Linux security: step by step fortification (3)

Author: dingwei NFS services for network file system is Unix file sharing access to the world.

If you want to prevent users from any of the shared directory, you can increase the limits, such as NFS locking/etc/exports file and define the shared directories. If you do not want users to share, just restrict user access, you need to modify NFS startup script. Edit the file, locate the/etc/init.d/nfs daemon line is commented out. /Etc/init.d/ns # daemonrpc.nfsd $ RPCNFSDCOUNT system many of the configuration file and the command is very sensitive, modify permissions, and to increase the read-only property to some degree to avoid security problems. Chmod700/bin/rpm # NFS shared directory profile chmod600/etc/exports # host access control file chmod600/etc/hosts. * chmodR751/var/log chmod644/var/log/messages # syslog configuration file chmod640/etc/syslog.con chmod660/var/log/wtmp chmod640/var/log/lastlog chmod600/etc/ftpusers # user password file chmod644/etc/passwd chmod600/etc/modules # validate sadow profile directory chmodR750/etc/pam.d chmod600/etc/lilo.con # Terminal profile chmod600/etc/securetty chmod400/etc/shutdown.allow # system access security profile chmod700/etc/security # network system profile chmodR751/etc/sysconig # Super daemon configuration file chmod600/etc/xinetd.con chmod600/etc/inetd.con chmodR750/etc/rc.d/init.d/chmod750/etc/rc.d/init.d/* # autorun program control file chmod600/etc/crontab chmod400/etc/cron. * # SSH configuration file chmod750/etc/ss # kernel control profile chmod400/etc/sysctl.cong chattr + I/etc/services chattr + I/etc/group chattr + I/etc/gsadow chattr + I/etc/hosts. * chattr + I/etc/xinetd.con chattr + I/etc/exports chattr + I/bin/login chattr + a/var/log/message concerns the log first to use the log server. The client saves a copy of the log information is a good idea to create a server dedicated to store log files, you can check the log to discover the problem. Modify/etc/sysconfig/syslog file to accept remote logging. /Etc/sysconfig/syslog SYSLOGD_OPTIONS = "-mr0" should also be set to save the log remote. Modify the/etc/syslog.conf file join log settings of the server, syslog will save a copy in the log on the server. /Etc/syslog.con *. * & nbsp @ log_server_IP you can use color log filters. Color filter log, version loco is 0.32. Use the loco/var/log/messages | more reveals the colour of the log, clear marking out the root location and log exceptions. This reduces the analysis log people missing. Also for regular inspection of the log. RedHatLinux logwatch tools provided in the regular automatic checks log and send a message to the administrator mailbox. Need to modify/etc/log.d/conf/logwatch.conf file, MailTo = root parameter after the increase in the Administrator's e-mail address. Logwatch will periodically check the logs, filtering for use root, sudo, telnet, FTP login and other information to help administrators analyze day-to-day security. Check the suid and sgid machine has. With the suid and sgid files have considerable risk. Simply put is a normal user can use these command with superuser permissions, users go directly to the super user environment. Many commands require suid and sgid. In System Setup is found on these commands, as well as a standard to compare the problem machine can identify security issues. In addition to the suid and sgid, if you find some that do not belong to any user or security loopholes. The following command can be above the file list is saved to a file, the backup these files, later used to facilitate comparison. find/-xdev-typef-perm+600> 02 >/dev/null/root/backup/audit/suid.log find/-xdev-nouser-o-nogroup >/dev/null >/root/backup/audit/nouser.log find/-xdev-typef-perm-2 >/dev/null >/root/backup/audit/other.log use SS when administrators remotely manage the client, in addition to the Webmin convenient management via browser, command line use more quickly. While the telnet is clear, in order to prevent sniffer capture sensitive information, use the SSH is the best choice. SSH on the first connection in the communication between the two machines generate key, then the communication is transmitted via encrypted way, sniffer will not be able to effectively analyze the information. If you are using Linux SSH command will directly connect to other host, if you are connecting from Windows, you will need the support of the software, it is recommended to use PuTTY, you can download from http://www.chiark.greenend.org.uk/~sgtatham/putty/, current version is 0.52. SSH uses TCP port 22. Note do not use any of the r process, such as rlogin, rcp, etc. Use more secure FTP file transfer unless you need to transfer large amounts of files, or you can use SCP instead. With SSH, SCP is key to create an encrypted