Linux system service startup and the prohibition and the corresponding port number

/Etc/services view system default services and ports corresponding to the individual DAEMONS (services) of startup and shutdown scripts are placed in/etc/init.d/, but REDHAT system is put into the/etc/rc.d/init.d inside, as regards the control parameter file superdaemon is placed in/etc/xinetd.d inside.

Standalone (independent startup) and superdaemon (super service) standalone as the name implies, standalone is directly perform the service scan line stalls and let the executable directly loaded into memory, operation, this way to start this service can be made with a quick response. Generally speaking, this kind of services launch scrip will place the/etc/init.d/directory underneath this, so you can often use: [/etc/init.d/sshdrestart] like to start this service; With a super service superdaemon as mains, to manage some network services in the use of the inside CENTOS4.3 is xinetd this superdaemon, this way start network services while in response speed be slow, however, can provide some additional through superdaemon control, for example control when to start, when you can be online, the IP can even come in, whether to allow simultaneous online and so on. Usually profile in/etc/xinetd.d/, but needs to be set is finished to [/etc/init.d/xinetdrestart] to start again. If you want the system to switch off the PORT25, above the simplest approach is to first identify the PORT25 's startup process. # Netstat-tnlp TCP00127.0.0.1: 6310.0.0.0: * listen1171/cupsd//22, the port is opened by the program cupsd. If the program is not visible, use the CUPSD nmaplocalhost to view native ports, will show port and the corresponding procedures. # Whichcupsd/usr/sbin/cupsd//identify cupsd program location. If not found, WHICH is used to LOCATE with the formal notation to find this directive. # Locatecupsd | grep '/cupsd $ '/usr/sbin/ssd use RPM to treatment: # rpm-qf/usr/sbin/cupsd cups-1.1.17-13//identify the program name # rpm-qccups | grepinit/etc/rc.d/init.d/cups//identify program startup. #/Etc/rc.d/init.d/cupsstop//stop program.

Use SSH implementation under Linux safe data transfer (pictures)

Currently in use on the Internet, such as FTP, Telnet, POP etc in essence are not secure, they are in use on the network in clear text password and data transmitted, the hacker is very easy to intercept these passwords and data, thus undermining the integrity and confidentiality of the data.

