###########################
\n### RHEL\/CentOS install ###
\n###########################<\/p>\n
### Link for netinstall ##
\nhttp:\/\/ftp.astral.ro\/distros\/centos\/6.8\/os\/x86_64\/<\/p>\n
###########
\n### yum ###
\n###########<\/p>\n
yum update\u00a0\u00a0 \u00a0\u00a0\u00a0 \u00a0# update toate pachetele si dependintele lor
\nyum search nume_pachet\u00a0\u00a0 \u00a0# cauta un anume pachet, pot fi mai multe pachete trecute
\nyum info nume_pachet\u00a0\u00a0 \u00a0# afiseaza detalii despre un anume pachet
\nyum list nume_pache\u00a0\u00a0 \u00a0\u00a0\u00a0 \u00a0# afiseaza informatii despre un anumit pachet, instalat sau nu
\nyum list nume_pachet\\* \u00a0\u00a0 \u00a0# afiseaza informatii despre toate pachetele care incep cu un nume
\nyum list all\u00a0\u00a0 \u00a0\u00a0\u00a0 \u00a0# afiseaza toate pachetele disponibile
\nyum list installed “*nume_pachet*”\u00a0 # afiseaza pachetele instalate care contine un nume
\nyum list installed | grep reponame\u00a0 # afiseaza pachetele instalate dintr-un repo
\nyum list available\u00a0\u00a0 \u00a0# afiseaza pachetele disponibile in functie de repo-urile instalate
\nyum repolist\u00a0\u00a0 \u00a0\u00a0\u00a0 \u00a0# afiseaza repo-urile instalate
\nyum gruplist\u00a0\u00a0 \u00a0\u00a0\u00a0 \u00a0# afiseaza
\nyum install nume_pachet\\* # instaleaza toate pachetele care incep cu un nume
\nyum downgrade nume_pachet
\nyum provides “*\/nume_pachet” # afiseaza fisierele care le detine un pachet
\nyum -v grouplist kde\\*\u00a0 # listeaza toate pachetele ce tin de KDE
\nyum groupinstall “KDE Software Compilation” # instaleaza toate pachetele ce tin de KDE
\nyum groupinstall kde-desktop
\nyum install @kde-desktop\u00a0 # @ pentru a instala un grup
\nyum remove nume_pachet
\nyum groupremove “KDE Software Compilation”
\nyum groupremove kde-desktop
\nyum remove @kde-desktop
\nyum history list
\nyum history list nume_pachet
\nyum repolist all\u00a0 # list all repositories set up on your system
\nyum –exclude=packagename\\* …<\/p>\n
################
\n### yum.conf ###
\n################<\/p>\n
### skip updating packages ###
\nyum -x nume_pachet update
\nyum –exclude=nume_pachet update<\/p>\n
sudo vim \/etc\/yum.conf\u00a0 # permanent
\n_______
\n[main]
\nexclude=nume_pachet1* nume_pachet2*
\n_______
\nyum –disableexcludes=all update\u00a0 # disable exclude to check for an update<\/p>\n
### Remove Old Kernels ###
\n# Package-cleanup set count as how many old kernels you want left #
\npackage-cleanup –oldkernels –count=2<\/p>\n
# Make Amount of Installed Kernels Permanent #
\nvim \/etc\/yum.conf # and set installonly_limit:
\ninstallonly_limit=2<\/p>\n
### Removing dependencies ###
\nsudo vim \/etc\/yum.conf
\n______________________________
\n[main]
\nclean_requirements_on_remove=1
\n______________________________<\/p>\n
###########
\n### RPM ###
\n###########<\/p>\n
rpm -ivh package-2.7.9-5.el6.2.i686.rpm\u00a0 # Install an RPM Package
\n-i : install a package
\n-v : verbose for a nicer display
\n-h: print hash marks as the package archive is unpacked<\/p>\n
rpm -qpR package-5.2.2-1.noarch.rpm\u00a0\u00a0 # check dependencies of RPM Package before Installing
\n-q : Query a package
\n-p : List capabilities this package provides.
