Anonymous FTP server on RHEL6 with SELinux enforcing

Alternate solutions

• RHEL6 vsftp anonymous access selinux

Outline of Steps

1. Create a new filesystem for the ftp server.
2. Set the SELinux context.
3. Install the ftp server.
4. Configure the server. 
5. Change the ftp user's home directory to the new filesystem.
6. Add iptables rules.
7. Start the firewall on boot.
8. Restart the firewall.
9. Start the FTP server on boot.
10. Start the FTP server now.

lvcreate -L 30G -n FTP HelpDeskRHEL6
mkfs.ext4 -m0 -L FTP /dev/mapper/HelpDeskRHEL6-FTP
mkdir /ftp
echo 'LABEL=FTP /ftp ext4 defaults 1 3' >> /etc/fstab
mount /ftp
mkdir /ftp/public
cd /ftp/public
mkdir upload Documentation InstallMedia kickstart

yum install policycoreutils-python
semanage fcontext -a -t public_content_t /ftp
# stepping over the "lost+found" directory at the top of the /ftp filesystem
semanage fcontext -a -t public_content_t '/ftp/pub(/.*)?'
semanage fcontext -a -t public_content_rw_t '/ftp/pub/upload(/.*)?'
restorecon -R -v '/ftp'
ls -alZ /ftp
setsebool -P allow_ftpd_anon_write=1

yum install vsftpd

cp /usr/share/doc/vsftpd-*/EXAMPLE/INTERNET_SITE_NOINETD/vsftpd.conf /etc/vsftpd/vsftpd.conf
Adjust the values if necessary.  In my case I changed the following:

max_clients=10
write_enable=YES
anon_upload_enable=YES
anon_mkdir_write_enable=YES
anon_other_write_enable=YES
anon_umask=022
anon_max_rate=0
anon_umask=022

usermod -d /ftp/pub ftp


Load the FTP conneciton tracking module for iptables in the file /etc/sysconfig/iptables-config

IPTABLES_MODULES=”ip_conntrack_ftp”

Add the firewall rule to allow "active" FTP connecitons in the file /etc/sysconfig/iptables

-A INPUT -m state –state NEW -m tcp -p tcp –dport 21 -j ACCEPT

chkconfig iptables on

service iptables restart

chkconfig vsftpd on
service vsftpd start

Dia to PDF

Using Dia version 0.97.1

• Postscript to PDF 

When creating landscape network diagrams I found that when converting to PDF with 'ps2pdf'. 

There are 2 problems:

1. The '.eps' file still has "PORTRAIT" on the "ORIENTATION" line. Change this to "LANDSCAPE".
2. The diagram needs "cropping" to make it fit the page properly.
   
   

   ps2pdf -dEPSCrop network.eps

Customise your Fedora17 Desktop experience

Thanks to the following posts, at the bottom, I found out about dconf-editor and gnome-tweak-tool.  Now I can configure those things that had been annoying me with the new simplified Gnome experience.

• yum install dconf-editor gnome-tweak-tool
• gnome-tweak-tool
• dconf-editor

While dconf-editor has a lot more stuff a few changes did not activate but they did using gnome-tweak-tool.  See how you go.  There is also a lot of other good advice on the 2nd  link.


References: 

• http://askubuntu.com/questions/129985/how-to-make-the-date-appear-next-to-the-time-indicator-in-gnome-classic
• http://smashingweb.info/fedora-17-post-installation-guide-things-to-do-after-installing-fedora-17/

Building Handbrake on Fedora 17

References:

• https://trac.handbrake.fr/wiki/CompileOnLinux

Commands:

1. yum groupinstall "Development Tools" "Development Libraries" "X Software Development" "GNOME Software Development"

2. yum install yasm zlib-devel bzip2-devel fribidi-devel dbus-glib-devel libgudev1-devel webkitgtk-devel libnotify-devel gstreamer-devel gstreamer-plugins-base-devel

Kickstart Fedora 17 from Spacewalk

References

• https://fedorahosted.org/spacewalk/wiki/HowToKickstartCobbler
• https://fedorahosted.org/spacewalk/wiki/ManagingFedoraSystems

Kickstart with registration to Spacewalk

Fedora 17 has some 26,000 packages on the Base Channel.  The Distribution Tree's repodata, as supplied by a DVD ISO image, has a few thousand.  Guess what:

1. there are four packages required as dependencies of Spacewalk-client v1.7 that are not on the standard DVD ISO!
2. the packages on the Base Channel from spacewalk are not accessible during a kickstart because the repodata for the base channel is supplied externally from Spacewalk, the Distro-Tree.  However, child channels' repodata are available during a kickstart.  Who designs this rubbish?