This article describes how to use the SSH software under Linux is not a secure network environment through password mechanism to guarantee the security of data transmission. The English name is SSH SecureSHell. Through the use of SSH, you can put all transferred data is encrypted, so even if the network hackers to hijack the data transmitted by the user, if you cannot decrypt it, nor on data transfer constitutes a real threat. In addition, the transmission of data is compressed, so you can speed up the transmission speed. SSH has many features, it can replace Telnet and FTP, POP provides a security "transmission channel". In non-secure network communication environments, it provides strong authentication (authentication) and very secure communications environment. SSH is determined by the client and service side of software, there are two incompatible versions 1.x and 2.x is:. The client program used SSH2.x is unable to connect to the service looks SSH1.x. OpenSSH2.x while supporting SSH1.x and 2.x. SSH provides two levels of security validation: a is for security authentication based on passwords. As long as the user knows the password, account number and can log on to the remote host. All transferred data is encrypted, but cannot guarantee that users are connecting to the server that the user wants to connect to the server. You may have other servers in the impersonate the real server, there is a potential threat. The second is based on the key security validation. Need to rely on the key, the user must create a public key/private key pair, and the public key is placed in the need to access the server. If you need to connect to a SSH server and client software will make a request to the server, the request uses the user's keys for security verification. After the server receives the request, the first server on the user's home directory to find the user's public key, and then take it and users of public keys sent for comparison. If the two keys match, the server uses the public key encryption, "question" and have it sent to the client software. Client software after you receive the "question" can be used to decrypt the user's private key and send it to the server. Install and start the SS in RedHatLinux7 and its release is included in the packages associated with OpenSSH, if not, you can download from the home page of OpenSSH RPM package installed, OpenSSH is the home page address is: www.openssh.com. Main install the following packages: openssh-3.5p1-6, 6, openssh-server-3.5p1-openssh-askpass-gnome-3.5p1-6, 6, openssh-clients-3.5p1-openssh-askpass-3.5p1-6. Use the following command to install: first query system is installed on the above packages. # Rpm-qa | grepopenss if you have not installed then do the following command. # Rpm-ivhopenssh-3.5p1-6 # rpm-ivhopenssh-server-3.5p1-6 # rpm-ivhopenssh-askpass-gnome-3.5p1-6 # rpm-ivhopenssh-clients-3.5p1-6 # rpm-ivhopenssh-askpass-3.5p1-6 after the installation has completed, you can use the following two commands for a start. # Servicesshdstart #/etc/rc.d/initd/sshdstart also, if you want the system to automatically run when you start the service, you will need to use the Setup command, in network service configuration options, select the sshd daemon. After you finish the installation start the OpenSSH, use the following command to test it out. Ssh-l [username] [addressoftheremoteost] if the OpenSSH is working correctly, you will see the following message: Theauthenticityofhost [hostname] can'tbeestablised. Keyfingerprintis10245f:a0:0b:65:d3:82:df:ab:44:62:6d:98:9c:fe:e9:52. Areyousureyouwanttocontinueconnecting(yes/no)? At the first login, OpenSSH will prompt the user does not know the login host, simply type "yes", you will get the login identification tag of the "host" to "~/.ssh/know_hosts" file. Second visit to this host when they no longer show this message again. Then SSH prompt the user for a user account on the remote host's password. In this way, an SSH connection is established, then you can use telnet as easily use SS. SSH key management (1) it is necessary to generate your own key pair using the following command to generate a public/private key pair: ssh-keygent type. If the remote host using SSH2.x will use this command: ssh-keygend. In the sameHost both SSH1 and SSH2 key is no problem, because the key is present in different files. Ssh-keygen command to run after it displays the following information: # ssh-keygen-trsa Generatingpublic/privatersakeypair. Enterfileinwhichtosavethekey(/home/.username/ssh/id_rsa):　　Enterpassphrase(emptyfornopassphrase):　　Entersamepassphraseagain:　　Youridentificationhasbeensavedin/home/.username/.ssh/id_rsa. Yourpublickeyhasbeensavedin/home/.username/.ssh/id_rsa.pub. Thekeyfingerprintis:　　38:25:c1:4d:5d:d3:89:bb:46:67:bf:52:af:c3:17:0c username@localhost 　　GeneratingRSAkeys:　　Keygenerationcomplete. "Ssh-keygen-d" command to do the same work, but it's a pair of keys for the save path by default as:/home/[user]/.ssh/id_dsa (private key) and/home/[user]/.ssh/id_dsa.pub (public key). Now the user has a pair of keys: a public key to distribute to all users want to use SSH to log in to the remote host looks; private keys to take custody of preventing other people know. Use the "ls-l ~/.ssh/identity" or "ls-l ~/.ssh/id_dsa" command displays the file access permission must be "-rw-------". If you suspect that your key has been known to others, you should immediately generate a new key. Of course, doing so will also need to redistribute a public key, for normal use. 2. distribute the public keys for each user needs to use SSH connection on a remote server, all in their own home directory create a ".ssh" subdirectory, the user's public key "identity.pub" copied to this directory and rename it to "authorized_keys". And then execute the command: chmod644.ssh/authorized_keys this step is essential. Because, if a user other than the others on the "authorized_keys" file has write permissions, if subjected to unlawful destruction, SSH will not work properly. If the user wants to log on from a different computer to a remote host, the "keys" authorized_ files can have multiple public keys. In this case, you must restart the new computer to generate a pair of keys, and then put the generated "identify.pub" file copy and paste to the remote host "authorized_keys" file. Of course, on the new computer users must have an account, but the key is password protected. It is important that when a user cancels out of this account, you have to remember to delete the key. Configuring the SSH client on the Linux client to use SSH, advantage is more convenient to operate, without additional software. But the disadvantage is not very intuitive. Users only need to use the system-provided default profile "/etc/ssh/ssh_config" and use the following simple command to log://user test for the remote server www.test.com # ssh-ltestwww.test.com following this section mainly introduces the configuration to use Windows environment of the putty tools to log in to the SSH server. The tools being used fairly common, and can be downloaded free from the Internet. Currently the latest version of the Internet to: putty0.58, the version installed, do the following steps to configure: 1. open the software, enter the configuration interface and software initial Session window opens automatically. 2. in the interface right half area 【 HostName (orIPaddress) 】 edit box, enter the log on to the remote server address, here set to: 192.168.10.1, port edit box, enter the default port number 22, and then click 【 Save 】 button to save the input configuration, as shown in Figure 1. Figure 1 Configuring IP address and port number 3. click 【 Open 】 button, the software to connect to the server, display the connection as a result, users can make the appropriate remote management operations. Configure automatic login SSH in SSH's described above, each time the user logs on the server will need to enter the password for the user, is in some trouble. Since SSH key mechanisms used in full, then you must configure the system, to achieve a configuration that do not have to enter your password for easy logon to the end, the following Windows client, for example, shows how to auto login to SSH in. In Windows, use the previously described putty client software also allows you to easily implement an automatic logon, mainly using the putty tool kit comes with puttygen tool to generate a public/private key pair, the same principles and under Linux, the following describes the configuration details. 1. open puttygenTools to generate a public/private key pair, as shown in Figure 2, select the type of key generated SSH2RSA. Figure 2 main interface 2PuttygenGenerator. click 【 Generate 】 button, enter the public/private key pair generation interface, users need to keep the interface space, move the mouse to ensure that key generated random performance. 3. successful public/private key pair is generated, the system prompts the user to save the public key/private key pair. Click the button and 【 Savepublickey 】 【 Saveprivatekey 】 button, specify the path to save the public key and private key. 4. use putty connections on the server, copy the contents of the public key file to the server in the main directory, use your own account to log on to a remote system, and then execute the following command. Then use Notepad to open the file, select all id_rsa1.pub, press CTRL + C to copy to the Clipboard, and then in the Putty window, press SHIFT + Ins paste, and then press Ctrl + D keys, complete file creation. This is the process of completing public key distribution.

