LINUX SERVER BUILD & SECURITY CONFIG N.E.T LAB Junior, 05 HJS Sophomore, 04 PJK Network Engineer Training Laboratory

TABLE & GRAPH

CONTENTS BEGIN,, ◎ Built environment - p. 4 ◎ Install - p. 5 SERVER,, ◎ DNS server config - p. 6 ◎ TELNET sever config - p. 8 ◎ FTP server config - p. 9 ◎ DB server config - p. 10 ◎ WEB server config - p. 11 Network Engineer Training Laboratory EXAM SERVER,, ◎ Simple WEB server page - p. 12 ◎ DB server use for PHP - p. 13 SECURITY,, ◎ Soft security - p. 14 ◎ Hard security - p. 15 BACKUP,, ◎ Two week-cycle auto backup at DB server PC #hdb - p. 16 FIN,, - p. 18

Built environment ◎ Used two PC for cross server PC #1 PC #2 º DNS serverº DATABASE server º WEB serverº BACKUP server º FTP server º TELNET server Network Engineer Training Laboratory BEGIN,, DEBIAN LINUX SERIES DEBIAN LINUX UBUNTU 5.01 KERNELUBUNTU Mbps NETWORK100 Mbps IP ADDRESS P4 2.8C PC SPECAMD GB ram/160GB HDD 512MB ram/5GB HDD p. 4

Install ◎ COMMON º Select language : ENGLISH (UNITED STATES) º Hostname : djnet.dnip.net º Partitioning : HDD - 100% = / - 10%, swap - 1GB, /BOOT – 30%, /VAR – the rest of the HDD º The Network : Edit /etc/network/interfaces, adjust it. IPADDR, NETMASK, NETWORK, BROADCAST, GATEWAY º Hosts : Edit /etc/hosts -> add new IPADDR º Update & Upgrade : Edit /etc/apt/sources.list -> add recent archive site Do #apt-get update & #apt-get upgrade º Install SSH & ETC library (cpp, lib, tool etc,,) Network Engineer Training Laboratory BEGIN,, p. 5 ◎ PC #1 º DNS server : Install bind9 & bind9 config logging deamon & restart º WEB server : Install apache2 º FTP server : Install vsftpd º TELNET server : Install telnetd ◎ PC #2 º DATABASE server : Install My-SQL º BACKUP server * About hacking intercepts the outside IPADDR because of defense. PC #1PC #2

DNS server config ◎ Domain name system - Converts IPADDR with Domain Name and the system which provides routing system Network Engineer Training Laboratory SERVER,, p. 6 ◎ DNS config - Edit /etc/bind/named.conf, adjust it. & make file /etc/bind/dj-djnet /etc/bind/named.conf/etc/bind/db-djnet

DNS server config ◎ DNS server application - When there is not DNS and the Internet is not connected. Network Engineer Training Laboratory SERVER,, p. 7 ◎ DNS Install & configure

TELNET server config ◎ Teletype-network - Network protocol used on the Internet or LAN connections Network Engineer Training Laboratory SERVER,, p. 8 ◎ TELNET server application -Connected telnet server Ls command Execution (LS is DOS’s dir command) ◎ TELNET config ▷ Make /etc/xinetd.conf, adjust it.

FTP server config ◎ File Transfer Protocol - The network leads and sends a file and receives the protocol Network Engineer Training Laboratory SERVER,, p. 9 ◎ FTP server application Connected FTP server Help command and LS command executions ◎ FTP config ▷ Edit /etc/vsftpd.conf, adjust permission and port REMOVE # >> listen=YES, local_enable=YES, write_enable=YES ADD # >> anonymous_enable=YES

