Oracle Linux/Quick Reference

yum

update repo cache (agt-get update equivalent)

~$ yum check-update

update all packages

~$ yum update

install software

~$ yum install lynx

search for software

~$ yum search apache

remove software

~$ yum remove lynx

search for package by command

~$ yum whatprovides dig

search for installed packages

~$ yum list installed | grep nfs-utils

show available versions from repo with their details

~$ yum -v list nfs-utils --show-duplicates 

Add user & add to sudoers

add user

~$ useradd user

you can also add the user, define their home directory, and add them to a group in one line.

~$ useradd username -d <user_home_dir_path> -G <group_names>

set password for user

~$ passwd user

add to sudoers

~$ visudo
...
user ALL=(ALL) ALL

or use the wheel group. Uncomment it:

## Allow people in the group wheel to run all commands
%wheel     ALL=(ALL)     ALL

Add user to the group

~$ sudo usermod -a -G [group] [user]
i.e. sudo usermod -a -G sudo Joe

check to verify they are part of the group
~$ getent group sudo
sudo:x:27:Bob,Joe

Remove a user from a group

~$ sudo gpasswd -d user group

permissions

Permissions	Owner	Group	Others
777	rwx	rwx	rwx
666	rw-	rw-	rw-
555	r-x	r-x	r-x
444	r--	r--	r--
333	-wx	-wx	-wx
222	-w-	-w-	-w-
111	--x	--x	--x
000	---	---	---

determine packages installed & search

~$ rpm -qa | less | grep term

configure date/time

~$ sudo date -s "2 OCT 2006 18:00:00"

netstat

determine gateway

~$ netstat -nr
Kernel IP routing table
Destination     Gateway         Genmask         Flags   MSS Window  irtt Iface
0.0.0.0         10.45.9.1       0.0.0.0         UG        0 0          0 eth0
10.45.9.0       0.0.0.0         255.255.255.0   U         0 0          0 eth0
169.254.0.0     0.0.0.0         255.255.0.0     U         0 0          0 eth0

selinux

Basics

Users

selinux has a set of pre-built users which linux user accounts can be mapped to one or more of.

Roles

roles are like filters which sit between a user and a process. they define which users can access that process. users can enter or assume a role at any time if the role grants it.

Subjects

a process is called a subject and can affect objects

Objects

any requested resource is an object, such as files, directories, ports, tcp sockets, cursor, etc.

Permissions

the actions that a subject (process) can perform on an object.

Domains

the context within which an selinux subject can run, like a wrapper. a domain can define what files, dirs, links, devices, ports, etc are accessible to the subject.

Types

the context for a file's context that stipulates the file's purpose, such as its meant for certain processes or belongs to a certain directory, or is owned by certain selinux user

security context

ls -Z shows the selinux security context of a process or file/dir. mls is hidden by default.

user:role:type:mls
ie. 
ls -Z /var/www/html/index.html  
-rw-r--r--  username username system_u:object_r:httpd_sys_content_t /var/www/html/index.html

Check Status

~$ $ sestatus
SELinux status:                 enabled
SELinuxfs mount:                /sys/fs/selinux
SELinux root directory:         /etc/selinux
Loaded policy name:             targeted
Current mode:                   enforcing
Mode from config file:          enforcing
Policy MLS status:              enabled
Policy deny_unknown status:     allowed
Max kernel policy version:      31

disable

temporarily disable

~$ setenforce 0
or
~$ setenforce Permissive

permanently disable

~$ /etc/selinux/config
 change SELinux=enforcing to SELinux=disabled

Restore labels in filesystem

In case you need to restore all the labels in the entire filesystem, here you go

~$ sudo restorecon -Rv /

Check audit log

Show denials within the last 10 minutes. use today instead of recent to show the entire day.

