In this guide, we are going to learn how to enforce password complexity policy on CentOS 7/RHEL based derivatives. Our previous guide covered the enforcement of password complexity on Ubuntu 18.04. You can check the same by following the link below;
Similar to our previous guide, we are going to use PAM pwquality modules to enforce password complexity policy on CentOS 7/RHEL based derivatives.
In Ubuntu or Debian based derivatives, we modified the, /etc/pam.d/common-password configuration file. For CentOS 7 or similar derivatives, the /etc/security/pwquality.conf or /etc/pam.d/system-auth configuration file is used.
As our normalcy, make a backup of the configuration file before making changes just in case things go south.
Change file and folder permissions – display or modify Access Control Lists (ACLs) for files and folders. iCACLS resolves various issues that occur when using the older CACLS & XCACLS
Syntax
Add or remove permissions:
ICACLSName
[/grant[:r] User:Permission[...]]
[/denyUser:Permission[...]]
[/remove[:g|:d]] User[...]]
[/inheritance:e|d|r ]
[/setintegritylevelLevel[...]]
[/T] [/C] [/L] [/Q]
Store ACLs for one or more directories matching name into aclfile for later use with /restore:
ICACLSname/saveaclfile [/T] [/C] [/L] [/Q]
Restore ACLs to all files in directory:
ICACLSdirectory [/substitute SidOld SidNew [...]]
/restoreaclfile [/C] [/L] [/Q]
Change Owner:
ICACLSname/setowneruser [/T] [/C] [/L] [/Q]
Find items with an ACL that mentions a specific SID:
ICACLSname/findsidSid [/T] [/C] [/L] [/Q]
Find files whose ACL is not in canonical form or with a length inconsistent with the ACE count:
ICACLSname/verify [/T] [/C] [/L] [/Q]
Replace ACL with default inherited acls for all matching files:
ICACLSname/reset [/T] [/C] [/L] [/Q]
This is equivalent to “Replace all child permission entries with inheritable permission from this object” in the GUI.
Key
name The File(s) or folder(s) the permissions will apply to.
/T Traverse all subfolders to match files/directories. This will apply permission changes to
all subfolders whether or not they are set to inherit permissions from the parent. On very large
directory structures this may take some time as the command has to traverse the entire tree.
/C Continue on file errors (access denied) Error messages are still displayed.
/L Perform the operation on a symbolic link itself, not its target.
/Q Quiet - supress success messages.
/grant :r user:permission
Grant access rights, with :r, the permissions
will replace any previouly granted explicit permissions (for the given user).
Otherwise the permissions are added.
/deny user:permission
Explicitly deny the specified user access rights.
This will also remove any explicit grant of the
same permissions to the same user.
/remove[:[g|d]] User
Remove all occurrences of User from the acl.
:g remove all granted rights to that User/Sid.
:d remove all denied rights to that User/Sid.
/inheritance:e|d|r
e - Enable inheritance
d - Disable inheritance and copy the ACEs
r - Remove all inherited ACEs
/setintegritylevel [(CI)(OI)]Level
Add an integrity ACE to all matching files.
level is one of L,M,H (Low Medium or High)
Mandatory Label\Low Mandatory Level = Low.
Mandatory Label\Medium Mandatory Level = Medium/Standard.
Mandatory Label\High Mandatory Level = Elevated.
If No mandatory label is displayed in the output, it is Medium by default.
