Difference between revisions of "NetStat Setup Process"

Revision as of 22:06, 5 April 2009

This page summarizes how the virtual machine netstat was set up in Spring 2009.

Install

Installed CentOS 5.2 x64.
- Partition Scheme
  - 15 GB /
  - 3.9 GB /var
  - 1024 MB swap

Configuration

Updated VM

Added RPMForge Yum Repository
- rpm -Uhv http://apt.sw.be/redhat/el5/en/x86_64/rpmforge/RPMS//rpmforge-release-0.3.6-1.el5.rf.x86_64.rpm
  - From Dag Wieers

yum install yum-fastestmirror vim-enhanced gcc
yum update

Created User

Created user mccarrms
- /usr/sbin/useradd -m mccarrms
Set password for mccarrms
- passwd mccarrms

Configured Sudo

/usr/sbin/visudo

## Sudoers allows particular users to run various commands as
## the root user, without needing the root password.

#User_Alias ADMINS =

## Networking
Cmnd_Alias NETWORKING = /sbin/route, /sbin/ifconfig, /bin/ping, /sbin/dhclient, /usr/bin/net, /sbin/iptables, /usr/bin/rfcomm, /usr/bin/wvdial, /sbin/iwconfig, /sbin/mii-tool

## Installation and management of software
Cmnd_Alias SOFTWARE = /bin/rpm, /usr/bin/up2date, /usr/bin/yum

## Services
Cmnd_Alias SERVICES = /sbin/service, /sbin/chkconfig

## Updating the locate database
Cmnd_Alias LOCATE = /usr/sbin/updatedb

## Storage
Cmnd_Alias STORAGE = /sbin/fdisk, /sbin/sfdisk, /sbin/parted, /sbin/partprobe, /bin/mount, /bin/umount

## Delegating permissions
Cmnd_Alias DELEGATING = /usr/sbin/visudo, /bin/chown, /bin/chmod, /bin/chgrp

## Processes
Cmnd_Alias PROCESSES = /bin/nice, /bin/kill, /usr/bin/kill, /usr/bin/killall

## Drivers
Cmnd_Alias DRIVERS = /sbin/modprobe

## Shells
Cmnd_Alias SHELLS = /bin/sh, /bin/bash, /usr/bin/rsh, /bin/dash, /bin/rbash, /bin/su

## Users
Cmnd_Alias USERS = /usr/sbin/useradd, /usr/sbin/userdel, /usr/sbin/userhelper, /usr/sbin/usermod, /usr/sbin/usernetctl

Defaults    requiretty

Defaults    env_reset,tty_tickets,lecture=always,logfile=/var/log/sudo.log
Defaults    env_keep = "COLORS DISPLAY HOSTNAME HISTSIZE INPUTRC KDEDIR \
                        LS_COLORS MAIL PS1 PS2 QTDIR USERNAME \
                        LANG LC_ADDRESS LC_CTYPE LC_COLLATE LC_IDENTIFICATION \
                        LC_MEASUREMENT LC_MESSAGES LC_MONETARY LC_NAME LC_NUMERIC \
                        LC_PAPER LC_TELEPHONE LC_TIME LC_ALL LANGUAGE LINGUAS \
                        _XKB_CHARSET XAUTHORITY"

## Allow root to run any commands anywhere
root    ALL=(ALL)       ALL
%wheel  ALL=(ALL)       ALL
#ADMINS ALL=(root) ALL, !SHELLS, !USERS, !DELEGATING

Configured Networks

Configured hostname in /etc/sysconfig/network

NETWORKING=yes
NETWORKING_IPV6=no
HOSTNAME=netstat.cslabs.clarkson.edu

Verified eth0 configuration for Clarkson Network in /etc/sysconfig/network-scripts/ifcfg-eth0

DEVICE=eth0
BOOTPROTO=none
BROADCAST=128.153.145.255
HWADDR=00:16:3E:1B:DA:CA
IPADDR=128.153.145.16
NETMASK=255.255.255.0
NETWORK=128.153.145.0
ONBOOT=yes
GATEWAY=128.153.145.1
TYPE=Ethernet

Verified eth1 configuration for the Server Room Network in /etc/sysconfig/network-scripts/ifcfg-eth1

# Xen Virtual Ethernet
DEVICE=eth1
BOOTPROTO=none
BROADCAST=10.0.1.255
HWADDR=00:16:3E:70:AA:10
IPADDR=10.0.1.55
NETMASK=255.255.255.0
NETWORK=10.0.1.0
ONBOOT=yes
TYPE=Ethernet

