this is how we can convert the init based service ftp to an xinetd service..
1) First of all we need to make FTP not to listen on port 21 by making 'listen=NO' in
/etc/vsftpd/vsftpd.conf.
2) Then, make a file named ftp inside /etc/xinetd.d
the contents of /etc/xinetd.d/ftp should look like this
service ftp
{
disable = no
socket_type = stream
wait = no
user = root
server = /usr/sbin/vsftpd
server_args = /etc/vsftpd/vsftpd.conf
nice = 10
flags = IPv4
}
3) then restart the xinetd service by
#/etc/init.d/xinetd restart
#chkconfig xinetd on
now if u 'nmap localhost', u can see that the port 21 is now open...!
Wednesday, September 5, 2007
Tuesday, September 4, 2007
Services - XINETD and INIT
Services in Linux:
------------------
Services in linux are classified into TWO.
XINETD and INIT based services.
XINETD is itself an INIT based service.
All INIT based services are invoked by the command,
#/etc/init.d/service start
XINETD services' configuration file resides in /etc/xinetd.d directory.
All the services are made persistent across reboots by
#chkconfig servicename on , for all init based services.
#chkconfig xinetd on , for all xinetd based services.
XINETD services: e(X)tended (I)(N)tern(E)(T) services (D)aemon
--------------------------------------------------------------
xinetd service is called a super server as it serves as the daemon for a number of seperate services.
For all the services which use xinetd, we need to start the xinetd daemon only. xinetd services' configuration files can be found at /etc/xinetd.d/servicename
All the xinetd services are having the same syntax facilitating the administration of xinetd services very easy.
Extensive logging and fine grained access control can be implemented with xinetd
Xinetd service forks process ids only when a client requests the service.
Only one process is necessary to invoke process ids for individual xinetd services, ie the xinetd super daemon itself.
Logging based on hostname are not supported in XINETD
INIT based services:
--------------------
INIT based services are having individual configuration files under
/etc/service/servicename.
Their starting scripts are placed under /etc/init.d/servicename.
Each individual services can be started by
#/etc/init.d/servicename start
and to sum up... the more the processes .. the lesser the performance of the machine..
so it is advisable to have more xinetd based services than init based ones..!
------------------
Services in linux are classified into TWO.
XINETD and INIT based services.
XINETD is itself an INIT based service.
All INIT based services are invoked by the command,
#/etc/init.d/
XINETD services' configuration file resides in /etc/xinetd.d directory.
All the services are made persistent across reboots by
#chkconfig servicename
#chkconfig xinetd on , for all xinetd based services.
XINETD services: e(X)tended (I)(N)tern(E)(T) services (D)aemon
--------------------------------------------------------------
xinetd service is called a super server as it serves as the daemon for a number of seperate services.
For all the services which use xinetd, we need to start the xinetd daemon only. xinetd services' configuration files can be found at /etc/xinetd.d/service
All the xinetd services are having the same syntax facilitating the administration of xinetd services very easy.
Extensive logging and fine grained access control can be implemented with xinetd
Xinetd service forks process ids only when a client requests the service.
Only one process is necessary to invoke process ids for individual xinetd services, ie the xinetd super daemon itself.
Logging based on hostname are not supported in XINETD
INIT based services:
--------------------
INIT based services are having individual configuration files under
/etc/
Their starting scripts are placed under /etc/init.d/
Each individual services can be started by
#/etc/init.d/
and to sum up... the more the processes .. the lesser the performance of the machine..
so it is advisable to have more xinetd based services than init based ones..!
Monday, September 3, 2007
INODES,LINKS
Inode Table:
All files in linux are having an inode number which is residing inside the inode table of a partition. For every partition there is an inode table, so an inode number will be unique for a partition, and thats the reason why we cannot hardlink between two partitions. Inode number contains a file's uid, gid, access time, modification time, change time and size of the file. inode number DOESNT hold a file's NAME. we can retrieve the contents of a file even if the file is deleted unless and until the inode number corresponding to that file is overwritten.
The inode number can be viewed with the -i switch with the 'ls' command..!