A Directory Inheritance option for the integrity ACE can precede the level
and is applied only to directories:
user A user account, Group or a SID
/restore Apply the acls stored in ACLfile to the files in directorypermission is a permission mask and can be specified in one of two forms:
a sequence of simple rights:
D - Delete access
F - Full access (Edit_Permissions+Create+Delete+Read+Write)
N - No access
M - Modify access (Create+Delete+Read+Write)
RX - Read and eXecute access
R - Read-only access
W - Write-only access
a comma-separated list in parentheses of specific rights:
DE - Delete
RC - read control
WDAC - write DAC
WO - write owner
S - synchronize
AS - access system security
MA - maximum allowed
GR - generic read
GW - generic write
GE - generic execute
GA - generic all
RD - read data/list directory
WD - write data/add file
AD - append data/add subdirectory
REA - read extended attributes
WEA - write extended attributes
X - execute/traverse
DC - delete child
RA - read attributes
WA - write attributes
inheritance rights can precede either form and are applied
only to directories:
(OI) - object inherit
(CI) - container inherit
(IO) - inherit only
(NP) - don’t propagate inherit
(I) - Permission inherited from parent container
Version:1.0
StartHTML:000000222
EndHTML:000042418
StartFragment:000012983
EndFragment:000042312
StartSelection:000012983
EndSelection:000042308
SourceURL:https://www.tecmint.com/setup-dns-cache-server-in-centos-7/
How to Install and Configure ‘Cache Only DNS Server’ with ‘Unbound’ in RHEL/CentOS 7
Caching name servers using ‘Unbound‘ ( is a validating, recursive, and caching DNS server software ), back in RHEL/CentOS 6.x (where x is version number), we used bind software to configure DNS servers.
Here in this article, we are going to use ‘unbound‘ caching software to install and configure a DNS Server in RHEL/CentOS 7 systems.
Setup Cahing DNS Server in RHEL/CentOS 7
DNS cache servers are used to resolve any DNS query they receive. If the server caches the query and in future the same queries requested by any clients the request will be delivered from DNS ‘unbound‘ cache, this can be done in milliseconds than the first time it resolved.
Caching will only act as a agent to resolve the query of client from any one of the forwarders. Using caching server, will reduce the loading time of webpages by keeping the cache database in unbound server.
My Server and Client Setup
For demonstration purpose, I will be using two systems. The first system will act as a Master(Primary) DNS server and the second system will act as a local DNS client.
Master DNS Server
Operating System : CentOS Linux release 7.0.1406 (Core)
IP Address : 192.168.0.50
Host-name : ns.tecmintlocal.com
Client Machine
Operating System : CentOS 6
IP Address : 192.168.0.100
Host-name : client.tecmintlocal.com
Step 1: Check System Hostname and IP
1. Before setting up a caching DNS server, make sure that you’ve added correct hostname and configured correct static IP address for your system, if not set the system static IP address.
2. After, setting correct hostname and static IP address, you can verify them with the help of following commands.
# hostnamectl
# ip addr show | grep inet
Check IP Address
Step 2: Installing and Configuring Unbound
3. Before installing ‘Unbound’ package, we must update the our system to latest version, after that we can install the unbound package.
# yum update -y
# yum install unbound -y
4. After package has been installed, make a copy of the unbound configuration file before making any changes to original file.
5. Next, use any of your favorite text editor to open and edit ‘unbound.conf‘ configuration file.
# vim /etc/unbound/unbound.conf
Copy Unbound DNS Configuration
Once the file is opened for editing, make the following changes:
Interfaces
Search for Interface and enable the interface which we going to use or if our server have multiple interfaces we have to enable the interface 0.0.0.0.
Here Our server IP was 192.168.0.50, So, i’am going to use unbound in this interface.
Interface 192.168.0.50
Enable IPv4 and Protocol Supports
Search for the following string and make it ‘Yes‘.
do-ip4: yes
do-udp: yes
do-tcp: yes
Enable the logging
To enable the log, add the variable as below, it will log every unbound activities.
logfile: /var/log/unbound
Hide Identity and Version
Enable following parameter to hide id.server and hostname.bind queries.
hide-identity: yes
Enable following parameter to hide version.server and version.bind queries.
hide-version: yes
Access Control
Then search for access-control to allow. This is to allow which clients are allowed to query this unbound server.