Verified eth2 configuration for the Internal Network in /etc/sysconfig/network-scripts/ifcfg-eth2

# Xen Virtual Ethernet
DEVICE=eth2
BOOTPROTO=none
BROADCAST=10.0.0.255
HWADDR=00:16:3E:78:CF:CD
IPADDR=10.0.0.21
NETMASK=255.255.255.0
NETWORK=10.0.0.0
ONBOOT=yes
TYPE=Ethernet

Configured Hosts

Edited /etc/hosts

127.0.0.1       localhost.localdomain   localhost
::1     localhost6.localdomain6 localhost6
128.153.145.16  netstat.cslabs.clarkson.edu netstat.cslabs netstat
10.0.1.55       netstat.sr.cslabs.clarkson.edu netstat.sr.cslabs netstat.sr
10.0.0.21       netstat.int.cslabs.clarkson.edu netstat.int.cslabs netstat.int

Configured DNS Servers

Edited /etc/resolv.conf

search cslabs.clarkson.edu
nameserver 128.153.145.2
nameserver 128.153.0.254
nameserver 128.153.5.254

Configured IPtables

Edited /etc/sysconfig/iptables

Due to the sensitivity of this material, this config file has been left off; however, the following rules are needed.

-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 443 -j ACCEPT

Configured SSH

Edited /etc/ssh/sshd_config

Due to the sensitivity of this material, this config file has been left off.

Restarted sshd
- /etc/init.d/sshd restart

Set Up SSH Login Banner

Edited /etc/issue.net

            __      __       __ 
  ___  ___ / /____ / /____ _/ /_
 / _ \/ -_) __(_-</ __/ _ `/ __/
/_//_/\__/\__/___/\__/\_,_/\__/

Configured Password Requirements

Edited /etc/login.defs

MAIL_DIR        /var/spool/mail

PASS_MAX_DAYS   360
PASS_MIN_DAYS   0
PASS_MIN_LEN    8
PASS_WARN_AGE   60

UID_MIN                   500
UID_MAX                 60000

GID_MIN                   500
GID_MAX                 60000

CREATE_HOME     yes

UMASK           077

USERGROUPS_ENAB yes

MD5_CRYPT_ENAB yes

ENCRYPT_METHOD MD5

Added Custom PATH Variables

Added the following to /etc/profile

PATH=$PATH:/usr/sbin:/sbin
export PATH

Modified Root's Crontab

crontab -e

# Used to update locate database
0 * * * * /usr/bin/updatedb

Installed Nagios

To install a bare installation of Nagios, see Install Nagios on CentOS 5.

Installed & Configured Prerequisites

Installed Apache & SSL
- yum install httpd mod_ssl openssl-devel net-snmp net-snmp-libs net-snmp-perl net-snmp-perl net-snmp-utils net-snmp-devel

Removed unneeded config files
- rm /etc/httpd/conf.d/proxy_ajp.conf /etc/httpd/conf.d/welcome.conf

Modified Apache Config /etc/httpd/conf/httpd.conf

ServerTokens Prod
ServerRoot "/etc/httpd"
PidFile run/httpd.pid
Timeout 120
KeepAlive Off
MaxKeepAliveRequests 100
KeepAliveTimeout 15

<IfModule prefork.c>
StartServers       8
MinSpareServers    5
MaxSpareServers   20
ServerLimit      256
MaxClients       256
MaxRequestsPerChild  4000
</IfModule>

<IfModule worker.c>
StartServers         2
MaxClients         150
MinSpareThreads     25
MaxSpareThreads     75
ThreadsPerChild     25
MaxRequestsPerChild  0
</IfModule>

