **PermitRootLogin no** in **/etc/ssh/sshd_config**?
  * root user and terminal not listed in **/etc/securetty**?
  * non-root user and **/etc/nologin** exists?
  * check pam_listfile restrictions