\n-R: List capabilities on which this package depends..<\/p>\n
rpm -ivh –nodeps package-5.2.2-1.noarch.rpm\u00a0 # Install a RPM Package Without Dependencies
\n\u2013nodeps (Do not check dependencies)<\/p>\n
rpm -q package\u00a0\u00a0 # check an Installed RPM Package
\nrpm -ql package\u00a0 # List all files of an installed RPM package<\/p>\n
rpm -qa –last\u00a0 # List Recently Installed RPM Packages
\nrpm -qa\u00a0\u00a0 \u00a0\u00a0\u00a0 \u00a0# List All Installed RPM Packages<\/p>\n
rpm -Uvh package-3.5.0-2.el6.centos.i686.rpm\u00a0 # Upgrade a RPM Package<\/p>\n
rpm -evv package\u00a0 # Remove a RPM Package
\nrpm -ev –nodeps package\u00a0 # Remove an RPM Package Without Dependencies
\n-e (erase)<\/p>\n
rpm -qi package\u00a0 # Query a Information of Installed RPM Package
\n-qi (query info)<\/p>\n
rpm -qf \/usr\/bin\/package\u00a0 # Query a file that belongs which RPM Package
\n-qf (query file)<\/p>\n
rpm -qip package-1.3.3-1.noarch.rpm\u00a0 # Information of RPM Package Before Installing
\n-qip (query info package)<\/p>\n
rpm -qdf \/usr\/bin\/vmstat\u00a0 # Query documentation of Installed RPM Package
\n-qdf (query document file)<\/p>\n
rpm -Vp package-1.3.3-1.noarch.rpm\u00a0 # Verify a RPM Package
\n-Vp (verify package)
\nrpm -Va\u00a0 # Verify all RPM Packages<\/p>\n
rpm -qa gpg-pubkey*\u00a0 # List all Imported RPM GPG keys<\/p>\n
######################
\n### YUM & RPM tips ###
\n######################<\/p>\n
#Query packages not from CentOS #
\nrpm -qa –qf ‘%{NAME} %{VENDOR}\\n’ | grep -v CentOS<\/p>\n
# Reset File Permissions #
\nrpm –setperms <packagename><\/p>\n
# View the Changelog of a package #
\nrpm -q –changelog <packagename> | less<\/p>\n
# quickly list documentation relating to a package #
\nrpm -qd <packagename><\/p>\n
# Query Package Install Order and Dates #
\nrpm -qa –last > ~\/RPMS_by_Install_Date<\/p>\n
# Query Available Packages from a Repo #
\nyum –disablerepo “*” –enablerepo “rpmforge” list available<\/p>\n
# Enable or Disable a Repo from the Command Line #
\nyum-config-manager –enable c6-media
\nyum-config-manager –disable c6-media<\/p>\n
# Show all installed GPG keys #
\nrpm -q gpg-pubkey –qf ‘%{name}-%{version}-%{release} –> %{summary}\\n’<\/p>\n
### package-cleanup ###
\npackage-cleanup –orphans
\npackage-cleanup –leaves
\npackage-cleanup –dupes
\npackage-cleanup –problems
\npackage-cleanup –oldkernel<\/p>\n
### Fonts config ###
\nvim ~\/.fonts.conf
\n__________________________________________
\n<?xml version=’1.0′?>
\n<!DOCTYPE fontconfig SYSTEM ‘fonts.dtd’>
\n<fontconfig>
\n<match target=”font”>
\n<edit mode=”assign” name=”rgba”>
\n<const>rgb<\/const>
\n<\/edit>
\n<\/match>
\n<match target=”font”>
\n<edit mode=”assign” name=”hinting”>
\n<bool>true<\/bool>
\n<\/edit>
\n<\/match>
\n<match target=”font”>
\n<edit mode=”assign” name=”hintstyle”>
\n<const>hintslight<\/const>
\n<\/edit>
\n<\/match>
\n<match target=”font”>
\n<edit mode=”assign” name=”antialias”>
\n<bool>true<\/bool>
\n<\/edit>
\n<\/match>
\n<match target=”font”>
\n<edit mode=”assign” name=”lcdfilter”>
\n<const>lcddefault<\/const>
\n<\/edit>
\n<\/match>
\n<\/fontconfig>
\n__________________________________________<\/p>\n
### Add an user to SUDOERS ###
\nsu –
\nvisudo