Listen 80

LoadModule auth_basic_module modules/mod_auth_basic.so
LoadModule auth_digest_module modules/mod_auth_digest.so
LoadModule authn_file_module modules/mod_authn_file.so
LoadModule authn_alias_module modules/mod_authn_alias.so
LoadModule authn_anon_module modules/mod_authn_anon.so
LoadModule authn_dbm_module modules/mod_authn_dbm.so
LoadModule authn_default_module modules/mod_authn_default.so
LoadModule authz_host_module modules/mod_authz_host.so
LoadModule authz_user_module modules/mod_authz_user.so
LoadModule authz_owner_module modules/mod_authz_owner.so
LoadModule authz_groupfile_module modules/mod_authz_groupfile.so
LoadModule authz_dbm_module modules/mod_authz_dbm.so
LoadModule authz_default_module modules/mod_authz_default.so
LoadModule ldap_module modules/mod_ldap.so
LoadModule authnz_ldap_module modules/mod_authnz_ldap.so
LoadModule include_module modules/mod_include.so
LoadModule log_config_module modules/mod_log_config.so
LoadModule logio_module modules/mod_logio.so
LoadModule env_module modules/mod_env.so
LoadModule ext_filter_module modules/mod_ext_filter.so
LoadModule mime_magic_module modules/mod_mime_magic.so
LoadModule expires_module modules/mod_expires.so
LoadModule deflate_module modules/mod_deflate.so
LoadModule headers_module modules/mod_headers.so
LoadModule usertrack_module modules/mod_usertrack.so
LoadModule setenvif_module modules/mod_setenvif.so
LoadModule mime_module modules/mod_mime.so
LoadModule dav_module modules/mod_dav.so
LoadModule status_module modules/mod_status.so
LoadModule autoindex_module modules/mod_autoindex.so
LoadModule info_module modules/mod_info.so
LoadModule dav_fs_module modules/mod_dav_fs.so
LoadModule vhost_alias_module modules/mod_vhost_alias.so
LoadModule negotiation_module modules/mod_negotiation.so
LoadModule dir_module modules/mod_dir.so
LoadModule actions_module modules/mod_actions.so
LoadModule speling_module modules/mod_speling.so
LoadModule userdir_module modules/mod_userdir.so
LoadModule alias_module modules/mod_alias.so
LoadModule rewrite_module modules/mod_rewrite.so
LoadModule proxy_module modules/mod_proxy.so
LoadModule proxy_balancer_module modules/mod_proxy_balancer.so
LoadModule proxy_ftp_module modules/mod_proxy_ftp.so
LoadModule proxy_http_module modules/mod_proxy_http.so
LoadModule proxy_connect_module modules/mod_proxy_connect.so
LoadModule cache_module modules/mod_cache.so
LoadModule suexec_module modules/mod_suexec.so
LoadModule disk_cache_module modules/mod_disk_cache.so
LoadModule file_cache_module modules/mod_file_cache.so
LoadModule mem_cache_module modules/mod_mem_cache.so
LoadModule cgi_module modules/mod_cgi.so
LoadModule version_module modules/mod_version.so

Include conf.d/*.conf

User apache
Group apache

ServerAdmin mccarrms@gmail.com

UseCanonicalName Off

DocumentRoot "/var/www/html"

<Directory />
    Options FollowSymLinks
    AllowOverride None
</Directory>

<Directory "/var/www/html">
    Options Indexes FollowSymLinks
    AllowOverride None
    Order allow,deny
    Allow from all
</Directory>

<IfModule mod_userdir.c>
    UserDir disable
</IfModule>

DirectoryIndex index.html index.html.var index.php

AccessFileName .htaccess

<Files ~ "^\.ht">
    Order allow,deny
    Deny from all
</Files>

TypesConfig /etc/mime.types

DefaultType text/plain

<IfModule mod_mime_magic.c>
#   MIMEMagicFile /usr/share/magic.mime
    MIMEMagicFile conf/magic
</IfModule>

HostnameLookups Off

ErrorLog logs/error_log
LogLevel warn

LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined
LogFormat "%h %l %u %t \"%r\" %>s %b" common
LogFormat "%{Referer}i -> %U" referer
LogFormat "%{User-agent}i" agent

CustomLog logs/access_log combined

ServerSignature On

Alias /icons/ "/var/www/icons/"

<Directory "/var/www/icons">
    Options Indexes MultiViews
    AllowOverride None
    Order allow,deny
    Allow from all
</Directory>

<IfModule mod_dav_fs.c>
    DAVLockDB /var/lib/dav/lockdb
</IfModule>

ScriptAlias /cgi-bin/ "/var/www/cgi-bin/"

<Directory "/var/www/cgi-bin">
    AllowOverride None
    Options None
    Order allow,deny
    Allow from all
</Directory>

IndexOptions FancyIndexing VersionSort NameWidth=* HTMLTable

AddIconByEncoding (CMP,/icons/compressed.gif) x-compress x-gzip

AddIconByType (TXT,/icons/text.gif) text/*
AddIconByType (IMG,/icons/image2.gif) image/*
AddIconByType (SND,/icons/sound2.gif) audio/*
AddIconByType (VID,/icons/movie.gif) video/*