DB server config ◎ Data-Base server - Server for database input-output control Network Engineer Training Laboratory SERVER,, p. 10 ◎ MYSQL config ▷ Edit /etc/mysql/my.cnf, adjust it. REMOVE # >> bind-address = ▷ Executes mysql, add user and grant privileges. sql> GRANT ALL PRIVILEGES ON net(DBNAME).* TO IDENTIFIED BY ‘password'; ◎ DB server application Connected DB server Login root Show databases command and use mysql execution

WEB server config ◎ Web server - Program for web service Network Engineer Training Laboratory SERVER,, p. 11 ◎ Httpd config ▷ Edit /etc/apache2/apache2.conf, adjust it. ADD DirectoryIndex line >> index.php, index.php3, index.html ADD line >> AddDefaultCharSet EUC-KR If user want private folder then remove #

Simple WEB server page ◎ Web server is runningHTTP://djnet.dnip.net Network Engineer Training Laboratory EXAM SERVER,, p. 12 ◎ Server information ▷ The homepage is located in /var/www/ ▷ APM system was applied (apache + php + mysql) ▷ Unlimited traffic SAMPLE PAGE

DB server use for PHP ◎ Sample guestbook made by PHP ▷ is runningHTTP://djnet.dnip.net/guest Network Engineer Training Laboratory EXAM SERVER,, p. 13

Soft security ◎ Console approach control (/etc/lilo.conf << add password ) Network Engineer Training Laboratory SECURITY,, p. 14 ◎ Remove useless daemon ◎ TELNET use prohibition -> SSH (secure shell) ◎ Permission set -> #chmod –R 711 ◎ Connection limitation Edit /etc/hosts.deny/ << in.telnetd:ALL Edit /etc/hosts.allow/ << in.telnetd:IPADDR

Hard security ◎ Port interceptions - firewallstarter (UBUNTU Linux don’t need it) - EDIT /etc/services  port list file, Network Engineer Training Laboratory SECURITY,, p. 15 ◎ DNS security - EDIT /etc/bind/named.conf.options << << allow-transfer { none; }; ◎ IPCHAINS (iptable) - #ipchains –A input –s 0/0 ! www –p tcp –j DENY ※ Command toward server with packet mode, ipchain packet filtering Processing resulting output Checksum Sanity Input Chain DeMasquerade Routing Decision Local Output Chain Forward Chain Forward Chain Filtering of Packet

DB-server IPADDR Web-server Group ID BACKUP SYSTEM Network Engineer Training Laboratory BACKUP,, p. 16 ◎ PC #1 Web-server º Make shell script for webpage backup >> make file /root/backup.sh ◎ For auto backup system used tar, rsync and crontab º Add crontab schedule >> * * * /root/backup.sh º Configure rsync >> make file /etc/rsyncd.conf º Make file /etc/xinetd.d/rsync ◎ Every day 06:00 execute auto backup for Web-server’s webpages ◎ PC#1 backup system finished

HDB#2 증가백업 HDB#1 증가백업 HDB#2 증가백업 HDB#1 증가백업 HDB#2 증가백업 HDB#1 증가백업 일 월 화 수 목 금 HDB#2 증가백업 HDB#1 증가백업 HDB#2 증가백업 HDB#1 증가백업 HDB#2 증가백업 HDB#1 증가백업 금목 수 화 월 일 HDB#1 완전백업 HDB#2 완전백업 토토 매체백업매체백업 매체백업매체백업 Information HDA, HDB BACKUP SYSTEM Network Engineer Training Laboratory BACKUP,, p. 17 ◎ PC #2 config for two-week cycle backup at #hdb º Partition hdb -> hdb1, hdb2 ▷ Time plan and synopsis ▷ Edit crontab schedule and make shell script file ▷ Make shell script file >> /root/backup.sh º Rsync –avz :backup/ /backup ◎ PC#2 backup system finished

FINISH Network Engineer Training Laboratory FIN,, p. 18 WORK STATION in N.E.T lab. ▷ Necessity of server ▷ Prospect of server.. I knew if I stayed around l ong enough, something lik e this would happen (George Bernard Shaw)