\nsergiu\u00a0\u00a0 \u00a0\u00a0\u00a0 \u00a0ALL=(ALL)\u00a0\u00a0 \u00a0ALL<\/p>\n
Or add the user to wheel group and enable wheel from visudo<\/p>\n
#############
\n### Repos ###
\n#############
\nrpm -Uvh http:\/\/dl.fedoraproject.org\/pub\/epel\/6\/x86_64\/epel-release-6-8.noarch.rpm<\/p>\n
# Multimedia #
\nrpm -Uvh http:\/\/pkgs.repoforge.org\/rpmforge-release\/rpmforge-release-0.5.3-1.el6.rf.x86_64.rpm<\/p>\n
rpm -Uvh http:\/\/li.nux.ro\/download\/nux\/dextop\/el6\/x86_64\/nux-dextop-release-0-2.el6.nux.noarch.rpm
\nsudo wget http:\/\/li.nux.ro\/download\/nux\/misc\/nux-misc.repo -P \/etc\/yum.repos.d\/
\nsudo yum –enablerepo=nux-dextop-testing install xbmc<\/p>\n
# nVidia driver #
\nrpm -Uvh http:\/\/elrepo.org\/elrepo-release-6-5.el6.elrepo.noarch.rpm
\nhttp:\/\/elrepo.org\/linux\/extras\/el6\/x86_64\/RPMS\/\u00a0\u00a0 # extras
\nhttp:\/\/elrepo.org\/linux\/testing\/el6\/x86_64\/RPMS\/\u00a0 # testing
\nsudo yum install kmod-nvidia
\nsudo yum install nvidia-x11-drv<\/p>\n
# Last kernel & lts kernel #
\nhttp:\/\/elrepo.org\/linux\/kernel\/el6\/x86_64\/RPMS\/\u00a0\u00a0 # kernel
\nsudo yum remove kernel-headers kernel-firmware
\nsudo yum –enablerepo=elrepo-kernel install kernel-ml kernel-ml-devel kernel-ml-headers kernel-ml-firmware\u00a0 # for last kernel
\nsudo yum –enablerepo=elrepo-kernel install kernel-lt kernel-lt-devel kernel-lt-headers kernel-lt-firmware\u00a0 # for lts kernel<\/p>\n
# Others #
\nrpm -Uvh http:\/\/download1.rpmfusion.org\/free\/el\/updates\/6\/x86_64\/rpmfusion-free-release-6-0.1.noarch.rpm http:\/\/download1.rpmfusion.org\/nonfree\/el\/updates\/6\/x86_64\/rpmfusion-nonfree-release-6-0.1.noarch.rpm\u00a0\u00a0 \u00a0# (not needed if nux-dextop is installed)<\/p>\n
### Install Google Chrome ###
\nwget http:\/\/chrome.richardlloyd.org.uk\/install_chrome.sh
\nchmod u+x install_chrome.sh
\n.\/install_chrome.sh
\nsudo grep chrome \/var\/log\/audit\/audit.log | audit2allow -M mypol
\nsudo semodule -i mypol.pp<\/p>\n
### Install Chromium ###
\ncd \/etc\/yum.repos.d
\nwget http:\/\/people.centos.org\/hughesjr\/chromium\/6\/chromium-el6.repo
\nyum install chromium
\nsudo setsebool -P mmap_low_allowed 1<\/p>\n
### Install lastest Firefox ###
\nrpm -Uvh http:\/\/rpms.famillecollet.com\/enterprise\/remi-release-6.rpm
\nyum –enablerepo=remi install firefox<\/p>\n
### Others ###
\nyum install bash-completion
\nyum install nautilus-open-terminal
\nyum install flash-plugin
\nyum install gconf-editor
\nyum install gnome-utils
\nyum install file-roller
\nyum install ntfsprogs<\/p>\n
### Apps ###
\nyum install pidgin pidgin-plugin-pack skype
\nyum install geany filezilla transmission mc
\nyum install radiotray tv-maxe xbmc clementine<\/p>\n
### xscrennsaver ###
\nyum remove gnome-screensaver
\nyum install xscreensaver
\nxscreensaver -nosplash\u00a0 # open Startup Applications and add Xscreensaver to startup<\/p>\n
### Change the hostname ###
\nhostname\u00a0\u00a0 # to check your hostname
\nsudo hostname RedHat
\nvim \/etc\/sysconfig\/network<\/p>\n
### Dropbox ###
\nvim \/etc\/sysconfig\/dropbox\u00a0 # DROPBOX_USERS=”sergiu”
\necho ‘-b \/usr\/libexec\/dropbox\/’ > \/etc\/prelink.conf.d\/dropbox.conf
\nyum –enablerepo rpmforge reinstall dropbox<\/p>\n
