CHAPTER 3 Advanced SUSE LINUX Enterprise Server 9 The 30 exercises that follow allow you to test your knowledge with SUSE LINUX Enterprise Server 9 at an advanced level. As with those that preceded, the vast majority of these exercises can be done from the console, but you might find it helpful to have at least one client connected to the server. Once again, the ideal client for most purposes is the Novell Linux Desktop. Step-by-step solutions to these exercises appear in Chapter 4, Solutions to Exercises. Table 3.1 lists the objectives and prerequisites from the courses used to prepare for the Novell CLE (Certified Linux Engineer) 9 that this section covers and which exercise each of those tasks can be found in. Where possible, every objective that could have an exercise associated with it is represented here at least once. NOTE The two Novell courses that are recommended for CLE 9 study, and from which these objectives are derived, are numbers 3057 (SUSE LINUX Network Services), and 3058 (SUSE LINUX Security).
TABLE 3.1 Objectives Within This Section OBJECTIVE EXERCISE Configuring a DHCP Server Exercises 48, 68 Configuring a DNS Server Exercises 49, 67 Configuring Email Services Exercise 50 Detecting Intruders Exercise 51 Implementing a Packet Filter Exercise 52 Implementing a Proxy Server with SQUID Exercise 53 Implementing a VPN Exercise 54 Implementing a Web Application Server with Tomcat Exercise 55 Implementing an Application-Level Gateway Exercise 56 Implementing General Security Practices Exercises 57, 73 Implementing Host Security Exercises 58, 71 Implementing Network Printing Using CUPS Exercise 59 Implementing Network Security Exercise 60 Implementing OpenSLP Exercise 61 Implementing Samba to Provide File and Print Services Exercise 62 Install SLES 9 Exercises 46, 72 Managing the SLES 9 System Configuration Exercises 47, 69, 70, 74, 75 Monitoring Traffic on Your Network Exercise 63 Relating General Firewall Concepts Exercise 64 Responding to Security Breaches Exercise 65 Securing Services with Cryptography Exercise 66 Using YaST Throughout 60
Exercise 46: Alabama Cement You are an administrator for a company that owns a number of independent concerns. One of those entities, Alabama Cement, has purchased an SLES 9 server, and you have been assigned to go to the site and install the operating system. Someone will be following after you to install the proprietary software the site needs in order to do its specialized tasks. Your assignment is merely to perform a normal installation of the operating system. 61
Exercise 47: Alaska Tours and Such You have been summoned to one of the satellite offices of the tour company Alaska Tours and Such. They suspect configuration problems with the network card on their server. You are to change the settings on the network card so that it no longer uses DHCP and now has a static IP address of 192.168.0.14 and subnet mask of 255.255.255.0. You also need to configure a default gateway of 192.168.0.1. After configuring the system, you need to test connectivity to the gateway and beyond. 62
Exercise 48: Arizona Aluminum Manufacturing You have been called to the server room at AAM and been given an assignment. The head of the lab wants you to turn on the DHCP service for the SLES server. You are to also enable LDAP support and use the following settings: Domain name: LabRoom Default Lease Time: 1 day, with a maximum allowed of 2 days IP address of this host: 192.168.0.14 IP address of default gateway: 192.168.0.1 IP address range: 192.168.0.15 192.168.0.99 When you complete the installation of the service, be sure to start it before you leave. NOTE You should start the service from the command line. 63
Exercise 49: Arkansas University Your pager goes off in the middle of the church service, and you hastily make a retreat to the narthex. There is a problem with DNS at the local university in the D S Technical lab. They want you to immediately configure an SLES 9 server to the following specifications: Zone name: dstechnical.com Name server: lab1.dstechnical.com TTL: 3 days Reverse lookup: Yes Configure the server as required. 64
Exercise 50: California Dreaming You have been summoned to the local office of the California Dreaming ice cream company. They are converting from a hosted environment to running their own servers. Your assignment for the day is to configure the Postfix service as an MTA for the california.com domain. 65
Exercise 51: Colorado Insurers As you arrive for work in the morning, you are met by a very anxious network administrator. He informs you that he suspects someone hacked into the server over the weekend. He has nothing to base this on other than hearsay from a couple of co-workers around the water cooler. Check the appropriate logs and identify anything that might indicate an intrusion. 66
Exercise 52: Connecticut Water You have been summoned to CW to configure a packet-filtering firewall. The manager tells you that iptables must be used because he read in a magazine that that is the best approach. While you are at it, he would also like NAT routing enabled on the server. NOTE As a part of this exercise, you should configure and test NAT as well as verify the packet-filtering configuration. An NLD workstation can be used to test this. When you take the actual Novell practicum, testing the configuration is helpful in proving that you know what should be done and have done it properly. 67
