In this guide, we are going to learn how to enforce password complexity policy on CentOS 7/RHEL based derivatives. Our previous guide covered the enforcement of password complexity on Ubuntu 18.04. You can check the same by following the link below;
Similar to our previous guide, we are going to use PAM pwquality modules to enforce password complexity policy on CentOS 7/RHEL based derivatives.
In Ubuntu or Debian based derivatives, we modified the, /etc/pam.d/common-password configuration file. For CentOS 7 or similar derivatives, the /etc/security/pwquality.conf or /etc/pam.d/system-auth configuration file is used.
As our normalcy, make a backup of the configuration file before making changes just in case things go south.
Change file and folder permissions – display or modify Access Control Lists (ACLs) for files and folders. iCACLS resolves various issues that occur when using the older CACLS & XCACLS
Add or remove permissions:
[/T] [/C] [/L] [/Q]
Store ACLs for one or more directories matching name into aclfile for later use with /restore:
ICACLSname/saveaclfile [/T] [/C] [/L] [/Q]
Restore ACLs to all files in directory:
ICACLSdirectory [/substitute SidOld SidNew [...]]
/restoreaclfile [/C] [/L] [/Q]
ICACLSname/setowneruser [/T] [/C] [/L] [/Q]
Find items with an ACL that mentions a specific SID:
ICACLSname/findsidSid [/T] [/C] [/L] [/Q]
Find files whose ACL is not in canonical form or with a length inconsistent with the ACE count:
ICACLSname/verify [/T] [/C] [/L] [/Q]
Replace ACL with default inherited acls for all matching files:
ICACLSname/reset [/T] [/C] [/L] [/Q]
This is equivalent to “Replace all child permission entries with inheritable permission from this object” in the GUI.
name The File(s) or folder(s) the permissions will apply to.
/T Traverse all subfolders to match files/directories. This will apply permission changes to
all subfolders whether or not they are set to inherit permissions from the parent. On very large
directory structures this may take some time as the command has to traverse the entire tree.
/C Continue on file errors (access denied) Error messages are still displayed.
/L Perform the operation on a symbolic link itself, not its target.
/Q Quiet - supress success messages.
/grant :r user:permission
Grant access rights, with :r, the permissions
will replace any previouly granted explicit permissions (for the given user).
Otherwise the permissions are added.
Explicitly deny the specified user access rights.
This will also remove any explicit grant of the
same permissions to the same user.
Remove all occurrences of User from the acl.
:g remove all granted rights to that User/Sid.
:d remove all denied rights to that User/Sid.
e - Enable inheritance
d - Disable inheritance and copy the ACEs
r - Remove all inherited ACEs
Add an integrity ACE to all matching files.
level is one of L,M,H (Low Medium or High)
Mandatory Label\Low Mandatory Level = Low.
Mandatory Label\Medium Mandatory Level = Medium/Standard.
Mandatory Label\High Mandatory Level = Elevated.
If No mandatory label is displayed in the output, it is Medium by default.
A Directory Inheritance option for the integrity ACE can precede the level
and is applied only to directories:
user A user account, Group or a SID
/restore Apply the acls stored in ACLfile to the files in directorypermission is a permission mask and can be specified in one of two forms:
a sequence of simple rights:
D - Delete access
F - Full access (Edit_Permissions+Create+Delete+Read+Write)
N - No access
M - Modify access (Create+Delete+Read+Write)
RX - Read and eXecute access
R - Read-only access
W - Write-only access
a comma-separated list in parentheses of specific rights:
DE - Delete
RC - read control
WDAC - write DAC
WO - write owner
S - synchronize
AS - access system security
MA - maximum allowed
GR - generic read
GW - generic write
GE - generic execute
GA - generic all
RD - read data/list directory
WD - write data/add file
AD - append data/add subdirectory
REA - read extended attributes
WEA - write extended attributes
X - execute/traverse
DC - delete child
RA - read attributes
WA - write attributes
inheritance rights can precede either form and are applied
only to directories:
(OI) - object inherit
(CI) - container inherit
(IO) - inherit only
(NP) - don’t propagate inherit
(I) - Permission inherited from parent container
How to Install and Configure ‘Cache Only DNS Server’ with ‘Unbound’ in RHEL/CentOS 7
Caching name servers using ‘Unbound‘ ( is a validating, recursive, and caching DNS server software ), back in RHEL/CentOS 6.x (where x is version number), we used bind software to configure DNS servers.