channel. In Windows, you can download from http://winscp.vse.cz/WinSCP, current version 2.0.0 (Build89). But if you need to transfer large files, the SCP will cause the processor to handle the encryption, consume too many resources, you can use proftp instead. RedHatLinux default use Wuftp services from http://www.proftpd.org/, the current version 1.2.4. Use the system snapshot system snapshot is to use the system file format database to discover system changes on a regular basis. Recommend the use of tripwire, current version is 2.3.1-10. Note that tripwire's configuration file is very comprehensive, but not necessarily suitable for your system, so you need to customize twpol.txt file. Customize the principle is the first installation of the complete system, then install tripwire, use the default configuration file making system snapshot. The error message when you are prompted to do so, use # shield off extra configuration information, and then rebuild the database. Rpmivhtripwire-2.3.1-10.i386.rpm # modify twpol.txt file masking off system file does not exist, then start installing/etc/tripwire/twinstall.s # installation will be asked to enter the password generated key and update the database password # note the replication key actions, or else be initialized in the prompt file does not exist error cp/etc/tripwire/$ HOSTNAME-local.key/etc/tripwire/localhost-local.key # initialize tripwire, generate database, which will require you to enter key tripwire--init # through system snapshots determine system changes, and sends messages to the specified user tripwire--check-M use host-based intrusion detection IDS can help administrators found the attempt to break security. In the enterprise host-based intrusion prevention is based on the network is more important, after all, enterprise network is behind a firewall. It is recommended that you use the snare, currently supported version RedHatLinux7.2 0.9-1, you can download the http://www.intersectalliance.com. Which is the core of snare-core daemon. Snare is the graphical interface of the program. After installation has named audit daemon. Snare concern is to root operation or modify the file permissions, and access sensitive data in the log. Through the configuration file to define a suitable system of intrusion detection log system. The default installation has provided a complete configuration to meet the General requirements. Other security tools use Bastille tool Bastille is a set of security settings for script collection, in front of a lot of settings you can use to automatically complete the Bastille. For the first time after you install the Bastille, BastilleBackEnd you can use the previous set of configuration files. Configure/etc/Bastille/config file can complete security script customization. Bastille General configuration parameters such as not including firewalls. If you want, you can install when you are finished using the InteractiveBastille.pl interactive installation. Bastille will start the wizard window, select Yes or no as can be generated for your system's configuration files. Bastille configuration scenarios. Use Trojans Checker chkrootkit is through checkout system is important in order to determine whether or not to be replaced because it was based on the Trojans and backdoor tool, it is necessary to pay attention to regular updates. Use auto run programs using crontab can reduce administrator work intensity. For example, adding regular calibration, verification of tripwire, and send chkrootkit results to develop mail administrators. Draw attention: at least one dayChi-server, and use different types of Linux version or operating system; all desktops need to be inside the firewall, and the prohibition of the use of a modem connection to the Internet; at least an intrusion detection system, multiple sensors distributed in the network; at least two mutual backup system administrator; do not use the direct login root; do not use telnet remote login; any system changes need to be documented; after all, a very sub prevention is better than cure. More than just simple describes the Enterprise Linux secure basic settings. If even the basic settings are not reached, the security issues will be plagued by the system administrator. There are many more complex security settings have not been introduced, such as limiting the network interaction, restrict resources, etc. Since the introduction of desktop firewall, firewall, mail server, file and Web server security settings are not to be a description, but is by no means says security according to do so, you can rest easy. These are just getting started, is still far from enough. A lot of specific use cases and deeper concern Linux security configured welcomes the Exchange administrator. (Responsibility edit Sunny)