Exercise 53: Delaware Trucking The administrator for Delaware Trucking has just left the company. Until a replacement can be found, your company has been retained to help with administrative tasks. Today, you have been asked to configure and test the Squid HTTP proxy server on their SLES 9 system. 68
Exercise 54: Florida Reviewers Florida Reviewers has recently expanded from a single office to two offices. You have been hired to create a VPN connection between their two hosts (servers) using YaST and test it. 69
Exercise 55: Georgia Widgets The independent widget growers association has hired you to install and configure Tomcat on their SLES 9 server. After you have installed and configured it, you should test the setup as well. 70
Exercise 56: Hawaii PineTrees, Inc. You are a consultant for a small company doing security implementations and audits. Drawing the short stick from the daily assignment jar, you have been dispatched to HPI in order to implement an application-level gateway on the SLES 9 server. Make a list of the questions and concerns that should be asked when you reach the site, and then implement this per the customer s request. 71
Exercise 57: Idaho Rock Quarries You have been sent to IRQ to act as a consultant. After reading a number of horror stories in the paper, they are interested in making certain that they have security well in hand. They are running only a single SLES 9 server with a number of NLD workstations. You need to make a list of items they should consider in order to implement best practice host security at their site. 72
Exercise 58: Illinois Lotto You are the administrator for Illinois Lotto a small company that recommends lottery numbers to clients. Your supervisor has asked that you install the nmap, nmap-gtk, and snort packages on the SLES 9 server. 73
Exercise 59: Indiana Reptiles It has been a long week, and you cannot wait for it to end. It seems as if you have spent more time driving to customers sites all week than you have actually spent in their presence. You have now arrived at Indiana Reptiles. They have hired you to configure the cupsd daemon on their server to enable broadcasting and add a CUPS administrative user with the name cupsadmin. 74
Exercise 60: Iowa Retirement Homes A number of old hackers have begun to retire and move to Iowa. As a proactive measure, the head of the retirement community there has asked that you make a list of items they should consider in order to implement best practice network security at their site. 75
Exercise 61: Kansas Vets, Ltd. As part of a routine maintenance/administration package that your company offers, you have been assigned by Kansas Vets, Limited to double-check the OpenSLP configuration on their single SLES 9 server and verify that it is working properly. Make certain that it is locating the services that it should. 76
Exercise 62: Kentucky s D S Technical You are a consultant for a small IT firm. You have been hired to configure the Samba service as a PDC for the DSTECHNICAL domain. NOTE Use your NLD workstation to test that the workgroup/domain configuration works correctly and that you can log in to it. Satisfy the customer and configure the Samba service as a PDC for the DSTECHNICAL domain. 77
Exercise 63: Louisiana Fishing One of your clients, Louisiana Fishing, is worried that their network is receiving too much traffic, and responses for data are taking longer than they should. Although this is desirable in most businesses, Louisiana Fishing fears that they might not have the resources to keep up with an increase in their load. Monitor the traffic on the SLES 9 server and look for any indication that traffic might be too heavy; then make an appropriate recommendation based on your findings. 78
Exercise 64: Maine Asylums, LLC During a monthly meeting of the local Linux users group, an interesting situation presents itself. The administrators at Maine Asylums, LLC are interested in pursuing security options. At this point, they do not want to implement anything, but they want to know what their choices are. Make a list of general firewall concepts and include pros and cons as to why, and how, they should implement such on their network. 79
Exercise 65: Maryland Programming You own a small network consulting company on the East Coast. You have three employees each with his own specialty and can, thus, offer services for a number of different operating systems and platforms. The administrator for Maryland Programming, a cable news network, calls in a panic. He is certain that there has been a confirmed security breach on their SLES server. You must arrive on site and take appropriate measures to respond to this security breach. 80
Exercise 66: Massachusetts Spammers Due to the backlash and general hard feeling associated with spam, Massachusetts Spammers would like to implement cryptography to secure their services. They do not, however, want to pay you to perform this action. Rather, they want you to document the steps involved, and the cryptographic options available to them with SLES 9 and fax those to them. Prepare the documentation for the customer. 81