### Install LibreOffice 4.1.2 ###
\nwget http:\/\/download.documentfoundation.org\/libreoffice\/stable\/4.1.2\/rpm\/x86_64\/LibreOffice_4.1.2_Linux_x86-64_rpm.tar.gz
\ntar -xvf LibreOffice_4.1.2*
\ncd LibreOffice_4.1.2*
\nyum localinstall RPMS\/*.rpm RPMS\/desktop-integration\/libreoffice4.1-freedesktop-menus-4.1.2*.noarch.rpm<\/p>\n
### Install vbox additions ###
\nyum install gcc kernel-devel kernel-headers dkms make bzip2
\nKERN_DIR=\/usr\/src\/kernels\/`uname -r`
\nexport KERN_DIR
\ncd \/media\/VirtualBoxGuestAdditions
\n.\/VBoxLinuxAdditions.run<\/p>\n
### Remove boot splash screen ###
\nvim \/etc\/grub.conf\u00a0 # remove \u2018rhgb\u2019 and \u2018quiet\u2019<\/p>\n
### Remove Desktop icons ###
\nyum install gconf-editor
\napps > nautilus > desktop<\/p>\n
### Multimedia support ###
\nsudo yum install gstreamer gstreamer-plugins-base gstreamer-plugins-good gstreamer-plugins-bad-free
\nsudo yum install gstreamer-plugins-bad gstreamer-plugins-ugly gstreamer-ffmpeg<\/p>\n
### Save alsamixer settings ###
\nsudo alsactl store
\nls -Z \/etc\/asound.*\u00a0 # to see SElinux label<\/p>\n
sudo vim \/etc\/pulse\/daemon.conf
\n_______________________________
\nenable-remixing = yes
\nenable-lfe-remixing = yes
\ndefault-sample-format = s32le
\ndefault-sample-rate = 48000
\ndefault-sample-channels = 6
\ndefault-fragments = 8
\ndefault-fragment-size-msec = 5
\n________________________________<\/p>\n
pulseaudio -k\u00a0 # restart pulseaudio<\/p>\n
### Disable window move with alt + left mouse button ###
\n# conf-editor
\n# \/apps\/metacity\/general
\n# “mouse_button_modifier” option change <Alt> to <Super><\/p>\n
####################################
\n### CentOS Protection & Security ###
\n####################################
\n# Securing and Hardening Red Hat Linux Production Systems
\nhttp:\/\/www.puschitz.com\/SecuringLinux.shtml
\nhttps:\/\/access.redhat.com\/site\/documentation\/en-US\/Red_Hat_Enterprise_Linux\/6\/html\/Security_Guide\/index.html<\/p>\n
### SElinux ###
\nTwo important documentations about Selinux can be found here:
\nhttp:\/\/docs.redhat.com\/docs\/en-US\/Red_Hat_Enterprise_Linux\/6\/html\/Security-Enhanced_Linux\/index.html
\nhttp:\/\/docs.redhat.com\/docs\/en-US\/Red_Hat_Enterprise_Linux\/6\/html\/Managing_Confined_Services\/index.html<\/p>\n
# You can view current status of SELinux mode from the command line using these:
\nsystem-config-selinux
\ngetenforce\u00a0 # if you get back a 1 selinux is turned on if you get back a 0 its turned off
\nsestatus<\/p>\n
# If it is disabled, enable SELinux using the following command.
\nsetenforce enforcing\u00a0 # changes do not persist through a system reboot
\nTo make changes persistent through a system reboot, edit the ‘SELINUX=’ line in\u00a0 \/etc\/selinux\/config for either ‘enforcing’, ‘permissive’, or ‘disabled’. For example: ‘SELINUX=permissive’<\/p>\n
# SElinux logs (\/var\/log\/audit\/audit.log) #
\nyum install setroubleshoot
\nsetroubleshootd
\nsealert -a \/var\/log\/audit\/audit.log\u00a0 # if you only have a console available and no X-Window System
\nsealert -b\u00a0 # if you have gui<\/p>\n
# SElinux re-labelling #
\ntouch \/.autorelabel
\nsudo reboot<\/p>\n
### Password Protect Grub and Single-User Mode ###
\n# It is highly important to protect your bootloader.