Linux JDK1.4 and the distinction between instance resolves JDK1.6

In Linux with jdk1.6 wrote a program to compile the package, all is well, get the win, the same is 1.6 JDK, actually said what is incompatible with the type of compilation, illegal magicnumber. in Linux using jdk1.4.2 this classic version of recompiling it, find the following two exceptions: 1. in 1.4.2, assert is a keyword, you can not assert (booleanexpression): (String) to use, but in 1.6.

Compile in 1.4.2, will give a warning: asofrelease1.4, assertisakeyword, andmaynotbeusedasanidentifier and it gives me errors that say is semicolon errors (in fact, the compiler to assert as an identifier to handle newspaper's fault). 2. in 1.4.2, not as such to overrideclone () method publicNewClassclone () {...returnNewClass;} This is allowed in 1.6, is convenient. Only in 1.4.2 publicObjectclone () {...return ...;} Then there are the N number of type cast.

Linux administrator's manual (5)--boot and shutdown

-This section explains when Linux system boot and shutdown what occurred, should any completed correctly without follow the correct procedure, the file may be corrupt or missing.

Boot and shutdown overview on your computer and cause the operating system is loaded by the process called boot .Thenamecomesfromanimageofthecomputerpullingitselfupfromitsbootstraps, buttheactitselfslightlymorerealistic. During startup, the computer first loads a small program called bootstraploader, which, in turn, load and start the operating system, bootstraploader is usually stored in your hard disk or a floppy disk in a fixed location this 2-step process of grounds is large and complex, the operating system and computer loads the first piece of code is very small (a few hundred bytes), so as not to unnecessarily complicate the firmware. Different computer bootstrap different computer for PC, (it's BIOS) reading the floppy disk or hard disk the first sector (called boot sector) .bootstraploader included in this sector is located on the disk to load it (and other) in other parts of the operating system. Linux loaded, its founding of hardware and device driver, and then start another process running init.init to allow users to log on and do other things. this part of the detail in the following discussion. In order to close a Linux system, first of all the processes are told to end (this allows them to close all files, complete the necessary other things that make them neatly end), and then unmount file systems and the swap area, the last print can turn off the power of information to the console if not followed the correct procedure, terrible things may happen. the most important, file system, buffer cache may not write back, which means that all data will be lost and disk file system is not complete, and may not be available. A closer look at the boot process can boot from the floppy or hard drive installed and start Linux. Guide to the installation section ([Wel]) to tell you how to install Linux, and the way you want to boot. When the PC boots, the BIOS to do some testing ensure that everything is normal, and then start the real boot it select a disk (usually the first floppy drive, if you have a floppy disk, otherwise it is the first hard disk, if you installed Word; sequence is settable)-and then read the first sector, this is called the boot sector; for hard drives, also called the master boot record, because the hard disk can contain multiple partitions, each partition has its own boot sector. Boot sector contains a small program (as small as you can into a sector), it is the responsibility of reading from disk and start a real operating systems of Linux from a floppy disk boot-time, boot sector contains code read-only before hundreds of data blocks (of course, depend on the core size) to a predetermined memory location .Linux boot floppy, no file system, core exists continuous sector, because this simplifies the boot process. of course, use LILO (LInuxLOader) from the file system boot. Boot from the hard disk, the master boot record partition table of code review (also in the master boot record sector), confirm the active partition (for marked as bootable partition), read from the partition boot sector, and then starts the boot sector code. the partition boot sector code to do with the same floppy disk: the boot partition into the core and the details are different, however, since usually only to core image to make a separate partition is not used, the partition boot sector code can not read disks only order, it must locate the file system to put them in what sector. There are several methods to resolve this problem, but the most common method is to use LILO. (Details on how to do it with irrelevant here; for more information please look at the LILO documentation, it's very comprehensive) using LILO boot time, it reads and boot the default core. you can also set the LILO, boot one of several core, or even other operating systems, you can boot time which allows the user to select a boot kernel or operating system .LILO can be set to if someone at boot time by pressing ALT, shift, orctrl keys (LILO starts), LILO will not immediately boot default and ask user guide which can be set to bring .LILO a timeout options and asks, when the time-out, then boot the default core. META: there are other than LILO boot loader, such as loadlin, their information will be in the next version in. Boot from the floppy and hard disks have advantages, but it is usually better to boot from the hard drive, because it avoids the controversy on floppy disks and quickly however., install the same boot from the hard drive may have more trouble, so many people to use a floppy disk boot, and then when the same work very well, and then install the LILO boot from the hard drive. Linux core is read into memory, it really started, summarized as follows: Linux core is installed is compressed, it first had to extract