AddIcon /icons/binary.gif .bin .exe
AddIcon /icons/binhex.gif .hqx
AddIcon /icons/tar.gif .tar
AddIcon /icons/world2.gif .wrl .wrl.gz .vrml .vrm .iv
AddIcon /icons/compressed.gif .Z .z .tgz .gz .zip
AddIcon /icons/a.gif .ps .ai .eps
AddIcon /icons/layout.gif .html .shtml .htm .pdf
AddIcon /icons/text.gif .txt
AddIcon /icons/c.gif .c
AddIcon /icons/p.gif .pl .py
AddIcon /icons/f.gif .for
AddIcon /icons/dvi.gif .dvi
AddIcon /icons/uuencoded.gif .uu
AddIcon /icons/script.gif .conf .sh .shar .csh .ksh .tcl
AddIcon /icons/tex.gif .tex
AddIcon /icons/bomb.gif core

AddIcon /icons/back.gif ..
AddIcon /icons/hand.right.gif README
AddIcon /icons/folder.gif ^^DIRECTORY^^
AddIcon /icons/blank.gif ^^BLANKICON^^

DefaultIcon /icons/unknown.gif

ReadmeName README.html
HeaderName HEADER.html

IndexIgnore .??* *~ *# HEADER* README* RCS CVS *,v *,t

AddLanguage ca .ca
AddLanguage cs .cz .cs
AddLanguage da .dk
AddLanguage de .de
AddLanguage el .el
AddLanguage en .en
AddLanguage eo .eo
AddLanguage es .es
AddLanguage et .et
AddLanguage fr .fr
AddLanguage he .he
AddLanguage hr .hr
AddLanguage it .it
AddLanguage ja .ja
AddLanguage ko .ko
AddLanguage ltz .ltz
AddLanguage nl .nl
AddLanguage nn .nn
AddLanguage no .no
AddLanguage pl .po
AddLanguage pt .pt
AddLanguage pt-BR .pt-br
AddLanguage ru .ru
AddLanguage sv .sv
AddLanguage zh-CN .zh-cn
AddLanguage zh-TW .zh-tw

LanguagePriority en ca cs da de el eo es et fr he hr it ja ko ltz nl nn no pl pt pt-BR ru sv zh-CN zh-TW

ForceLanguagePriority Prefer Fallback

AddDefaultCharset UTF-8

AddType application/x-compress .Z
AddType application/x-gzip .gz .tgz

AddHandler type-map var

AddType text/html .shtml
AddOutputFilter INCLUDES .shtml

Alias /error/ "/var/www/error/"

<IfModule mod_negotiation.c>
<IfModule mod_include.c>
    <Directory "/var/www/error">
        AllowOverride None
        Options IncludesNoExec
        AddOutputFilter Includes html
        AddHandler type-map var
        Order allow,deny
        Allow from all
        LanguagePriority en es de fr
        ForceLanguagePriority Prefer Fallback
    </Directory>
</IfModule>
</IfModule>

ErrorDocument 404 /error/404.html

BrowserMatch "Mozilla/2" nokeepalive
BrowserMatch "MSIE 4\.0b2;" nokeepalive downgrade-1.0 force-response-1.0
BrowserMatch "RealPlayer 4\.0" force-response-1.0
BrowserMatch "Java/1\.0" force-response-1.0
BrowserMatch "JDK/1\.0" force-response-1.0
BrowserMatch "Microsoft Data Access Internet Publishing Provider" redirect-carefully
BrowserMatch "MS FrontPage" redirect-carefully
BrowserMatch "^WebDrive" redirect-carefully
BrowserMatch "^WebDAVFS/1.[0123]" redirect-carefully
BrowserMatch "^gnome-vfs/1.0" redirect-carefully
BrowserMatch "^XML Spy" redirect-carefully
BrowserMatch "^Dreamweaver-WebDAV-SCM1" redirect-carefully

Configured Apache to start on boot
- /sbin/chkconfig --levels 35 httpd on

Installed & Configured Nagios

Install Nagios & Plugins
- yum install nagios nagios-plugins nagios-plugins-setuid

Customized the default Nagios Apache conf /etc/httpd/conf.d/nagios.conf

ScriptAlias /nagios/cgi-bin "/usr/lib64/nagios/cgi"

<Directory "/usr/lib64/nagios/cgi">
   SSLRequireSSL
   Options ExecCGI
   AllowOverride None
   Order allow,deny
   Allow from all
   AuthName "CS Labs Nagios Access"
   AuthType Basic
   AuthUserFile /etc/nagios/htpasswd.users
   Require valid-user
</Directory>

