Vivek's Blog

Assumption:

- eth0 is the external interface (Connected to internet)
- eth1 is the internal interface (local network) (Fixed IP)

Edit /etc/sysctl.conf to enable ip forwarding permanently.

net.ipv4.ip_forward = 1

Edit /etc/sysconfig/iptables-config and make following changes:

IPTABLES_MODULES=”ip_conntrack_netbios_ns ip_conntrack ip_conntrack_ftp ip_conntrack_irc iptable_nat ip_nat_ftp ip_nat_irc”
IPTABLES_SAVE_ON_STOP=”yes”
IPTABLES_SAVE_ON_RESTART=”yes”

# To clear out any existing rules and set default policy,
# run following commands on command prompt
iptables -P INPUT ACCEPT
iptables -F INPUT
iptables -P OUTPUT ACCEPT
iptables -F OUTPUT
iptables -P FORWARD DROP
iptables -F FORWARD
iptables -t nat -F

# FWD: Allow all connections OUT and only existing and related ones IN

iptables -A FORWARD -i eth0 -o eth1 -m state –state ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -i eth1 -o eth0 -j ACCEPT

# Enabling MASQUERADE functionality on eth0
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

RPM packages have a file of names like foo-1.0-2.i386.rpm, which include the
package name (foo), version (1.0), release (2), and architecture (i386).

To display package information before installing the program, use the command:
# rpm -qpi foo-2.3-8.i386.rpm

To install a RPM package, use the command:
# rpm -ivh foo-1.0-2.i386.rpm

To upgrade a RPM package, use the command:
# rpm -Uvh foo-1.0-2.i386.rpm

With this command, RPM automatically uninstalls the old version of foo package and installs the
new one. Always use rpm -Uvh to install packages, since it works fine even when there are no
previous versions of the package installed.

To uninstall a RPM package, use the command:
# rpm -e foo
Notice the use of the package name “foo�?, not the name of the original package file “foo-
1.0-2.i386.rpm�?.

# rpm -q foo
foo-2.3-8
This command will print the package name, version, and release number of installed package
foo. Use this command to verify that a package is or is not installed on your system.

To display package information, use the command:
# rpm -qi foo

To display package information before installing the program, use the command:
# rpm -qpi foo-2.3-8.i386.rpm

To list files in a installed RPM package, use the command:
# rpm -ql foo

To know which files is part of which package, use the command:
# rpm -qf /etc/passwd

To remove all the unneeded packages together, use the following commands:
# rpm -e –nodeps anacron apmd at dhcpcd dosfstools eject hotplug ipchains ksymoops kudzu lokkit mailcap pciutils pump raidtools redhat-logos redhat-release setserial kbdconfig mouseconfig timeconfig authconfig ntsysv setuptool

Once you have installed all the software that you need on your Linux server with the RPM
command, it’s a good idea to move it to a safe place like a floppy disk or other safe place of your choice. With this method if someone accesses your server and has the intention to install nasty software with the RPM command, he wouldn’t be able to. Of course, if in the future you want to install or upgrade new software via RPM, all you have to do is to replace the RPM binary to its original directory again.

To move the RPM binary on the floppy disk, use the command:
[root@deep /]# mount /dev/fd0H1440 /mnt/floppy/
[root@deep /]# mv /bin/rpm /mnt/floppy/
[root@deep /]# umount /mnt/floppy/

One more thing you can do is change the default permission of the “rpm�? command from 755 to 700. With this modification, non-root users can’t use the “rpm�? program to query, install etc; in case you forget to move it to a safe place after installation of new programs.

Configure the /etc/exports file with the most restrictive access possible. This means not using wildcards, not allowing root
write access, and mounting read-only wherever possible.

Edit the exports file (vi /etc/exports) and add:
As an example:
/dir/to/export host1.mydomain.com(ro,root_squash)
/dir/to/export host2.mydomain.com(ro,root_squash)
Where /dir/to/export is the directory you want to export, host1.mydomain.com is the machine allowed to log in this directory, the option mean mounting read-only and the option for not allowing root write access in this directory.
* root_squash – Maps the root user to the nobody user. This has the effect of not allowing a root user on a client to gain root file access permissions on the server.
* all_squash – Maps all the UIDs and GIDs to the nobody user. This is useful if the share is to have anonymous access, much like an anonymous FTP server.

For this change to take effect you will need to run this command on your terminal:
#/usr/sbin/exportfs -a