core mappings. include an extract of the beginning of the applet. If you have Linux recognizable super-VGA card, and to support some special text mode (such as 100 columns 40 rows), Linux will ask you to use when compiling the kernel mode., may have booked a video mode, will not be asked. this you can also use LILO or rdev completed. Then, check what other core hardware (hard disk, floppy disk, NIC ...), and configure the appropriate device driver; at the same time, the output of the find results information. for example, I get the boot-time, similar to the following information: LILOboot: Loadinglinux. Console:colourEGA+80x25,8virtualconsoles　　Serialdriverversion3.94withnoserialoptionsenabled　　tty00at0x03f8(irq=4)isa16450　　tty01at0x02f8(irq=3)isa16450　　lp_init:lp1exists(0),usingpollingdriver　　Memory:7332k/8192kavailable(300kkernelcode,384kreserved,176kdata)　　Floppydrive(s):fd0is1.44M,fd1is1.2M　　Loopbackdeviceinit　　WarningWD8013boardnotfoundati/o=280. Mathcoprocessorusingirq13errorreporting. Partitionceck:　　hda:hda1hda2da3　　VFS:Mountedroot(extfilesystem). Linuxversion0.99.pl9-1root @ haven) 05/01/20 12: 9314: exact text different on different systems, rely on the hardware, the Linux version, and its configuration. And then the core tries to mount the root file system where you can compile-time settings, or at any time using rdev or LILO. file system type autodetection. If failed to mount the root file system, for example because you forgot the core contains the relevant file system driver that core will fail, the system stops (has nothing to do at this time). The root file system is usually read-only mount (this is available in the same way as with the location). This makes the file system check on the mount; check a read/write file system mount is not a good idea. Then, start the program in the background the core init (located at/sbin/init) (its process number is 1.) start work .init do many things-exact is dependent on set; see chapter for more information. it at least to start some essential background daemons. Init and then switch to multi-user mode and start getty, offer virtual console and the serial line .getty is a user through the virtual console and the serial terminal login program some .init also may start the other program, based on the settings. At this point, boot completed, the system up and running. For more information about Shutdown Shutdown Linux system, follow the correct procedure is very important. Otherwise, the file system may become waste, the file may become cluttered. This is because Linux use the disk cache and the data is not immediately written to disk, which is intermittently write back. This greatly improves performance, but it also means that if you just turn off the power, the cache may keep large amounts of data, and data on disk may not be a full working file system (because some of the data is written back to disk, and some not). Another cannot directly off the power of reason: in a multitasking system, the background may run with a lot of things, turns off the power supply possible losses. Use the correct shutdown sequence, you can ensure that all of the background process to save their data. Graceful shutdown of the Linux system commands is shutdown. It typically use 2 methods. If the system has only one user, use the shutdown of general approach is to quit all running programs, log off from all virtual console, root login (if you are root, of course, do not have to log off, log on, but it should change to the root directory to avoid problems due to unmount), and then run the command shutdown-hnow (although single user is generally not necessary, but if you need a delay, use a plus sign and a representation of the number of minutes in place now) if the system is multi-user, use command shutdown-h + timemessage, time is the number of minutes the system stops, the message is to inform all users of the system shutdown reason of SMS. #shutdown-h+10'Wewillinstallanewdisk.Systemsould　　>bebackon-lineinthreehours.' # Above command warning all users, the system will shut down after 10 minutes, they'd better save information that otherwise would be lost. A warning will be displayed in all logins on the Terminal, including all the xterm: Broadcastmessagefromroot (ttyp0) WedAug201: 03 251995 ... Wewillinstallanewdisk.Systemsould　　bebackon-lineinthreehours. ThesystemisgoingDOWNforsystemhaltin10minutes!! Warning before the system shuts down automatically repeating several times, as time goes by, more and more short intervals. When delay after shutting down the system at the beginning of the genuinely, all file systems (except root) are all user processes unmount, (if someone has not cancelled) is terminated, all processes are closed, everything stopped. Since then, the init to print out a message telling you to turn off the power. At this point, and only then, you can turn off the power. Sometimes (although in any good system rarely), the system may not be able to close gracefully. For example, nuclearHeart disorder, crashes, and other unusual circumstances, may not be able to type any command, so the normal shutdown may have some difficulty, this is the only direct power off. The problem may not be so serious, for example, some malfunction of your keyboard, core and update program still running, waiting for some time may be a good idea, this can make the update have the opportunity to the data in the buffer cache huicun hard disk, and then direct to shut down. Some people like to use sync three times to turn off the system, wait until the disk i/o, and then turn off the power. If no program is running, and the use of equivalent shutdown. However, it does not unmount any file system that may cause the ext2fs "clean file system" sign out. This 3 x sync method is deprecated. (Incaseyou'rewondering:thereasonforthreesyncsisthatintheearlydaysofUNIX,whenthecommandsweretypedseparately,thatusuallygavesufficien