Alias /nagios "/usr/share/nagios"

<Directory "/usr/share/nagios">
   SSLRequireSSL
   Options None
   AllowOverride None
   Order allow,deny
   Allow from all
   AuthName "CS Labs Nagios Access"
   AuthType Basic
   AuthUserFile /etc/nagios/htpasswd.users
   Require valid-user
</Directory>

Removed the last line of /etc/httpd/conf/httpd.conf

# Include /etc/httpd/conf.d/nagios.conf

Put previous Nagios config files from former installation in /etc/nagios/

Customized /etc/nagios/nagios.cfg, /etc/nagios/cgi.cfg, & /etc/nagios/resource.cfg to use the correct config files and locations

Configured sshd to disallow ssh as the nagios user by adding the adding the following to /etc/ssh/sshd_config
- DenyUsers nagios
- /etc/init.d/sshd restart

Installed NRPE Plugin

Downloaded nrpe
- wget http://internap.dl.sourceforge.net/sourceforge/nagios/nrpe-2.12.tar.gz

Extracted nrpe
- tar xzf nrpe-2.12.tar.gz

Compiled & Installed Plugin
- cd nrpe-2.12
- ./configure
- make all
- make install-plugin
- mv /usr/local/nagios/libexec/check_nrpe /usr/lib64/nagios/plugins/
- rm -r /usr/local/nagios

Started Nagios
- /etc/init.d/nagios start

Started Apache
- /etc/init.d/httpd start

Installed AWStats

To install a bare installation of AWStats, see Install AWStats on CentOS 5.

Installed & Configured AWStats

Installed AWStats
- yum install awstats

Modified AWStats Apache Configuration
- Edited /etc/httpd/conf.d/awstats.conf

Alias /webstats /var/www/awstats/webstats/
Alias /awstats/icon /var/www/awstats/icon/
Alias /awstats/docs /usr/share/doc/awstats-6.9/
ScriptAlias /awstats /var/www/awstats/

<Directory /var/www/awstats/>
  SSLRequireSSL
  Options ExecCGI
  Order allow,deny
  Allow from all
  AuthName "CS Labs AWStats Access"
  AuthType Basic
  AuthUserFile /etc/nagios/htpasswd.users
  Require valid-user
</Directory>

<Directory /var/www/awstats/webstats/>
  SSLRequireSSL
  Order allow,deny
  Allow from all
  AuthName "CS Labs AWStats Access"
  AuthType Basic
  AuthUserFile /etc/nagios/htpasswd.users
  Require valid-user
</Directory>

<Directory /usr/local/awstats/docs/>
  SSLRequireSSL
  Options None
  AllowOverride None
  Order allow,deny
  Allow from all
  AuthName "CS Labs AWStats Access"
  AuthType Basic
  AuthUserFile /etc/nagios/htpasswd.users
  Require valid-user
</Directory>

Removed default update script
- rm /etc/cron.hourly/00awstats

Created new update script /root/scripts/awstats_update.sh

#!/bin/bash

/usr/bin/awstats_updateall.pl now -confdir="/etc" -awstatsprog="/var/www/awstats/awstats.pl" >/dev/null

Added script to crontab
- crontab -e

#Used to update AWStats
0 * * * * /root/scripts/awstats_update.sh

Moved over logs, configuration files, etc. from previous installation
Modified .conf files in /etc/awstats/ to use the correct config files and locations

Updated Statistics
- /usr/bin/awstats_updateall.pl now -confdir="/etc" -awstatsprog="/var/www/awstats/awstats.pl"

Restarted Apache
- /etc/init.d/httpd restart

@@ Line 128: / Line 128: @@
 </pre></code>
-===Configured Hosts===
+====Configured Hosts====
 *Edited <code>/etc/hosts</code>
 <code><pre>

Difference between revisions of "NetStat Setup Process"

Revision as of 22:06, 5 April 2009

Contents

Install

Configuration

Updated VM

Created User

Configured Sudo

Configured Networks

Configured Hosts

Configured DNS Servers

Configured IPtables

Configured SSH

Set Up SSH Login Banner

Configured Password Requirements

Added Custom PATH Variables

Modified Root's Crontab

Installed Nagios

Installed & Configured Prerequisites

Installed & Configured Nagios

Installed NRPE Plugin

Installed AWStats

Installed & Configured AWStats

Navigation menu

Views

Personal tools

Navigation

Search

Tools