$ls -i filename
softlinks:
softlinks are similar to shortcuts in Microsoft Windows. softlinks' size is determined by the number of characters in the absolute path to the original file it is linking to. Softlinks are apparently having full permissions. Soft links are effective as we can link files among different partitions. If the orignal file is removed ( or renamed )the soft links become dead, meaning softlinks refer only to the NAME of the original file. Soft links will be having a different inode number frm the original file. Soft links cannot be touched (means... their timestamps cannot be updated).
hardlinks:
hardlinks are pointers to the inode number of a file. hardlink will be having the same inode number as that of the original file. The contents will be there in the hardlink if we delete the original file as hardlink points to the same inode number in the inode table. We cannot hardlink between two partitions. same way... we cannot hardlink a directory. if some updates are done in the original file, it is reflected to hardlinks also as the updates are done in the inode number. Hardlink is not at all an overhead as they are pointers to the same inode number.
All files in linux are having an inode number which is residing inside the inode table of a partition. For every partition there is an inode table, so an inode number will be unique for a partition, and thats the reason why we cannot hardlink between two partitions. Inode number contains a file's uid, gid, access time, modification time, change time and size of the file. inode number DOESNT hold a file's NAME. we can retrieve the contents of a file even if the file is deleted unless and until the inode number corresponding to that file is overwritten.
The inode number can be viewed with the -i switch with the 'ls' command..!
$ls -i filename
softlinks:
softlinks are similar to shortcuts in Microsoft Windows. softlinks' size is determined by the number of characters in the absolute path to the original file it is linking to. Softlinks are apparently having full permissions. Soft links are effective as we can link files among different partitions. If the orignal file is removed ( or renamed )the soft links become dead, meaning softlinks refer only to the NAME of the original file. Soft links will be having a different inode number frm the original file. Soft links cannot be touched (means... their timestamps cannot be updated).
hardlinks:
hardlinks are pointers to the inode number of a file. hardlink will be having the same inode number as that of the original file. The contents will be there in the hardlink if we delete the original file as hardlink points to the same inode number in the inode table. We cannot hardlink between two partitions. same way... we cannot hardlink a directory. if some updates are done in the original file, it is reflected to hardlinks also as the updates are done in the inode number. Hardlink is not at all an overhead as they are pointers to the same inode number.
Sunday, September 2, 2007
SSL - Concepts Simplified...!?!!!
Secure Socket Layer:
--------------------
The Secure Socket Layer protocol was first introduced by Netscape to ensure secure transations between
webservers and browsers. The protocol uses a third party Certificate Authority (CA) to identify the both end
of the transactions
SSL philosophy:
---------------
1. Client using some browser requests a secure page (https://www.gmail.com)
2. www.gmail.com sends its public key with its certificate
signed by (Thawte Consulting Pty Limited) (dated: 02/09/2007, 20:48)
3. Our browser checks that the certificate was issued by a trusted party (Thawte here), that the certificate is
still valid and the certificate is related to site we just contacted (www.gmail.com here).
4. The Browser then uses the public key send by www.gmail.com to encrypt some random symmetric
encryption key and sends it to www.gmail.com along with the encrypted URL requested as well as other
encrypted data.
5. www.gmail.com decrypts the encrypted symmetric key send by the browser (in step 4) with its private key and uses this
symmetric key to decrypt the URL and http data.
6. www.gmail.com sends back the requested html data encrypted with the symmetric encrytion key send by the
browser in step 4.
7. Our browser decrypts the http data and html document using symmetric key and displays the information.
With this symmetric key the further communication between www.gmail.com and our browser takes place.
Here asymmetric encryption machanism is taking place between browser and www.gmail.com.
Our browser encrypted some key with public key of www.gmail.com and www.gmail.com on recieval of
this encrypted key, decrypted it with its private key. This mechanisms works with public/private key pairs.
This way www.gmail.com sends its public key to every browser requesting its first page and SSL mechanism
undergoes like the above 7 steps.
--------------------
The Secure Socket Layer protocol was first introduced by Netscape to ensure secure transations between
webservers and browsers. The protocol uses a third party Certificate Authority (CA) to identify the both end
of the transactions
SSL philosophy:
---------------
1. Client using some browser requests a secure page (https://www.gmail.com)
2. www.gmail.com sends its public key with its certificate
signed by (Thawte Consulting Pty Limited) (dated: 02/09/2007, 20:48)
3. Our browser checks that the certificate was issued by a trusted party (Thawte here), that the certificate is
still valid and the certificate is related to site we just contacted (www.gmail.com here).
4. The Browser then uses the public key send by www.gmail.com to encrypt some random symmetric
encryption key and sends it to www.gmail.com along with the encrypted URL requested as well as other
encrypted data.
5. www.gmail.com decrypts the encrypted symmetric key send by the browser (in step 4) with its private key and uses this
symmetric key to decrypt the URL and http data.
6. www.gmail.com sends back the requested html data encrypted with the symmetric encrytion key send by the
browser in step 4.