Fedora 8 i386 using local iso add and remove programs

Step 1: first copy the iso file to mount as a virtual CD drive: mount-oloop-tiso9660/mnt/cdrom Note: 1. replace your iso file addresses such as/Fedora-8-i386.iso2. If you do not have cdrom directory under/mnt, you can create a new folder named cdrom step 2: modify the file location of the warehouse yum: because the "Add/Fedora RemoveSoftware" seems to be integrated with some features similar to yum.

Each time you open it, it will go online to search the list of installed packages, to search for a while (super upset). If you do not want to let it go to cable Internet, and is only found in Add/Remove software, then we need to warehousing file location yum to make some adjustments. That is put in the/etc/yum.repos.d/file backup to other places, I choose it in the directory to place a directory again. And then he built one. Repo for the file name extension, the note is placed in the/etc/directory yum.repos.d/. For example, I is CDROM.repo, path is/etc/yum.repos.d/CDROM.repo, which reads as follows: [core] Note: must not be changed, otherwise the download software header error name = CDROMbaseurl = file:///mnt/cdrom comments: here is the place you CD mount path enabled = 1gpgcheck = 1gpgkey = file:///mnt/cdrom/rpm-gpg-key comments: here is the specified CD called RPM-GPG-KEY certification files Note: above indicate comments place be sure to modify your own place. Well, now you can rest assured that open the "Add/RemoveSoftware". Wait, wait for it to search out installation package, you can begin to add/remove programs.

CentOS5 install apache and svk use domain user authentication

Using the rpm installation package httpdhttpd-develpam-develsubversionsubversion-perl installed above the svk cpanSVK can complete the installation.

Http enabled ssl as a first step, create the key and request: opensslreq-new > new.cert.csr second step, remove the passphrase from the key (optional): opensslrsa-inprivkey.pem-outnew.cert.key third step converts the request signedsert: opensslx509-innew.cert.csr-outnew.cert.cert-req-signkeynew.cert.key-days1825 step four, cert and key files are copied to the appropriate location. Cpnew.cert.cert/etc/apache/ssl.crt/server.crtcpnew.cert.key/etc/apache/ssl.key/server.key configuration: linux into a Windows domain configurations do not more. Mod_auth_pam no out-of-the-Pack, download the source code to compile, as long as the above package is installed, it should be no problem. Because my system is directly using winbind and windows domains, so the direct use of a domain user authentication, you need to modify this configuration:/etc/pam.d/httpdauthrequired/lib/security/pam_winbind.soaccountrequiredpam_permit.so so that you can complete the svn over HTTPS using a domain user authentication.

Linux security and LIDS

LIDS (Linux intrusion detection system) is the Linux kernel patches and system management staff lidsadm), which strengthened the Linus kernel.