Here I have used 0.0.0.0, that means anyone send query to this server. If we need to refuse query for some range of network we can define which network need to be refuse from unbound queries.
access-control: 0.0.0.0/0 allow
Note: Instead of allow, we can replace it with allow_snoop this will enable some additional parameters like dig and it support both recursive and non recursive.
Domain Insecure
Then search for domain-insecure. If our domain is works with DNS sec keys, we need to define our server available for domain-insecure. Here our domain will be treated as insecure.
domain-insecure: "tecmintlocal.com
Forward Zones
Then change the forwarders for our requested query not fulfilled by this server it will forward to root domain (. ) and resolve the query.
8. Now it’s time to check our DNS cache, by doing a ‘drill’ (query) one ‘india.com‘ domain. At first the ‘drill‘ command results for ‘india.com‘ domain will take some milliseconds, and then do a second drill and have a note on Query time it takes for both drills.
drill india.com @192.168.0.50
Check DNS Cache Locally
Did you see in the above output, the first query taken almost 262 msec to resolve and the second query takes 0 msec to resolve domain (india.com).
That means, the first query gets cached in our DNS Cache, so when we run ‘drill’ second time the query served from our local DNS cache, this way we can improve loading speed of websites.
Step 4: Flush Iptables and Add Firewalld Rules
9. We can’t use both iptables and firewalld at same time on same machine, if we do both will conflict with each other, thus removing ipables rules will be a good idea. To remove or flush the iptables, use the following command.
# iptables -F
10. After removing iptables rules permanently, now add the DNS service to firewalld list permanently.
11. After adding DNS service rules, list the rules and confirm.
# firewall-cmd --list-all
Add DNS to Firewalld
Step 5: Managing and Troubleshooting Unbound
12. To get the current server status, use the following command.
# unbound-control status
Check Unbound DNS Status
Dumping DNS Cache
13. If in-case you would like to have a dump of a DNS cache information in a text file, you can redirect it to some file using below command for future use.
# unbound-control dump_cache > /tmp/DNS_cache.txt
Backup DNS Cache
14. To restore or import the cache from the dumped file, you can use following command.
# unbound-control dump_cache < /tmp/DNS_cache.txt
Restore DNS Cache
Flushing DNS Records
15. To check whether the specific address was resolved by our forwarders in unbound cache Server, use the below command.
# unbound-control lookup google.com
Check DNS Lookup
16. Some times if our DNS cache server will not reply our query, in mean time we can use to flush the cache to remove information such as A, AAA, NS, SO, CNAME, MX, PTR etc.. records from DNS cache. We can remove all information using flush_zone this will remove all informations.
17. To check which forwards are currently used to resolve.
# unbound-control list_forwards
Check Current DNS Forwards
Step 6: Client Side DNS Configuration
18. Here I’ve used a CentOS 6 server as my client machine, IP for this machine is 192.168.0.100 and I’m going to use my unbound DNS server IP (i.e Primary DNS) in it’s interface configuration.
Log-into the Client machine and set the Primary DNS server IP to our unbound server’s IP.
Run the setup command and choose network configuration from TUI network manager.
Then choose DNS configuration, insert the unbound DNS server’s IP as Primary DNS, but here i have used both in Primary and Secondary because I don’t have any other DNS server.
Primary DNS : 192.168.0.50
Secondary DNS : 192.168.0.50
Select Network Configuration
Select DNS Configuration
Enter DNS IP Address
Click OK –> Save&Quit –> Quit.
19. After adding Primary and Secondary DNS IP addresses, now it’s time to restart the network using following command.
# /etc/init.d/network restart
Restart Network
20. Now time to access any one of the website from client machine and check for the cache in unbound DNS server.
# elinks aol.com
# dig aol.com
Check Website
Query Website
Conclusion
Earlier we were used to setup DNS cache server using bind package in RHEL and CentOS systems. Now, we have seen how to setup a DNS cache server using unbound package. Hope this will resolve your query request quicker than the bind pacakge.
raised on watched item removing. Probably useless for you, prefer instead IN_DELETE*.