~$ sudo ausearch -m AVC,USER_AVC,SELINUX_ERR -ts recent

time->Thu Jan  3 15:18:56 2019
type=PROCTITLE msg=audit(1546546736.770:592): proctitle=2F7573722F6C69622F6A766D2F6A72652F62696E2F6A617661002D636C61737370617468002F7573722F73686172652F746F6D6361742F62696E2F626F6F7473747261702E6A61723A2F7573722F73686172652F746F6D6361742F62696E2F746F6D6361742D6A756C692E6A61723A2F7573722F73686172652F6A6176612F63
type=SYSCALL msg=audit(1546546736.770:592): arch=c000003e syscall=83 success=no exit=-13 a0=7fd3d42251f0 a1=1ff a2=0 a3=7fd3dd052780 items=0 ppid=1 pid=6200 auid=4294967295 uid=53 gid=53 euid=53 suid=53 fsuid=53 egid=53 sgid=53 fsgid=53 tty=(none) ses=4294967295 comm="java" exe="/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.191.b12-1.el7_6.x86_64/jre/bin/java" subj=system_u:system_r:tomcat_t:s0 key=(null)
type=AVC msg=audit(1546546736.770:592): avc:  denied  { create } for  pid=6200 comm="java" name="jobs" scontext=system_u:system_r:tomcat_t:s0 tcontext=system_u:object_r:usr_t:s0 tclass=dir permissive=0

Using the audit ID, msg=audit(), find out specifics on the denial

~$ sudo grep 1546546736.770:592 /var/log/audit/audit.log | audit2allow -a -w

type=AVC msg=audit(1546546736.770:592): avc:  denied  { create } for  pid=6200 comm="java" name="jobs" scontext=system_u:system_r:tomcat_t:s0 tcontext=system_u:object_r:usr_t:s0 tclass=dir permissive=0
	Was caused by:
		Missing type enforcement (TE) allow rule.

		You can use audit2allow to generate a loadable module to allow this access.

scontext

the context of the process that attempted the denied action

tconext

the context of the target the process attempt to access

You can also check the audit log using sealert, however this doesn't print the audit messages in chronological order.

~$ sudo sealert -a /var/log/audit/audit.log

listing rules, file contexts, users, and roles

Here is a quick example on how to list all the file system labels matching a string, in this example tomcat

~$ sudo semanage fcontext -l | grep tomcat

List all file contexts

~$ seinfo -t

List all users

~$ seinfo -u

List all user roles

~$ seinfo -r

List ports associated with context

Using sepolicy you can list the ports associated with a selinux context

~$ sepolicy network -t http_port_t
http_port_t: tcp: 80,81,443,488,8008,8009,8443,9000

Add port to the policy

~$ semanage port -m -t http_port_t -p tcp 8080

changing security context

There are a few ways to do this, but these are the (2) i'm currently familiar with.
Most of the time, only the type security context will need to be changed, like so:

~$ sudo chcon -v --type=httpd_sys_content_t /html

However, while the above offers persistence, it fails to offer is a way to retain the changed state if someone relabels the file system.
Alternatively, you can use this and also register the type security context change with selinux. This will not only be persistent after a restart, but also after relabeling the file system.

~$ sudo semanage fcontext -a -t httpd_sys_content_t "/html"
or delete
~$ sudo semanage fcontext -d -t tomcat_var_lib_t "/data(/.*)?"

Even better, you can clone the security contexts of an existing file or folder:

sudo semanage fcontext -a -e {source} {destination} 
~$ sudo semanage fcontext -a -e /usr/share/tomcat/webapps /opt/jenkins 

Creating a SELinux Policy

I had to add an extra policy to allow git and tomcat access to resources.
I wanted to restrict changes to SELinux to only what was necessary, so I opted to repeat these steps until all

~$ sudo ausearch -m AVC,USER_AVC,SELINUX_ERR -ts recent    
     #look at recent SELinux events and find the ID of the denial.
~$ sudo grep 1547056915.268:2946 /var/log/audit/audit.log | audit2allow -a -M local-git2     
     #with the denial ID, use audit2allow to create a new set of policy files (one TE for human readable and one PP for an encoded version that can be inserted).  You can create a fresh one for each restriction you find and then manually combine them together.
~$ cat local-git2.te
     #Look at the TE file and (if you have an existing one already), compare it to see what needs to be added.
~$ vim local-git.te
     #Manually merge the changes you saw in the previous TE file.
~$ sudo checkmodule -M -m -o local-git.mod local-git.te
     #create the module from the TE file
~$ sudo semodule_package -o local-git.pp -m local-git.mod
     #create the PP file from the Module
~$ sudo semodule -i local-git.pp
     #Install the new policy file.

