Download
1 / 45
450 likes | 477 Vues
Linux Networking and Security. Chapter 6. Configuring Major Network Services. Expand the routing capabilities of your Linux server Set up your own DNS name server Configure a basic email server Understand how Linux can excel as a Web server. Dynamic Routing with Routing Protocols.
E N D
Linux Networking and Security Chapter 6
Configuring Major Network Services • Expand the routing capabilities of your Linux server • Set up your own DNS name server • Configure a basic email server • Understand how Linux can excel as a Web server
Dynamic Routing with Routing Protocols • Static Routing - the routing table in the Linux kernel is assembled by entries in start-up scripts or by user-entered route commands issued to update the routing table • Dynamic Routing - the process of using a specialized routing protocol to build and modify routing tables automatically through a network, based on information shared by the routers
Dynamic Routing with Routing Protocols • Interior routing protocols are designed for routing packets among networks within an organization and they route packets based on mathematical models • Exterior routing protocols are designed for routing packets between networks controlled by different organizations and they route packets based on administration policies • All routing protocols communicate between routers to find the most efficient packet route
Routing Information Protocol (RIP) and routed • RIP, an interior routing protocol, is the oldest routing protocol still in common use on smaller or simply-routed networks • RIP defines the best route as that which has the lowest number of routers (hops) to reach the destination network • RIP is implemented using the routed daemon, which is easy to configure and run
Open Shortest Path First (OSPF) and gated • OSPF, an interior routing protocol, is designed to work effectively even in very large networks • OSPF uses a technique called flooding which allows routers to intelligently construct a chart inside the router that defines the best routing paths • OSPF is implemented using the gated daemon, which is not installed by default
Setting Up a DNS Name Server • Domain name service (DNS) is central to the Internet • When URLs are entered in a Web browser, a DNS server converts the name to an IP address, allowing the client to send a packet to the Web server as requested • The information in DNS can be thought of as an inverted hierarchical tree, where the top of the tree is called root and is represented by a period • Users typically don’t refer to roots, but to the last part of domain names called top-level domains
Setting Up a DNS Name Server • Resolving a domain to an IP address using DNS, also called querying the DNS server, stores, or cashes, the conversion information resulting in speedier DNS queries • Each domain has a master DNS server which contains database files that provide IP addresses to every host in that domain • Each domain should have a slave DNS server which acts as a backup to the master
Setting Up a Basic Name Server • The program that implements a DNS server is called named, the name daemon, which is controlled by a system script in /etc/rc.d/init.d • named is found in the BIND package on most Linux systems; selecting the Red Hat Linux name server component provides bind-conf, bind-utils, and caching-nameserver • Caching name servers have no preconfigured domain information, but simply query other DNS servers and cache the results
Setting Up a Basic Name Server • Later versions of BIND use the configuration file /etc/named.conf • This file is divided into five sections: options, controls, three different zones and an include line, which refers to the rndc security file • A zone is a part of the DNS domain tree for which the DNS server has authority to provide information • Zone information is contained in files referred to in named.conf
Setting Up a Basic Name Server • Zone information is important since it is the information that a DNS query seeks • These files contain resource records which hold information about a host within a zone that a client can receive through a query • There are many types of resource records and they have this general format: item-described, time-to-keep-cached, type-of-record, and information-sought
Managing the named Server • Once the /etc/named.conf configuration file and the zone information files are set up in /var/named, the named daemon is started by entering /usr/sbin/named • The script used is in /etc/rc.d/init.d • The rndc utility is used to control the name server from a command line without reloading • rndc can operate over a network connection, but is used only locally by default
Using Command-line Utilities • It is important to test the DNS server when it is up and running, and using any of the following utilities requests DNS information about a specific hostname or IP address: • host provides a brief response showing the IP address of the hostname specified • nslookup is more complete in that it can be run in interactive mode or from the command line • dig extracts data from the zone information files of DNS servers for domains requested
Using Command-line Utilities • A utility that goes beyond host, nslookup, and dig is nsupdate • nsupdate allows a user to update zone information files dynamically at the command line • nsupdate is an interactive utility, with a separate command prompt • The configuration file /etc/named.conf must be properly updated to allow the use of nsupdate
Configuring a Basic Email Server • Linux email servers include: sendmail, Qmail, Postfix and smail • Sendmail is the most widely used email server in the world • The sendmail package contains the sendmail daemon • Sendmail is started using a script in /etc/rc.d/init.d • Sendmail is configured using the file /etc/sendmail.cf • Most email administrators prefer to use the m4 program to configure sendmail