The solution is to create a new "child channel" of the Fedora 17 Base Channel in your spacewalk server.  The name is irrelevant but it seems to be convention to put "-tools" in its name.  Once you have your empty child channel add the following four packages from the parent/base channel.  Essentially these four packages will be frozen in time so even as the parent channel receives updates the child channel will not, unless compare the parent and child and promote the updates into the child channel manually.

• m2crypto
• python-dmidecode
• python-gudev
• python-hwdata

I also had to add a few packages manually to the kickstart's package list that were not being installed for me even though spacewalk had put instructions into the kickstart to use some of the commands from these packages.  Maybe I had another issue but I don't think so.  So manually add the following packages to the kickstart software packages list:

• rhn-client-tools
• rhn-setup

Distro-Trees

In regard to "distro-trees" you need some files from three directories from the DVD ISO image, at least for Fedora17.  This is a huge space saver.  It is strange that we have to use the metadata from a static DVD image.  However I understand the requirement from vmlinuz, initrd.img and squashfs.img.

• images/pxeboot/vmlinuz
• images/pxeboot/initrd.img
• LiveOS/squashfs.img
• repodata/*
  

Spacewalk Profile Re-connect option

If you enable "Re-connect to the existing system profile. Do not create a new system profile." in a kickstart profile under System Details -> Details -> Spacewalk Profile then your brand new system will fail to register on the first kickstart.  Manually register it once and from then on it will continue using the existing profile.

sha512 password hashes for /etc/shadow

cat passwd_hash_sha512.pl

#!/usr/bin/perl
#===============================================================================
#
# FILE: passwd_hash_sha512.pl
#
# USAGE: ./passwd_hash_sha512.pl
#
# DESCRIPTION: Generate the password hash for /etc/shadow using the sha512 algorithim.
#
# OPTIONS: ---
# REQUIREMENTS: ---
# BUGS: ---
# NOTES: ---
# AUTHOR: Andrew Spurrier,
# COMPANY:
# VERSION: 1.0
# CREATED: 11/06/12 21:00:15
# REVISION: ---
#===============================================================================

use strict;
use warnings;

my $salt = join "", (".", "/", 0..9, "A".."Z", "a".."z")[rand 64, rand 64, rand 64, rand 64];
my $pass1;
my $pass2;


$salt="\$6\$$salt\$";
print "$salt\n";

# request and verify the password from the user.
system "stty -echo";
print "The following password will be converted into a hash using sha512. The output is suitable for /etc/shadow.\n";
print "Password: ";
chomp($pass1 = <stdin>);
print "\n";
print "Verify: ";
chomp($pass2 = <stdin>);
print "\n";
system "stty echo";

if ($pass1 ne $pass2)
{
print "The passwords did not match.\n";
exit 1;
}

print "Password Hash is: ";
print crypt($pass1, $salt) . "\n";

exit 0;

Spacewalk and RHEL6

Register RHEL6 client with Spacewalk

Reference:

• http://linuxinternetworks.com/register-clients-in-spacewalk/ 

Instructions

1. First set a couple of variables to help the following instructions work with more versions:
   

   BASE_ARCH=$(uname -i)
   BASE_REL=$(sed -e '/.*release /s///' -e 's/\..*//' /etc/redhat-release)

2. Install the Space walk client for your architecture:
   

   rpm -Uvh http://spacewalk.redhat.com/yum/1.7/RHEL/$BASE_REL/$BASE_ARCH/spacewalk-client-repo-1.7-5.el$BASE_REL.noarch.rpm
   wget --directory-prefix=/tmp ftp://mirror.optus.net/epel/$BASE_REL/$BASE_ARCH/epel-release*.noarch.rpm && rpm -Uvh /tmp/epel-release*.noarch.rpm

3. Install the client packages:
   

   yum install rhn-client-tools rhn-check rhn-setup rhnsd m2crypto yum-rhn-plugin

4. Register the client:
   

   rhnreg_ks --serverUrl=https://<fqn_spacewalk_server>/XMLRPC --activationkey=1-<activation_key_label>

Install Spacewalk on RHEL6

Links

• https://fedorahosted.org/spacewalk/wiki/HowToInstall

Instructions

wget rpm -Uvh http://spacewalk.redhat.com/yum/1.7/RHEL/6/x86_64/spacewalk-repo-1.7-5.el6.noarch.rpm