Tag Archives: centos

Monitor your system for threats with rsec alerts

This week’s TechMail is Monitor your system for threats with rsec alerts which discusses the rsec tool I forked from Mandriva’s msec years ago (for Annvix). It’s been updated and is available for Red Hat Enterprise Linux 5 (and CentOS 5) as I think it’s still a pretty good tool and complements stuff like logwatch quite nicely. rsec essentially reports on various bits of your system… it lets you know if there are changes to suid/sgid files, points out unowned files, changes to firewall rules, indicates if there are new packages to install, if there are changes to listening services, etc. Basically it took all the best bits (reporting) of msec and got rid of all the crappy bits (that change things).

I have heard that msec now is much better, but have not had a chance to try it although I do try to keep up with the changes to msec related to reporting and fold those back into rsec.

Get a stable and secure server setup with CentOS, RPMForge, and Utter Ramblings

This week’s TechMail is Get a stable and secure server setup with CentOS, RPMForge, and Utter Ramblings which talks about setting up extra repositories in CentOS. As was pointed out in the comments on that blog, I neglected to mention EPEL (in all fairness, when I wrote about it, I had no idea EPEL existed so sorry EPEL folks!).

The return of Annvix

Well, sort of.

Annvix is not coming back as an operating system like it used to be, but rather a repository of packages for RHEL/CentOS (currently just version 5). There is very little there right now: a new version of openssh and a new version of logwatch. It will increase as time permits. I do plan on “porting” some of the stuff I had done for Annvix to RHEL5; things like rsec, AIDE+GPG, runit, scripts to use with runit, etc. Essentially those things that were fun to deal with on Annvix, but without the pain of managing a whole OS.

If you feel like giving it a go, just execute:

# rpm -ivh http://repo.annvix.org/media/EL5/x86_64/annvix-release-1.0-2.el5.avx.x86_64.rpm

on your RHEL5 or CentOS5 install (change x86_64 to i386 if you’re using an x86 system). If you have the priority plugin setup on CentOS, make sure you edit /etc/yum.repos.d/annvix.repo and add:

priority = 1

or something suitable. The annvix.org web site will be updated at some point to reflect that Annvix is a repository add-on to RHEL5 now instead of a stand-alone OS.

Upgrading Mandriva 2009.0 to CentOS 5.2

Well, technically speaking, I guess this is a bit of a downgrade. But, since I’m not longer using Mandriva and need to get used to Red Hat products (Fedora, RHEL, etc.), CentOS makes sense for upgrading my internal server to. It was also a long week, so I goofed a bit on it (I did backups of mysql and ldap, but didn’t do dumps of the data which I only realized after the fact… could have been very very bad).

Anyways, the system is a quad core 2 duo system with 8GB RAM. CentOS refused to boot at first until I specified “linux acpi=off”. Downside there is it only got me the use of one core rather than the four. That was later fixed using “pci=nommconf”, which allowed the kernel to boot and got me all four cores.

The install went well. Seems like a lot less to select, and therefore tweak, than the Mandriva installers I’m used to. But it wasn’t bad. Nice thing was it picked up and auto-assembled all my mdadm RAID1 arrays, so I could format those that needed it and left the others alone. Unfortunately, it didn’t fully associate them… after the install when I booted they were in a degraded state so I had to hot-add the second partition for each one.

The real kicker is the placement of files. There are a few places where Mandriva and CentOS differ, like where the named chroot is, so that took some monkeying around with. I also had SELinux in enforcing mode at first, but it didn’t really like the fact that I was using /srv/www/[domain] instead of /var/www/html for serving up web content, and it didn’t like the vhost.d/*.conf bit in httpd.conf so Apache was pretty broken until I disabled SELinux. I’ve never actually used SELinux before, so now I have to learn how to set policies and targets and all that other goodness.

One of the first steps was setting up the rpmforge yum repository. Too much of CentOS is just too dated for me. I need subversion 1.5 (comes with 1.4) and nagios 3.x (comes with 2.x). I was not going to change my nagios configs to suit the older version. rpmforge makes all of that pretty easy though. I did have to copy /var/lib/mysql over and other than changing the ownership of the files to match the new uid/gid for the mysql user, it all worked out great. I have not yet done the openldap setup though, so I’m not sure if I’ll be as lucky with that.

There are still quite a few configuration tweaks to make. It also didn’t help that I had to reset my network from a 10.10 network to a 192.168 network. I’m sure that may still bite me a bit.

Other than that, it all seems to have worked out ok. I was asked why I didn’t just use Fedora for this and while Fedora may be stable enough, I don’t want to have to upgrade every year. That makes CentOS compelling. All this machine does is run nagios to monitor other sites, provide DHCP and DNS services, LDAP for authentication for my virtual machines, web/mysql serving, and does automatic backups of other systems in the LAN. The reason I upgraded from Corporate Server 4.0 to 2009.0 in the first place was the idea that CS5 was going to be based on 2009.0 (so I was getting a jump on things). Time will tell how it goes, but I think it should be ok. Last month I deployed 4 CentOS boxes for a client, with one more left to do, so I’m starting to get a little used to it and yum. =) The SELinux thing may be a bit more work to get used to (I’ve used RSBAC and AppArmor, but never really played with SELinux).

Then tomorrow I’m upgrading a laptop to Fedora 11. That should be interesting. =)