Configuring a Basic Email Server • Email servers use DNS to locate the mail exchanger for a recipient, then hands the message to the sendmail daemon for delivery • Relaying is when sendmail tries to deliver a message that didn’t originate on the same host where sendmail is running • One problem with relaying is that spam email generators use it to hide their origin • Sendmail can be configured to avoid problems such as spamming
Using Forwarding and Aliases • Sendmail maintains a forwarding database that contains handling rules for a user’s email • If a user has moved their principal email account to another server, a line can be added to the forwarding database to redirect their email • Forwarding relying on single domain names for incoming messages can be done using the aliases file /etc/aliases • An email alias is another name that delivers email messages to the user
Creating a Linux Web Server • A Web server is a daemon that accepts requests via HTTP and responds with the requested files • The most widely used Web server in the world today is Apache • Apache is included with every standard version of Linux and is usually installed by default • Other Linux Web servers include: Boa, iPlanet, Servertec iServer, Stronghold, Zues
Creating a Linux Web Server • Some of the features that make Apache so popular include: • A regular development cycle • Virtual hosting, which allows a single Web server to provide documents for multiple Web sites • A modular design that allows functionality choices • Many security options and performance tuning settings • A broad support base, despite being free software
Creating a Linux Web Server • Apache is started from the standard script /etc/rc.d/init.d/httpd • Apache configuration files are stored in /etc/httpd/conf • The main configuration file, httpd.conf, contains hundreds of configurations options called directives, that affect global and local operation of Apache
Creating a Linux Web Server • Apache can keep a connection active, or alive, after a file is transferred • Apache uses a master server to spawn additional servers that handle client requests • many features of Apache are implemented as loadable modules where the user defines what their copy of Apache will do by what modules are selected for inclusion
Creating a Linux Web Server • Much of the httpd.conf file is organized into containers, special directives that activate other directives upon certain conditions • Virtual hosting is the feature of Apache that lets a single copy of Apache serve documents for several Web sites • Apache can act as a proxy server, which intercepts requests from clients and forwards them as if they came from the proxy server rather than the original client
Chapter Summary • Routing tables guide the Linux kernel in sending packets to their final destination on distant networks • Interior routing protocols are used within an organization using mathematical algorithms to determine how to route packets • Exterior routing protocols are used for routing packets among organizations, based on policy decisions about which specific sources of routing information are to be trusted - and how much • The routed daemon implements RIP on Linux, but typically only for small networks
Chapter Summary • OSPF is a highly effective interior routing protocol which builds a chart of the status of all routers that it knows of, determining the best route based on a complex mathematical algorithm • The gated daemon supports RIP version 2 with classless addressing, OSPF, and BGP on Linux • DNS is an Internetwide information hierarchy used to provide hostname-to-IP-address matching and IP-address-to-hostname address matching • Queries about a given hostname usually begin with one of the Internet’s root DNS servers
Chapter Summary • A zone is part of a domain about which a particular DNS server is authorized to provide information • Reverse DNS provides a security mechanism that is widely used to prevent unauthorized users from completing queries to various network services • Setting up a simple caching name server to forward DNS queries to another name server makes efficient use of network bandwidth for many small networks • The DNS protocol is implemented in Linux by the named daemon, which is part of the BIND collection of programs
Chapter Summary • Resource records hold information about a host within a zone that clients can receive through queries • The Start of Authority (SOA) record defines how to reach the DNS administrator for a zone • bindconf.gui is one utility used to configure named • The host, nslookup, and dig commands let you query a DNS server from the command line • The nsupdate utility lets you update DNS zone information over a network, on the fly • Popular Linux email servers include sendmail (most popular), Qmail, Postfix, and smail
Chapter Summary • Startup options for sendmail are configured via /etc/sysconfig/sendmail, but sendmail is most often configured through the /etc/sendmail.cf file • Spam is a source of great concern and annoyance to email server administrators, and email servers provide many features to control this problem • Aliases are a popular way to redirect email or create small mailing lists via sendmail • Apache is the most widely used Web server and it is included with all standard distributions of Linux • One copy of Apache is the master server and it controls Apache copies that handle client requests
Chapter Summary • Most functions in Apache are performed by loadable modules, configured using directives in httpd.conf • Apache uses directives to control access to the server on a per-directory basis, and can also host multiple Web sites using virtual hosting directives • Apache supports advanced features like virtual hosting and acting as a proxy server