Linux system service startup and the prohibition and the corresponding port number

/Etc/services view system default services and ports corresponding to the individual DAEMONS (services) of startup and shutdown scripts are placed in/etc/init.d/, but REDHAT system is put into the/etc/rc.d/init.d inside, as regards the control parameter file superdaemon is placed in/etc/xinetd.d inside.

Standalone (independent startup) and superdaemon (super service) standalone as the name implies, standalone is directly perform the service scan line stalls and let the executable directly loaded into memory, operation, this way to start this service can be made with a quick response. Generally speaking, this kind of services launch scrip will place the/etc/init.d/directory underneath this, so you can often use: [/etc/init.d/sshdrestart] like to start this service; the service with a super superdaemon as mains, to manage some network services in the use of the inside CENTOS4.3 is xinetd this superdaemon, this way start network services while in response speed be slow, however, can provide some additional through superdaemon control, for example control when to start, when you can be online, the IP can even come in, whether to allow simultaneous online and so on. Usually profile in/etc/xinetd.d/, but needs to be set is finished to [/etc/init.d/xinetdrestart] to start again. If you want the system to switch off the PORT25, above the simplest approach is to first identify the PORT25 's startup process. # Netstat-tnlpTCP00127.0.0.1: 6310.0.0.0: * listen1171/cupsd//22, the port is opened by the program cupsd. If the program is not visible, use the CUPSD nmaplocalhost to view native ports, will show port and the corresponding procedures. # Whichcupsd/usr/sbin/cupsd//identify the cupsd program location. If not found, WHICH is used to LOCATE with the formal notation to find this directive. # Locatecupsd | grep '/cupsd $ '/usr/sbin/ss use RPM to treatment: # rpm-qf/usr/sbin/cupsdcups-1.1.17-13//identify the program name # rpm-qccups | grepinit/etc/rc.d/init.d/cups//identify the program startup. #/Etc/rc.d/init.d/cupsstop//stop program. 1. to start the telnet, first of all you must have installed the telnet Server, so rpm query first to see if there are any installation telnet-server. [/Rpm-qa | greptelnet-server] If you did not install, download or find CD, installation [yuminstalltelnet-server] installation. 2, as is the management, the first superdaemon editable/etc/xinetd.d/telnet this file, the [disable = yes] into [disable = no] to [/etc/init.d/xinetdrestart] restart superdaemon.3, use netstat-tnlp check start PORT23. 4, start-up data placed in/etc/rc.d/rc [0-6] .d/inside, you can use ntsysv and chkconfig command to control, whether or not to post to start the service. For example: 1. To do a lookup on portmap this program will execute? 2. If you post it, how to change it to a post without boot? 3. How to immediately close the PORTMAP service? through [chkconfig--list | grepportmap] and [runlevel] to confirm your environment and PORTMAP is started. (The runlevel can view the current boot interface. Chkconfig can view program startup or not. OFF not started. NO boot. ) If you have started, available [chkconfig--level35portmapoff] to set the boot-time do not start; (3 to 5 for the text interface, graphical interface. ) Can be used [/etc/init.d/portmapstop] to immediately shut down the service. Normal program services need to be started. Acpid-new version of power NASA science module, it is generally recommended, however, some notebook computers may not support this service, it would have to shut down. Atd-------in the management of a single appointment command execution services, should you want to start. Crond-----in the management of the scheduling of critical services, be sure to start. Iptables--Linux built-in firewall software, it can also be started. Keytables-if your keyboard informal format, this service starts may help you. Network---this is important, to network should he, network services. Sshd------this is the system preset starts, you can remote login in textual form. Syslog-system login file records, very important, be sure to start. Xinetd--the superdaemOn, so you want to start. Xfs-------used to manage glyph data service XWindow, if you need this service XWindow to start. Other service programs, and then set startup when needed.