It in the kernel implements a security mode--reference mode and the kernel of MandatoryAccessControl (order entry control) mode. This article explains the functionality of the LIDS and how to use it to set up a secure Linux system. 1. Why choose LIDS with Internet Linux more and more popular, more and more existing GNU/LINUX system software security vulnerabilities are found. Many programs use the programmers of careless, such as buffer overflows, format code attacks. When the system security program jeopardize access to ROOT permissions, hacker, the entire system will be an intruder control. Because of the openness of the code, we can get a lot of hope Linux application of original code, and according to our need to modify. So the bug can be easily found and quickly repair. But when the vulnerability was revealed, while system administrators neglect to vulnerability patched, resulting in a very easily by intrusion, the worse the hacker could gain ROOTSHELL. Leverage existing GNU/Linux system, his own way. This is precisely the LIDS want to solve problems. First look at the existing GNU/Linux system which problems exist. File system is not affected by the protection system of many important documents such as/bin/login, once hackers, he can upload modified l ogin file instead of/bin/login, then he can do not need any login name and password to login to the system. This is often called Trojanhouse. Process is not protected processes running on the system is to some system features the services, such as HTTPD is a web server to respond to the remote client for Web needs. As a Web server system, to protect their process from being unlawful termination is very important. But when an intruder to gain ROOT privileges, but we are powerless. System management is not protected, many system management, for example, module loading/unloading, routing settings, firewall rules, can easily be modified, if a user's ID is 0. So when an intruder gain ROOT privileges, become unsafe. Super user (root) privileges as ROOT may abuse he can do whatever they want. He even as ROOT you can modify the existing permissions. To sum up, we found an existing Linux system into the control mode is not sufficient to establish a secure Linux system. We must add a new pattern to solve these problems. This is the LIDS have to do. 2.LIDS features Linux intrusion detection system is a Linux kernel patches and system administrator tool that reinforces the security of the kernel. It in the kernel implements a reference monitor mode and MandatoryAccessControl (order entry control) mode. When it comes into play, choose a file into each system/network management operations, any usage rights, rawdevice, mem and i/o into the ROOT can be prohibited even. It uses and extends the functionality of the system, in the entire system bound control settings, add the network in the kernel and the file system security features, thus strengthening security. You can adjust the security protection, hide sensitive process, through the network to accept the security warning, and so on. In short, the LIDS provide protection, detection and response capabilities to the Linux kernel in safe mode. 2.1 protection LIDS provides the following protection: protect your hard drive any type of important files and directories, including the ROOT can change. Protect important process is terminated to prevent illegal program RAWIO operation. Protect hard drive, including the protective MBR, etc. Protects sensitive files in the system to prevent unauthorized users (including ROOT) and is not authorized to enter the program. 2.2 reconnaissance when someone scanning your host, LIDS can detect and report the system administrator. LIDS also can detect any violation of the rules on the system. 2.3 response when someone violates the rule, the LIDS are illegal operation detail records to the protection of system log LIDS. LID S log information can also be transmitted to your mailbox. You can also close the LIDS and users at once. 3. establish a secure Linux system finished LIDS feature, let's take a look at how established with LIDS, step-by-step security system. 3.1 download LIDS patches and related official Linux kernel from LIDSHome, LIDSFtpHome or recent LIDSMirror access LIDS patches and system management tools. Patch name is representative of lids lids-x.xx-y.y.y.tar.gz, version x.xx, representative of the Linux kernel version y.y.y. for example, lids-0.9.9-2.2.17.tar.gz representative lids version 0.9.9 is as well as relevant kernel version is 2.2.17. 。 You must download the kernel version. For example, you download the lids-0.9.9-2.2.17.tar.gz, then you should download the Linux kernel 2.2.17 's original code. You can mirror from KernelFTPSite or other source code for the kernel. Then, the kernel of the original code and LIDStarUnzip. for example, to get from www.lids.org lids-0.9.9-2.2.17.ta r.gz, received from ftp.us kernel.org linux-2.2.17.tar.bz2:-----------------------------------------------------------1.uncompresstheLinuxkernelsourcecodetree. #cdlinux_install_pat/　　#bzip2-cdlinux-2.2.17.tar.bz2|tar-xv -　　2.uncompressthelidssourcecodeandinstallthelidsadmtool. # Cdlids_install_pat # tar-zxvflids-0.9.8-2.2.17.tar.gz-----------------------------------------------------------3.2 in official Linux kernel patch on the LIDS of the Linux kernel source code patch to play LIDS------------------------------------------------------------# cdlinux_install_path/linux # patc-p1/* linkthedefaultsourcepathtolidspatchedversion # rm-rf/usr/src/linux # ln-slinux_install_patch/linux/usr/src/linux 3.3 configuration of the Linux kernel-----------------------------------------------------------configuretheLinuxkernel # cdlinux # makemenuconfigormakexconig-----------------------------------------------------------now, configure the Linux kernel, follow these steps to implement: [*] Promptfordevelopmentand/orincompletecode/drivers [*] Sysctlsupport Afterthat, youwillfindthatanewitemappearinthebottomoftheconfigura tionmenuname "LinuxIntrusionDetectionSystem" .Enteringthismenu, turnte [*] LinuxIntrusionDetectionSystemsupport (EXPERIMENTAL) (NEW). After configuring the LIDS kernel. exit configuration interface, compile the kernel. # Makedep # makeclean # makebzImage # makemodules # makemodules_install 3.4 installed on a Linux system LIDS and system management tools replication bzImage to/boot/, edit/etc/lilo.con-----------------------------------------------------------# cparch/i386/boot/boot/bzImage/bzImage-lids-0.9.9-2.2.17/* buildadmintools */# cdlids-0.9.8-2.2.17/lidsadm-0.9.8/# make # makeinstall # less/etc/lilo.con boot =/dev/da map =/boot/map install =/boot/boot.b prompt timeout = 50 image = default = linux/boot/vmlinuz-2.2.16-3 read-only label = linux root =/dev/da2 image =/boot/bzImage-lids-0.9.9-2.2.17 label = dev read-only root =/dev/da2-----------------------------------------------------------run/sbin/lilo to install new kernel #/sbin/lilo 3.5 configuration LIDS system before the reboot, you must configure the lids system to meet your security needs, you can define a protected file, protected processes, etc. By default, the default configuration will be lidsadm files are installed to the/etc/lids/。 You have depending on their need to be reconfigured. First, you can update the default lids.conf inodes/dev value. #/Sbin/lidsadm-U 3.6 reboot the system when you finish configuring the Linux system, restart the. when lilo appears, select Mount thelidsenablekernel. Then, you will enter the wonderful world of LIDS. 3.7 package kernel system starts, don't forget to use lidsadm package kernel, in the final/etc/rc.local by adding the following command #/sbin/lidsadm-I 3.8 online management package after you finish the kernel, your system is under the protection of the LIDS. You can do some tests to verify that, if you want to change some configuration, such as modifying permissions, you can enter a password to change the way online lids security level. #/Sbin/lidsadm-S---LIDS change lids after the configuration attribute, for example lids.conf, lids.cap, you can use the following command in the kernel to reload configuration file #/sbin/lidsadm-S--+ RELOAD_CON 4. configure the LIDS system 4.1LIDS configuration directory--"/etc/lids/" install lidsadm, will produce a/etc/lids/lids configuration directory, when the kernel boots, configuration information is read into the kernel to initial