The resulting policy file was:

~$ cat local-git.te

module local-git 1.0;

require {
	type tomcat_t;
	type ssh_exec_t;
	type tomcat_cache_t;
	type tomcat_var_lib_t;
	class file execute;
	class file execute_no_trans;
	class file getattr;
	class file read;
	class file open;
}

#============= tomcat_t ==============
allow tomcat_t ssh_exec_t:file execute;
allow tomcat_t tomcat_cache_t:file execute;
allow tomcat_t tomcat_cache_t:file execute_no_trans;
allow tomcat_t ssh_exec_t:file getattr;
allow tomcat_t ssh_exec_t:file read;
allow tomcat_t ssh_exec_t:file open;
allow tomcat_t ssh_exec_t:file execute_no_trans;
allow tomcat_t tomcat_var_lib_t:file execute;
allow tomcat_t tomcat_var_lib_t:file execute_no_trans;

SELinux Boolean

List booleans

~$ sudo getsebool -a

enable a boolean

~$ sudo getsebool -a | grep nis_enabled
~$ sudo setsebool -P nis_enabled on
~$ sudo getsebool -a | grep nis_enabled

troubleshoot selinux

First thing is to understand how to read the audit messages from selinux.

Raw Audit Messages
type=AVC msg=audit(1546890349.633:735): avc:  denied  { execute } for  pid=5649 comm="git" name="ssh" dev="dm-0" ino=25530389 scontext=system_u:system_r:tomcat_t:s0 tcontext=system_u:object_r:ssh_exec_t:s0 tclass=file permissive=0

• { getattr } | ie. execute

This item indicates the permission that was denied.

• pid=number

The process id of the process that attempted the access

• comm="git"

The executable that launched the process.

• dev and no

The device where the target resource resides and its inode address.

• scontext="system_u:system_r:tomcat_t:s0"

The SElinux context of the process that attempted the denied action. In this case, it is the context of Tomcat, which is running in the tomcat_t domain.

• tcontext="system_u:object_r:ssh_exec_t:s0"

The SElinux context of the object (target) the process attempted tp access. In this case,

check linux version

~$ rpm -qf /etc/redhat-release

release and renew ip (dhcp)

release

~$ sudo dhclient -v -r eth0

renew

~$ sudo dhclient -v eth0

clone network adapter config

I found that i'm regularly adding new network adapters to vms (say to add an internal network) and wanted a single line way of copying the existing nic interface config and modifying it for the new interface. I came up with the line below which starts off by defining an array with both the old and new interface names, in that order: {old new}

~$ ints=(enp0s3 enp0s8) && sudo cat /etc/sysconfig/network-scripts/ifcfg-"${ints[0]}" | sed 's/UUID\=.\{38\}/UUID\=\"'$(uuidgen ${ints[1]})'\"/' | sed 's/DEVICE\=.\{8\}/DEVICE\=\"'$(echo ${ints[1]})'\"/' | sed 's/NAME\=.\{8\}/NAME\=\"'$(echo ${ints[1]})'\"/' | sudo tee /etc/sysconfig/network-scripts/ifcfg-"${ints[1]}" > /dev/null

pretty simple, opens the existing old config file, generates new UUID and replaces the old, finds old device and name values and replaces with new, then finally creates a new file with all the changes. Doesn't affect the old config file at all.

update hostname

Normally you only need to update the hostname in (1) place:

~$ sudo vim /etc/hostname
hostname.localhost

However, you may need to change it in these other places (or it may already be changed there)
Make sure your hostname is defined in /etc/sysconfig/network

HOSTNAME=server.fqdn.com

Also for the network config, put your FQDN in the hosts file @ /etc/hosts

127.0.0.1   server.fqdn.com
::1   server.fqdn.com
OR
127.0.0.1   localhost localhost.localdomain localhost4 localhost4.localdomain4
::1         localhost localhost.localdomain localhost6 localhost6.localdomain6
ip.address	fqdn.hostname

check and change DNS servers

~$ sudo vi /etc/resolv.conf
nameserver 8.8.8.8
nameserver 8.8.4.4

Install epel repo

~$ yum install epel-release

Add & configure LDAP authentication for SSH

references

https://docs.oracle.com/cd/E52668_01/E54669/html/ol7-sssd-ldap.html
https://cwiki.apache.org/confluence/pages/viewpage.action?pageId=66854729 https://www.jethrocarr.com/2010/11/17/automatically-creating-home-directories-at-login-time/