Linux system service startup and the prohibition and the corresponding port number

1. to start the telnet, first of all you must have installed the telnet Server, so rpm query first to see if there are any installation telnet-server.

[/Rpm-qa | grep telnet-server] If you did not install, download or find CD, installation [yuminstalltelnet-server] installation. 2, as is the management, the first superdaemon editable/etc/xinetd.d/telnet this file, the [disable = yes] into [disable = no] to [/etc/init.d/xinetdrestart] restart superdaemon. 3. Use netstat-tnlp check start PORT23. 4, start-up data placed in/etc/rc.d/rc [0-6] .d/inside, you can use ntsysv and chkconfig command to control, whether or not to post to start the service. For example: 1. To do a lookup on portmap this program will execute? 2. If you post it, how to change it to a post, don't start? 3. How to immediately close the PORTMAP service? You can try [chkconfig--list | grepportmap] and [runlevel] to confirm your environment and PORTMAP is started. (You can view the current runlevel starts interface. Chkconfig can view program startup or not. OFF not started. NO boot. ) If you have started, available [chkconfig--level35portmapoff] to set the boot-time do not start; (3 to 5 for the text interface, graphical interface. ) Can be used [/etc/init.d/portmapstop] to immediately shut down the service. Normal program services need to be started. Acpid-new version of power NASA science module, it is generally recommended, however, some notebook computers may not support this service, it would have to shut down. Atd-------in the management of a single appointment command execution services, should you want to start. Crond-----in the management of the scheduling of critical services, be sure to start. Iptables--Linux built-in firewall software, it can also be started. Keytables-if your keyboard informal format, this service starts may help you. Network---this is important, to network should he, network services. Sshd------this is the system preset starts, you can remote login in textual form. Syslog-system login file records, very important, be sure to start. Xinetd--the superdaemon, so also to start. Xfs-------used to manage glyph data service XWindow, if you need this service XWindow to start. Other service programs, and then set startup when needed.

Use the SMC to achieve Solaris10 server role management (continued)

But because of wildcards, and special program attributes not related, so all wildcard characters, the directive is in accordance with the current user (or role) of the uid and gid to perform.

If you specify this right, the right should be located right at the end of the list. If the first item in the list, the find command property, does not query other rights. If 「introduction all 」 dimmed, then you cannot 「introduction count "or the" delete 」 this right. L now home directory, home directory Description: enter a role's home directory (or accept the default), in accordance with established practice, this directory is written as:/export/home/role name is the name of the role is automatically appended to the displayed 「introduction path 」. The home directory is the role of private files saved in 「introduction home directory server 」. L specifies the user to the role, in this step, please increase the allowed use of the role of the user's user name. In addition you can now add a user, you can later from 「introduction role properties 」 dialog or 「introduction user properties 」 dialog box to increase the role of the user. Note: Although the role and user attributes, but you cannot assign a role to another role. Confirmation increase interface l, this role check screen displays your last screen enter or select all of the information. If the information is correct, click "Finish". If you want to make changes, click 「introduction back 」 to return to the screen you want to change.