IN_ISDIR
No
event occurred against directory. It is always piggybacked to an event. The Event structure automatically provide this information (via .is_dir)
IN_MASK_ADD
No
to update a mask without overwriting the previous value (lk 2.6.14). Useful when updating a watch.
IN_MODIFY
Yes
file was modified.
IN_MOVE_SELF
Yes
自移动，即一个可执行文件在执行时移动自己
IN_MOVED_FROM
Yes
file/dir in a watched dir was moved from X. Can trace the full move of an item when IN_MOVED_TO is available too, in this case if the moved item is itself watched, its path will be updated (see IN_MOVE_SELF).
IN_MOVED_TO
Yes
file/dir was moved to Y in a watched dir (see IN_MOVE_FROM).
IN_ONLYDIR
No
only watch the path if it is a directory (lk 2.6.15). Usable when calling .add_watch.
IN_OPEN
Yes
file was opened.
IN_Q_OVERFLOW
Yes
event queued overflowed. This event doesn’t belongs to any particular watch.
This type of RAID array requires a partition using a GUID (Globally Unique Identifier) Partition Table (GPT) to work properly for Windows in UEFI BIOS mode. Windows Setup, however, does not support making a GPT partition in the standard setup dialogue. Diskpart from the Command Prompt must be used to create a GPT partition to allow setup to see the RAID partition and continue setup.
Figure 1
Start the install, and load the PERC H310 drivers via the OS “Load Diver” function. After the driver is loaded the RAID volume will appear in the install to device list (Figure 1).
Press Shift+F10 to bring up a Command Prompt window.
Type DISKPART and press Enter to enter the DISKPART tool. Enter the commands in the following steps as shown in bold and press enter.
DETAIL DISK – This shows a list of volumes seen by the system. Make note of the Volume number for the RAID array.
SELECT DISK=X – X will be the Volume number of the RAID shown in the detail disk report.
CLEAN – Clears the partition information.
CONVERT GPT – Sets the partition to GPT.
EXIT – Exits DISKPART.
Exit the Command Prompt window.
The full RAID volume should show in the device list.
Complete the remainder of the installation process normally. The RAID volume should show as “Windows Boot Manager” in UEFI.
If this was completed correctly, the system should boot normally in UEFI BIOS mode, and allow Windows to install.
By default IIS will listen for connections on port 80 for any IP
bound to the server. This happens even if there are no host headers or
bindings set for a specific IP. This can be a problem when trying to run
multiple web servers on port 80.
To set IIS to listen on specific IPs follow the instructions below.
Windows Server 2003/IIS 6:
1. This requires the Server 2003 support tools. If this is not already installed it can be downloaded here.
2. Once installed open a command prompt and navigate to the support
tools installation folder (default is C:\Program Files\Support Tools). cd C:\Program Files\Support Tools
3. Stop http. net stop http /y
4. Use this command to display the current list of IPs: httpcfg query iplisten
5. By default it will listen on all IPs (0.0.0.0) so we can remove this. httpcfg delete iplisten -i 0.0.0.0
6. Specify the IP(s) that IIS should listen on. Make sure to update
127.0.0.1 to the desired IP and run the command for each IP IIS should
listen on. httpcfg set iplisten -i 127.0.0.1
7. Start http and test out your sites. net start http
Windows Server 2008/IIS 7:
1. Open a command prompt and type “netsh”. netsh
2. Type “http”. http
3. Enter the following command to display the current list of IPs to
listen on. Note if no IPs are displayed like in the below image, IIS
will listen on all IPs (default). show iplisten
4. Use the command below to set IIS to listen on a specific IP. Make
sure to replace 127.0.0.1 with the correct IP and run the command again
for any additional addresses. add iplisten ipaddress=127.0.0.1
5. In case you need to delete an IP from this list, use the following command. delete iplisten ipaddress=127.0.0.1