To establish the SSL connection channel MySQL

;; Remove the passphrase client-key (optional) opensslrsa-inclient-key.pem-outclient-key.pem;; signed client certificate opensslca-policypolicy_anything-outclient-cert.pem-configopenssl.cnf-infilesclient-req.pem # Sampleoutput: # Usingconfigurationfrom/usr/local/EnterPEMpassphrase myssl/openssl.cn #: # Checkthattherequestmatchesthesignature # Signatureok # TheSubjectsDistinguishedNameisasfollows # countryName: PRINTABLE: ' CN ' # organizationName: PRINTABLE: ' CenteurCA ' # commonName: PRINTABLE: ' MySQLuser ' # CertificateistobecertifieduntilMay1816 08: 202006GMT # (365days) # Signthecertificate? [y/n]: y ### 1outof1certificaterequestscertified, commit? [y/n] y # Writeoutdatabasewith1newentries # DataBaseUpdated modify/etc/my.cnf, add the following content: [client] ssl-ca =/usr/local/myssl/cacert.pem ssl-cert =/usr/local/myssl/client-cert.pem ssl-key =/usr/local/myssl/client-key.pem [mysqld] ssl-ca =/usr/local/myssl/cacert.pem ssl-cert =/usr/local/myssl/server-cert.pem ssl-key =/usr/local/myssl/server-key.pem restart mysql service/usr/local/etc/rc.d/mysql-serverrestart