Install SSSD

~$ sudo yum install sssd sssd-client

Configure SSSD

You can opt to manually edit the configuration file, like is seen in this link.
Or you can use authconfig to configure it for you, like so:

authconfig --enablesssd --enablesssdauth --enablelocauthorize --enableldap --enableldapauth --ldapserver=<ldap_host> --enableldaptls --ldapbasedn=dc=my-company,dc=my-org --enableshadow --enablerfc2307bis --enablemkhomedir --enablecachecreds --update

You may need to start or restart the service

~$ sudo service sssd restart

Home Directories

Make sure you use the switch --enablemkhomedir when you use authconfig if you want users to have their own home directory.

Sudo access

If you want users to have sudo access, providing you already have a group in your LDAP, you can the group to your sudoers file.
Check to see if sssd has imported the groups from your ldap:

~$ getent group

Once you see the group name with the users you want to add, just edit the sudoers file

~$ visudo

Make sure you add it like so:

## Read drop-in files from /etc/sudoers.d (the # here does not mean a comment)
#includedir /etc/sudoers.d
%new_sudoer_group ALL = (ALL) ALL

Add Service to auto start on boot

list current state

~$ sudo chkconfig --list <service name; ie. mysqld>

set service to start on boot

~$ sudo chkconfig --level 345 <service name; ie. mysqld> on

Common packages to install on fresh (minimal) install

~$ sudo yum install -y telnet net-tools vim tcpdump bind-utils redhat-lsb-core wget nfs-utils policycoreutils-python setroubleshoot setools

telnet

standard telnet package

net-tools

contains obsolete networking applications such as ifconfig

vim

advanced text editor

tcpdump

packet capture utility

bind-utils

contains dns focused applications such as dig

redhat-lsb-core

provides LSB commands, such as lsb_release -a which gives you specific system information and build details.

wget

application to access and download internet content, such as http/https

nfs-utils

utilities for setting up, configuring, and managing nfs shares on linux

policycoreutils-python

contains selinux management utilities such as semanage

setroubleshoot

has selinux troubleshooting tools, like sealert

setools

policy analysis tool for selinux, such as seinfo

bash for loop examples

Get a list of file names with the full path, then for each, print the filename and path and then search for a string, printing any matching lines.

~$ for i in $(find / -name "*.ldif"); do echo $i && grep localdomain $i; done
/etc/openldap/slapd.d/cn=config.ldif
/etc/openldap/slapd.d/cn=config/olcDatabase={2}bdb.ldif
olcSuffix: dc=localhost,dc=localdomain
olcRootDN: cn=ldapadmin,dc=localhost,dc=localdomain
/etc/openldap/slapd.d/cn=config/olcDatabase={1}monitor.ldif
 nal,cn=auth" read  by dn.base="cn=ldapadmin,dc=localhost,dc=localdomain" read  by * n
/etc/openldap/slapd.d/cn=config/olcDatabase={-1}frontend.ldif
/etc/openldap/slapd.d/cn=config/cn=schema/cn={10}ppolicy.ldif

Add NFS mount and share to clients

Done on CentOS Linux release 7.5.1804 (Core)

Server side

From the server side we need to do the following:

~$ sudo yum install nfs-utils
~$ systemctl enable nfs
~$ systemctl start nfs.service

Make the NFS share and assign permissions in /etc/exports

~$ sudo mkdir /nfsshare
$ sudo vim /etc/exports
/nfsshare ansible2.r00tedvw.local(ro,sync,no_root_squash)
/nfsshare ansible3.r00tedvw.local(ro,sync,no_root_squash)

Add the needed firewalld rules

~$ sudo firewall-cmd --permanent --add-service=nfs
~$ sudo firewall-cmd --permanent --add-service=mountd
~$ sudo firewall-cmd --permanent --add-service=rpc-bind
~$ sudo firewall-cmd --reload

NFS options

Some other options we can use in “/etc/exports” file for file sharing is as follows.

ro: With the help of this option we can provide read only access to the shared files i.e client will only be able to read.
rw: This option allows the client server to both read and write access within the shared directory.
sync: Sync confirms requests to the shared directory only once the changes have been committed.
no_subtree_check: This option prevents the subtree checking. When a shared directory is the subdirectory of a larger file system, nfs performs scans of every directory above it, in order to verify its permissions and details. Disabling the subtree check may increase the reliability of NFS, but reduce security.
no_root_squash: This phrase allows root to connect to the designated directory, but also leaves a security vulnerability.
root_squash: This phrase allows files created on a mount from a client to be setup with nobody permissions.