Exercise 67: Michigan Growers You are a consultant specializing in the networking and telecommunications fields. Many of your clients turn to you only after they have exhausted all internal resources and are stumped on how to proceed. You have been hired by MG to configure DNS to restrict all queries to hosts on your network segment. Hosts on your network segment should not be able to query DNS. 82
Exercise 68: Minnesota River Authority The Minnesota River Authority is responsible for educating the public about such issues as boat safety and fishing statutes. They are attempting to convert all of their practices to a standardized form after decades of being independently handled by individual branch offices and Department of Natural Resources officers. For MRA, configure the DHCP daemon on your SLES 9 server from exercise 48 to send dynamic updates to the DNS server (exercises 49 and 67). 83
Exercise 69: Mississippi Diabetes Group The Mississippi Diabetes Group has hired you on a project basis to write a simple shell script for them. The script should ask for the name of a file. When the user enters the name of the file, the script should verify that the file exists within the current directory and that it is readable. If the file does not exist, it should be created with a zero size so that another program can then run without error. Create this script, named MDG.sh, for the customer. 84
Exercise 70: Missouri Knife and Scissor You have recently finished a class on advanced Linux administration, and your boss is announcing to all customers that no request is now too big or too small. As you re explaining to him that this route of advertising might not lead to the most efficient use of your time, he hands you an assignment. The Missouri Knife and Scissor company has a number of shell routines that it needs to run on a regular basis: ABC: needs to run every Monday at 6:05 BCD: needs to run on the second day of each month at 15:10 CDE: needs to run on March 14th and September 15th at 18:30 DEF: needs to run every 10 minutes between 6:00 and 18:00 every day EFG: needs to run at 5 minutes past the hour on every hour between 12:00 and 16:00 on weekdays only Write down the cron file entries that MK&S needs to run these scripts at their appropriate times. 85
Exercise 71: Montana Expeditions You are the regional IT administrator for a company that owns and operates a number of smaller companies. All of the smaller companies act as selfcontained entities and have their own IT departments. You serve as a point of reference that any IT department can turn to should they encounter a task they are uncertain how to perform. Montana Expeditions has called you to its site. A new IT director has mandated a number of items he wants done to the SLES 9 server so that it matches his old environment. They would like the server to be changed such that the default permissions on all newly created files are rw-rw-r--/. They want the permissions on all files currently in the /tmp directory to be changed to 751. Last, they want the passwords from the /etc/shadow file put back in the /etc/passwd file. 86
Exercise 72: North Carolina Swimmers You are a field specialist assigned to manage a number of strategic accounts within a given geographic area. You have been instructed to treat all accounts with a great deal of finesse and make each of them feel as if they are the only account that your company services. NCS has summoned you to its headquarters. They have been using the KDE interface on their SLES server since it was installed. A new administrator has been hired to replace the old one, however, and he is only familiar with GNOME. You are to install the GNOME desktop on the server and make it available for the administrator when he logs in to the server. 87
Exercise 73: North Dakota Plastics After finishing several years of undergraduate and graduate studies in information technology, you have recently been hired by North Dakota Plastics. You are astounded at how simplistic their operations are and troubled by some of what you have found. North Dakota Plastics currently has only one SLES 9 server. They leave the console running in a room that has a great deal of traffic. Because of this, they would like you to configure the desktop to go to a screensaver after three minutes of no activity, and require a password to be unlocked. 88
Exercise 74: Nebraska Genealogy You are an administrator for Nebraska Genealogy, a company that specializes in tracking family histories. Your company has recently migrated from the Unix platform and is heavily dependent upon the use of proprietary shell scripts to perform routine operations. You have been assigned the task of creating a simple menu interface that will offer four choices ABC, BCD, CDE, and DEF. The user should be able to pick a number between 1 and 4 to run one of those, or 5 to quit. Write the script to create this menu. 89
Exercise 75: Nevada Design You are a programmer/administrator who has been assigned to Nevada Design on a short term, temporary basis. Nevada Design has a number of small jobs that they want you to do, as well as one simple request. They would like a short shell script that will tell them how many users are listed in the /etc/passwd file on their server. They intend to run this on a regular basis to see if accounts get added and draw attention to them when they do. Write as short a script as possible to accomplish this task for the customer. 90