Linux system of protection against hackers by some practical tips

Linux is a multiuser system, once they have your root user, he can do whatever they want on your system, because a single user on the system has full control permissions, if improper operation or by others to access, then the consequences will be dire consequences, how to prevent a single user, join the following note.

1. to protect the/etc/inittab file if the id: 3: initdefault in the 3 to 1, you can directly enter each time you boot into single user mode. On the file to root/etc/inittab entering through chown700/etc/inittab to property is set to other users cannot modify it. 2. If you are using lilo to boot, possible manner through linuxconf or directly modify the boot time waiting for lilo.conf input time is set to 0 or the shortest possible time. In this case, if you enter single user mode, you can boot with the floppy disk. 3. If the use is to boot GRUB manner, easiest way is to use the GRUB password on startup options for protection. 4, in order to prevent remote destruction, allowing the system to restart, except for the ROOT password and files under the/etc directory for effective management, it should also be set to the password-CMOS, so even if you put the system into single-user mode, it cannot start your computer directly.

Use the SMC to achieve Solaris10 server role management (continued)

Here I will be using the GUI tools SMC roles and permissions management.

First, in the role management console SMC introduction of role management is located in the SMC console system configuration sections of user tools section. User tools is a set of managing user accounts, user groups and mailing lists of tools. Figure 1 is a role management interface, table 1 role management instructions: field names indicate the role name is the name of the role administrator used to log the name of the special role. Each role name must:-be unique within the domain-containing two to 32 letters, numbers, underscore (_), hyphens (-), and periods (.) -From letters start-at least one lowercase letter-no spaces if you later in the role properties dialog box to change the role, and the role of related messages list name is automatically changed. Full name including the role of full, descriptive name. The name:-should be unique within the domain (a unique name for a specific database will reduce the time required)-to effectively contain an unlimited number of letters, numbers, spaces and special characters description including the role of full, descriptive name. The name:-should be unique within the domain (a unique name for a specific database will reduce the time required)-to effectively contain an unlimited number of letters, numbers, spaces and special characters (optional) role ID number that is assigned to the role of the identification code. Role and a user name using the same group identification code (although the user's identification code refers to the UID). This is the next available number. Role ID number must be 100 to 2147483647 full number. It must be unique within the domain number (not any other roles you and ID or UID). Select the role of roles shell login shell (the administrator of the Bourne, administrator or the administrator of the Kornshell C). This is the user login terminal or console window and the window contractor will perform with the role of the shell. These and more general Bourne, Korn and Cshell similar. However, these 「introduction administrator 」 shell can determine when the user receives the used roles, the user will only be able to perform the roles allow directive. Shell in the Administrator role in operations, users need to log in a terminal or console window, and enter in the su command after he or she can sing with the role name: surolename. Create role mailing list check this box to use the name of the role to create a mail list. You specify in step 5 to the roles of all sent to the user will receive the email. When you specify a different user to the role, please use 「introduction mail list 」 tool to add those users to the mail list (and perform any other mail list maintenance). Note: If you already have a mailing list and the name of the role, you will not be able to create a mail list here, because the two lists cannot have the same name. You can rename the role or later use 「introduction mail list 」 tool to create a mail list, and then add the user name to the list. Roles are used to grant permissions to the administrator of the special account. Included in each role attribute that can assume the role of the list of users and permissions granted to this role. When a user role, they abandon their own user account properties, and accept this role attributes--including permissions, home directory, password, etc. You can use the root user as full role; other roles permissions restrict more. If you are in the right window select 「introduction management role 」, click 「introduction action 」-> 「introduction open 」 to view a list of existing roles (if any). Then, 「introduction Action 」 menu will change to provide a description of the options below. To increase the role, please press the 「introduction action 」-> 「introduction increase management role 」. To assign users to roles, select role, and then click 「introduction action 」-> 「introduction specified management role 」. To specify permissions to the role, select role, and then click 「introduction action 」-> 「introduction specify permissions to roles 」. To view or change properties of an existing role, double-click the name of the role.