Client Side

~$ sudo yum install nfs-utils
~$ systemctl start nfs.service

check to make sure you can hit the NFS share and pull info

~$ showmount -e ansible1.r00tedvw.local
Export list for ansible1.r00tedvw.local:
/nfsshare ansible3.r00tedvw.local,ansible2.r00tedvw.local

check a couple of other ways:

~$ nfsstat -m
/mnt/nfsshare from ansible1.r00tedvw.local:/nfsshare
 Flags:	rw,relatime,vers=4.1,rsize=131072,wsize=131072,namlen=255,hard,proto=tcp,port=0,timeo=600,retrans=2,sec=sys,clientaddr=10.0.3.4,local_lock=none,addr=10.0.3.6

~$ mount -v
...
ansible1.r00tedvw.local:/nfsshare on /mnt/nfsshare type nfs4 (rw,relatime,vers=4.1,rsize=131072,wsize=131072,namlen=255,hard,proto=tcp,port=0,timeo=600,retrans=2,sec=sys,clientaddr=10.0.3.4,local_lock=none,addr=10.0.3.6)

temporary mount

Add the mount dir and map it.

~$ sudo mkdir /mnt/nfsshare
~$ sudo mount -t nfs ansible1.r00tedvw.local:/nfsshare /mnt/nfsshare

permanent map

add the mount to /etc/fstab

~$ sudo -s
~$ echo "ansible1.r00tedvw.local:/nfsshare /mnt/nfsshare  nfs defaults 0 0" >> /etc/fstab

Setup NTP server

very simple to configure a ntp client to maintain date/time on the server.

~$ sudo yum install -y ntp
~$ sudo echo '*/5 * * * * root /usr/sbin/ntpd -q -u ntp:ntp' | sudo tee /etc/cron.d/ntpd > /dev/null

The default ntp servers, like 0.centos.pool.ntp.org, do not work. So let's change them to something more reliable.

~$ sudo vim /etc/ntp.conf
...
server time1.google.com iburst
server time2.google.com iburst
server time3.google.com iburst
server time4.google.com iburst

~$ sudo systemctl restart ntpd

Update: If you run into an issue like I did with virtual machines that may be turned off or go to sleep, they can have a very large time difference between the NTP server and the client. This unfortunately causes the ntp client to panic and cease updating the time (great logic). I corrected this issue by adding the following to the top of my configurations file, /etc/ntp.conf

~$ sudo vim /etc/ntp.conf
...
# Do not die on large time jumps. Must be first in this file
tinker panic 0

Alternatively you can use the following to add the lines to the very top of the file.

$ sudo sed -i '1i\
# Do not die on large time jumps. Must be first in this file\
tinker panic 0\
' /etc/ntp.conf

With the ntpd service restarted, it should automatically sync with your NTP servers. If not, you can check it manually:

~$ ntpdate -q time1.google.com
server 216.239.35.0, stratum 1, offset 0.009567, delay 0.05885
 2 Jan 15:51:04 ntpdate[5561]: adjust time server 216.239.35.0 offset 0.009567 sec

firewalld

Here are some examples on how to use firewalld

~$ sudo firewall-cmd --get-active-zone 
public
  interfaces: eth0 enp0s3
~$ sudo firewall-cmd --zone=public --add-port=8080/tcp
~$ sudo firewall-cmd --zone=public --list-ports
22/tcp 8080/tcp
~$ sudo firewall-cmd --permanent --add-service=nfs
~$ sudo firewall-cmd --permanent --add-service=mountd
~$ sudo firewall-cmd --permanent --add-service=rpc-bind
~$ sudo firewall-cmd --reload