7. Our browser decrypts the http data and html document using symmetric key and displays the information.
With this symmetric key the further communication between www.gmail.com and our browser takes place.
Here asymmetric encryption machanism is taking place between browser and www.gmail.com.
Our browser encrypted some key with public key of www.gmail.com and www.gmail.com on recieval of
this encrypted key, decrypted it with its private key. This mechanisms works with public/private key pairs.
This way www.gmail.com sends its public key to every browser requesting its first page and SSL mechanism
undergoes like the above 7 steps.
vsFTPd configuration in RHEL 5.0
FTP:
conf file: /etc/vsftpd/vsftpd.conf
Unlike SSH we are having two files to allow/deny users via FTP ( in SSH we did it in the main configuration file itself by AllowUsers/DenyUsers)
The main file for denial is /etc/vsftpd/ftpusers
The other file is /etc/vsftpd/user_list
But if we need to make our FTP check user_list file we need to say it in the main configuration file, like
userlist_enable=YES
If, userlist_enable=NO, ftp doesnt check user_list file
The behaviour of user_list depends upon the declaration inside the vsftpd.conf file
if its declared like,
userlist_deny=YES , those usernames inside user_list is denied even without prompting for a password
if its declared like,
userlist_deny=NO, those in user_list are ONLY allowed to login.
Whatever the behaviour of user_list, FTP searches for ftpusers file for users that are DENIED!
conf file: /etc/vsftpd/vsftpd.conf
Unlike SSH we are having two files to allow/deny users via FTP ( in SSH we did it in the main configuration file itself by AllowUsers/DenyUsers)
The main file for denial is /etc/vsftpd/ftpusers
The other file is /etc/vsftpd/user_list
But if we need to make our FTP check user_list file we need to say it in the main configuration file, like
userlist_enable=YES
If, userlist_enable=NO, ftp doesnt check user_list file
The behaviour of user_list depends upon the declaration inside the vsftpd.conf file
if its declared like,
userlist_deny=YES , those usernames inside user_list is denied even without prompting for a password
if its declared like,
userlist_deny=NO, those in user_list are ONLY allowed to login.
Whatever the behaviour of user_list, FTP searches for ftpusers file for users that are DENIED!
ipv4 to ipv6 and vice-versa...
its been quite a some time that i have started thinking abt switching to ipv6 frm ipv4.... and finally im into configuring an ipv6 dhcp server...
as i was not that good at ipv6... wat i did was to convert the ipv4 addresses to ipv6 using a kool sexy tool available with Red Hat Enterprise editions... 'ipv6calc'
and here it goes...
i need to conver the ipv4 address 172.24.0.7 to ipv6... lets do it now..
$ipv6calc --in ipv4addr 172.24.0.7 --action conv6to4 --out ipv6addr
it will output the ipv6 equivalent of 172.24.0.7
and it will be..
2002:ac18:7::
suppose u want to convert this ipv6 address back to ipv4...
here it goes...
$ipv6calc --in ipv6addr 2002:ac18:7:: --action conv6to4 --out ipv4addr
172.24.0.7
have happy conversions..! :d
~mj0vy
:wq
as i was not that good at ipv6... wat i did was to convert the ipv4 addresses to ipv6 using a kool sexy tool available with Red Hat Enterprise editions... 'ipv6calc'
and here it goes...
i need to conver the ipv4 address 172.24.0.7 to ipv6... lets do it now..
$ipv6calc --in ipv4addr 172.24.0.7 --action conv6to4 --out ipv6addr
it will output the ipv6 equivalent of 172.24.0.7
and it will be..
2002:ac18:7::
suppose u want to convert this ipv6 address back to ipv4...
here it goes...
$ipv6calc --in ipv6addr 2002:ac18:7:: --action conv6to4 --out ipv4addr
172.24.0.7
have happy conversions..! :d
~mj0vy
:wq
Sunday, May 6, 2007
me is serious now..
i wasnt able to log into blogger for quite a sometime ... finally fixed the problem... upgraded to firefox 2.0 and did some tweaking.. now i have foxmarks installed...
well.... today.. 6th of may 2007... me going to start a fresh linux session.... in desperate need to garner some advanced knowledge... will come with all in the blogs frm today onwards...
~mj0vy
:wq
well.... today.. 6th of may 2007... me going to start a fresh linux session.... in desperate need to garner some advanced knowledge... will come with all in the blogs frm today onwards...
~mj0vy
:wq
Subscribe to:
Posts (Atom)