Here in this article, we are going to use ‘unbound‘ caching software to install and configure a DNS Server in RHEL/CentOS 7 systems.
Setup Cahing DNS Server in RHEL/CentOS 7
DNS cache servers are used to resolve any DNS query they receive. If the server caches the query and in future the same queries requested by any clients the request will be delivered from DNS ‘unbound‘ cache, this can be done in milliseconds than the first time it resolved.
Caching will only act as a agent to resolve the query of client from any one of the forwarders. Using caching server, will reduce the loading time of webpages by keeping the cache database in unbound server.
My Server and Client Setup
For demonstration purpose, I will be using two systems. The first system will act as a Master(Primary) DNS server and the second system will act as a local DNS client.
Master DNS Server
Operating System : CentOS Linux release 7.0.1406 (Core)
IP Address : 192.168.0.50
Host-name : ns.tecmintlocal.com
Operating System : CentOS 6
IP Address : 192.168.0.100
Host-name : client.tecmintlocal.com
Step 1: Check System Hostname and IP
1. Before setting up a caching DNS server, make sure that you’ve added correct hostname and configured correct static IP address for your system, if not set the system static IP address.
2. After, setting correct hostname and static IP address, you can verify them with the help of following commands.
# ip addr show | grep inet
Step 2: Installing and Configuring Unbound
3. Before installing ‘Unbound’ package, we must update the our system to latest version, after that we can install the unbound package.
# yum update -y
# yum install unbound -y
4. After package has been installed, make a copy of the unbound configuration file before making any changes to original file.
8. Now it’s time to check our DNS cache, by doing a ‘drill’ (query) one ‘india.com‘ domain. At first the ‘drill‘ command results for ‘india.com‘ domain will take some milliseconds, and then do a second drill and have a note on Query time it takes for both drills.
drill india.com @192.168.0.50
Did you see in the above output, the first query taken almost 262 msec to resolve and the second query takes 0 msec to resolve domain (india.com).
That means, the first query gets cached in our DNS Cache, so when we run ‘drill’ second time the query served from our local DNS cache, this way we can improve loading speed of websites.
Step 4: Flush Iptables and Add Firewalld Rules
9. We can’t use both iptables and firewalld at same time on same machine, if we do both will conflict with each other, thus removing ipables rules will be a good idea. To remove or flush the iptables, use the following command.
# iptables -F
10. After removing iptables rules permanently, now add the DNS service to firewalld list permanently.
11. After adding DNS service rules, list the rules and confirm.
# firewall-cmd --list-all
Step 5: Managing and Troubleshooting Unbound
12. To get the current server status, use the following command.
# unbound-control status
Check Unbound DNS Status
Dumping DNS Cache
13. If in-case you would like to have a dump of a DNS cache information in a text file, you can redirect it to some file using below command for future use.
# unbound-control dump_cache > /tmp/DNS_cache.txt
Backup DNS Cache
14. To restore or import the cache from the dumped file, you can use following command.
# unbound-control dump_cache < /tmp/DNS_cache.txt
Restore DNS Cache
Flushing DNS Records
15. To check whether the specific address was resolved by our forwarders in unbound cache Server, use the below command.
# unbound-control lookup google.com
Check DNS Lookup
16. Some times if our DNS cache server will not reply our query, in mean time we can use to flush the cache to remove information such as A, AAA, NS, SO, CNAME, MX, PTR etc.. records from DNS cache. We can remove all information using flush_zone this will remove all informations.
17. To check which forwards are currently used to resolve.
# unbound-control list_forwards
Check Current DNS Forwards
Step 6: Client Side DNS Configuration
18. Here I’ve used a CentOS 6 server as my client machine, IP for this machine is 192.168.0.100 and I’m going to use my unbound DNS server IP (i.e Primary DNS) in it’s interface configuration.
Log-into the Client machine and set the Primary DNS server IP to our unbound server’s IP.
Run the setup command and choose network configuration from TUI network manager.
Then choose DNS configuration, insert the unbound DNS server’s IP as Primary DNS, but here i have used both in Primary and Secondary because I don’t have any other DNS server.
