ISSC System Administraiton - Team LISA

Changing Java keystore passwords...

Sometimes you need to update a KeyStore password - use the following method to complete the process.

First, locate the keystore that you need to modify:
[root@swift cdgrieb]# ls /usr/share/certs/certs/pact.hf.mcarepartners.org.p12
/usr/share/certs/certs/pact.hf.mcarepartners.org.p12

Next, issue the password update command:
[root@swift cdgrieb]# keytool -storepasswd -keystore /usr/share/certs/certs/pact.hf.mcarepartners.org.p12 -storetype pkcs12
Enter keystore password:
New keystore password:
Re-enter new keystore password:

Note: remember to specific the keystore type (wit the -storetype pkcs12 switch), unless you're using the standard format. Otherwise, it'll fail.

Enumerate protocols and ciphers for Tomcat

By default, Tomcat instances configured for SSL will accept pretty much any secured cipher, which, obvously, this not always optimal. Use the following method to insure AES 128 or AES 256.

First, insure that a protocol is specified within the connector block, for example:
sslProtocol="TLS"

Next, add your cipher specifications:
ciphers="TLS_DHE_DSS_WITH_AES_256_CBC_SHA,
TLS_DHE_RSA_WITH_AES_256_CBC_SHA,
TLS_DHE_DSS_WITH_AES_128_CBC_SHA,
TLS_DHE_RSA_WITH_AES_128_CBC_SHA"

Finally, restart Tomcat. You should have enforced AES 128/256.

Agent based system monitoring vs external monitoring...

Some of the drawbacks associated with external monitoring (basically, pointing a monitor at a server and attempting to extract data) are lack of monitor consolidation and inability to pull detailed system information. Agent-based monitoring solves the above listed issues by relying on an internal system agent that retains the ability to pull detailed system data. A few agent based monitoring systems including Monitor.us and Nagios.

System Administration - monitoring and Manage Engine...

There are a lot of really nice components associated with Appmanager, including highly detailed SNMP monitoring, web traffic analysis, and extensive notification options. However, the service is still managed locally, and is susceptible data center availability. As a result, the SA team is exploring the possibility of cloud based, agent monitoring options such as Monitor.us.

iptables: redirecting ports

Generally, the preferred method to redirect in-bound traffic on port 80 to port 8080 is to utilize NAT/firewall rules (iptables, specifically). Use the following method to complete the process...

IPTABLES=`which iptables`
$IPTABLES --flush
$IPTABLES -P INPUT ACCEPT
$IPTABLES -P OUTPUT ACCEPT
$IPTABLES -P FORWARD DROP

$IPTABLES -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT

# Accept everything from the local interface
$IPTABLES -A INPUT -i lo -j ACCEPT

# Accept traffic on port 80
$IPTABLES -A INPUT -p tcp --dport 80 -j ACCEPT
# Accept traffic on port 8080
$IPTABLES -A INPUT -p tcp --dport 8080 -j ACCEPT
# Accept ssh traffice
$IPTABLES -A INPUT -p tcp --dport 22 -j ACCEPT

# Local redirect
$IPTABLES -t nat -A OUTPUT -o lo -p tcp --dport 80 -j REDIRECT --to-port 8080
# Actual 80 to 8080 redirect
$IPTABLES -t nat -A PREROUTING -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 8080

# Save the configuration
IPTABLES_SAVE=`which iptables-save`
if [ -d "/etc/sysconfig" ]
then
$IPTABLES_SAVE > /etc/sysconfig/iptables
fi

iptables: method to simply block Ping requests...

Sometimes a system administrator would simply like to block out all incoming ping requests - issue the following command in order to adjust iptables for this functionality:

/sbin/iptables -I INPUT -j DROP -p icmp --icmp-type echo-request

(this reads drop all input of protocol type icmp, specifically echo-request).

Then to drop the rule, simply obtain the index number of the iptables rule:

/sbin/iptables -L INPUT --line-numbers
Chain INPUT (policy ACCEPT)
num target prot opt source destination
1 DROP icmp -- anywhere anywhere icmp echo-request

(the block ICMP request in number 1)

Drop the entry:

/sbin/iptables -D INPUT 1

Apache - multiple virtual hosts on *80

When you have multiple virtual hosts on port *80, you need to specific a virtual host name, for example, at the very top of your virtual host configuration file, add an entry that states:
NameVirtualHost *:80

Otherwise, you'll receive the following warning:
"[warn] _default_ VirtualHost overlap on port 80, the first has precedence"

SA Lisa morning meetings - 07-13-2012

Meeting notes from the weekly Lisa group meeting are listed in the link below:
https://wiki.umms.med.umich.edu/x/WgSTBw

Highlights include:
- Finalizing personal goals
- Training
- VM checklists for Linux

Setting the default umask for web-content...

One of the issues we've had with multiple users managing web-content and directory permissions is related to properly setting umask, specifically modifying the default RHEL6 umask value of 022 (022 only allows for group reading) - this causes significant problems when multiple individuals are managing content. We've side-stepped this problem by simply setting default umask values within the various login shell profiles, for example:

[root@winterberry /home]# vim /home/cdgrieb/.cshrc
umask 002

(for bash)
[root@winterberry /home]# vim /home/cdgrieb/.bash_profile
umask 002

A default value of 002 allows for owner/group reading/writing, which makes managing multiple web-based users significantly easier to deal with.

SA Lisa Team communications standards UPDATED

We've updated the SA Lisa Team communication standards document, which can be located here: https://wiki.umms.med.umich.edu/x/xJiABw

SA Lisa - VM deployment checklist Linux

We started the process of creating our VM deployment check-list, including insurance of documentation creation, RHN registering, and account management, with the eventual goal of automating the entire process. More information soon!

Link:https://wiki.umms.med.umich.edu/x/EReTBw

Virtual CORE stand alone image

I've created a stand alone virtual CORE image that can be used in VM Fusion. All the details can be found here on this confluence page, https://wiki.umms.med.umich.edu/x/8wuTBw

Apache - disabling HTTP TRACE / TRACK

In order to resolve trace / track security issued related to Apache, simply append the following Rewrite rule to the Apache configuration file:
RewriteEngine On
RewriteCond %{REQUEST_METHOD} ^(TRACE|TRACK)
RewriteRule .* - [F]

and restart the server. Done.

Managing WordPress blogs

Currently, ISSC hosts a number of WordPress-based blogs for various organizations, including EVPMA, MICHR, etc. One of the numerous issues we've encountered with hosting these blogs including managing plugins, themes, access, and blog migrations. In order to resolve this issue, we've started looking into various blog management tools, including RHN, in-house development tools (scripts, etc), and cloud-based utilities. One example of a WordPress tool we've looked into is https://managewp.com - currently, we have a dedicated system administrator researching functionality, etc. More information soon!

SA Lisa Team Goals interation 2

We've started the second phase of the Lisa team goals, which include the following ideas/concepts:
- Internal presentations
- Assistance with other ISSC groups
- Continued training
We'll have updates when other Lisa members have contributed to the effort. In the meantime, feel free to have a look at our existing page that lists our goals: https://wiki.umms.med.umich.edu/x/sJCABw