Primary DNS : 192.168.0.50
Secondary DNS : 192.168.0.50
Select Network Configuration
Select DNS Configuration
Enter DNS IP Address
Click OK –> Save&Quit –> Quit.
19. After adding Primary and Secondary DNS IP addresses, now it’s time to restart the network using following command.
# /etc/init.d/network restart
20. Now time to access any one of the website from client machine and check for the cache in unbound DNS server.
# elinks aol.com
# dig aol.com
Earlier we were used to setup DNS cache server using bind package in RHEL and CentOS systems. Now, we have seen how to setup a DNS cache server using unbound package. Hope this will resolve your query request quicker than the bind pacakge.
raised on watched item removing. Probably useless for you, prefer instead IN_DELETE*.
event occurred against directory. It is always piggybacked to an event. The Event structure automatically provide this information (via .is_dir)
to update a mask without overwriting the previous value (lk 2.6.14). Useful when updating a watch.
file was modified.
file/dir in a watched dir was moved from X. Can trace the full move of an item when IN_MOVED_TO is available too, in this case if the moved item is itself watched, its path will be updated (see IN_MOVE_SELF).
file/dir was moved to Y in a watched dir (see IN_MOVE_FROM).
only watch the path if it is a directory (lk 2.6.15). Usable when calling .add_watch.
file was opened.
event queued overflowed. This event doesn’t belongs to any particular watch.
This type of RAID array requires a partition using a GUID (Globally Unique Identifier) Partition Table (GPT) to work properly for Windows in UEFI BIOS mode. Windows Setup, however, does not support making a GPT partition in the standard setup dialogue. Diskpart from the Command Prompt must be used to create a GPT partition to allow setup to see the RAID partition and continue setup.
Start the install, and load the PERC H310 drivers via the OS “Load Diver” function. After the driver is loaded the RAID volume will appear in the install to device list (Figure 1).
Press Shift+F10 to bring up a Command Prompt window.
Type DISKPART and press Enter to enter the DISKPART tool. Enter the commands in the following steps as shown in bold and press enter.
DETAIL DISK – This shows a list of volumes seen by the system. Make note of the Volume number for the RAID array.
SELECT DISK=X – X will be the Volume number of the RAID shown in the detail disk report.
CLEAN – Clears the partition information.
CONVERT GPT – Sets the partition to GPT.
EXIT – Exits DISKPART.
Exit the Command Prompt window.
The full RAID volume should show in the device list.
Complete the remainder of the installation process normally. The RAID volume should show as “Windows Boot Manager” in UEFI.
If this was completed correctly, the system should boot normally in UEFI BIOS mode, and allow Windows to install.
By default IIS will listen for connections on port 80 for any IP
bound to the server. This happens even if there are no host headers or
bindings set for a specific IP. This can be a problem when trying to run
multiple web servers on port 80.
To set IIS to listen on specific IPs follow the instructions below.
Windows Server 2003/IIS 6:
1. This requires the Server 2003 support tools. If this is not already installed it can be downloaded here.
2. Once installed open a command prompt and navigate to the support
tools installation folder (default is C:\Program Files\Support Tools). cd C:\Program Files\Support Tools
3. Stop http. net stop http /y
4. Use this command to display the current list of IPs: httpcfg query iplisten
5. By default it will listen on all IPs (0.0.0.0) so we can remove this. httpcfg delete iplisten -i 0.0.0.0
6. Specify the IP(s) that IIS should listen on. Make sure to update
127.0.0.1 to the desired IP and run the command for each IP IIS should
listen on. httpcfg set iplisten -i 127.0.0.1
7. Start http and test out your sites. net start http
Windows Server 2008/IIS 7:
1. Open a command prompt and type “netsh”. netsh
2. Type “http”. http
3. Enter the following command to display the current list of IPs to
listen on. Note if no IPs are displayed like in the below image, IIS
will listen on all IPs (default). show iplisten
4. Use the command below to set IIS to listen on a specific IP. Make
sure to replace 127.0.0.1 with the correct IP and run the command again
for any additional addresses. add iplisten ipaddress=127.0.0.1
5. In case you need to delete an IP from this list, use the following command. delete iplisten ipaddress=127.0.0.1