\n# There is a magic kernel parameter called init=\/bin\/sh. This makes any user\/login restrictions totally useless. Then mount -o remount,rw \/<\/p>\n
grub-crypt
\nvim \/etc\/grub.conf
\n______________________________________________
\ndefault=0
\ntimeout=2
\nsplashimage=(hd0,0)\/grub\/splash.xpm.gz
\nhiddenmenu
\npassword –encrypted $6$w1lrwrXOMm5ueR4M$…..
\n______________________________________________<\/p>\n
vim \/etc\/sysconfig\/init
\n_______________________
\nPROMPT=no<\/p>\n
SINGLE=\/sbin\/sulogin
\n_______________________<\/p>\n
### Modifying fstab ###<\/p>\n
vim \/etc\/fstab
\n____________________________________________________________________
\n\/dev\/sda1\u00a0\u00a0 \u00a0\/boot\u00a0\u00a0 \u00a0ext4\u00a0\u00a0 \u00a0defaults,nosuid,noexec,nodev\u00a0\u00a0 \u00a01 2
\n\/dev\/sda2\u00a0\u00a0 \u00a0swap\u00a0\u00a0 \u00a0swap\u00a0\u00a0 \u00a0defaults\u00a0\u00a0 \u00a0\u00a0\u00a0 \u00a0\u00a0\u00a0 \u00a00 0
\n\/dev\/sda3\u00a0\u00a0 \u00a0\/\u00a0\u00a0 \u00a0ext4\u00a0\u00a0 \u00a0defaults\u00a0\u00a0 \u00a0\u00a0\u00a0 \u00a0\u00a0\u00a0 \u00a01 1
\n\/dev\/sda4\u00a0\u00a0 \u00a0\/home\u00a0\u00a0 \u00a0ext4\u00a0\u00a0 \u00a0defaults,nosuid,nodev\u00a0\u00a0 \u00a0\u00a0\u00a0 \u00a01 2<\/p>\n
# Others partitions
\n\/tmp\u00a0\u00a0 \u00a0ext4\u00a0\u00a0 \u00a0defaults,nosuid,noexec,nodev\u00a0\u00a0 \u00a01 2
\n\/var\/tmp ext4\u00a0\u00a0 \u00a0defaults,nosuid,noexec,nodev\u00a0\u00a0 \u00a01 2
\n\/var\u00a0\u00a0 \u00a0ext4\u00a0\u00a0 \u00a0defaults,nosuid\u00a0\u00a0 \u00a0\u00a0\u00a0 \u00a0\u00a0\u00a0 \u00a01 2
\n\/var\/www ext4\u00a0\u00a0 \u00a0defaults,nosuid,nodev\u00a0\u00a0 \u00a0\u00a0\u00a0 \u00a01 2
\n\/dev\/shm\u00a0\u00a0 \u00a0tmpfs\u00a0\u00a0 \u00a0\u00a0\u00a0 \u00a0defaults\u00a0\u00a0 \u00a0\u00a0\u00a0 \u00a0\u00a0\u00a0 \u00a00 0
\ndevpts\u00a0\u00a0 \u00a0\u00a0\u00a0 \u00a0\/dev\/pts devpts\u00a0\u00a0 \u00a0gid=5,mode=620\u00a0\u00a0 \u00a0\u00a0\u00a0 \u00a0\u00a0\u00a0 \u00a00 0
\nsysfs\u00a0\u00a0 \u00a0\u00a0\u00a0 \u00a0\/sys\u00a0\u00a0 \u00a0sysfs\u00a0\u00a0 \u00a0defaults\u00a0\u00a0 \u00a0\u00a0\u00a0 \u00a0\u00a0\u00a0 \u00a00 0
\nproc\u00a0\u00a0 \u00a0\u00a0\u00a0 \u00a0\/proc\u00a0\u00a0 \u00a0proc\u00a0\u00a0 \u00a0defaults\u00a0\u00a0 \u00a0\u00a0\u00a0 \u00a0\u00a0\u00a0 \u00a00 0<\/p>\n
____________________________________________________________________
\n# Note that some packages (building nvidia-dkms for example) may require exec on \/var<\/p>\n
# Keep \/boot as read-only #
\n# Note that you need to reset the change to read-write if you need to upgrade the kernel in future
\n\/dev\/sda1\u00a0\u00a0 \u00a0\/boot\u00a0\u00a0 \u00a0ext4\u00a0\u00a0 \u00a0defaults,nosuid,noexec,nodev,ro\u00a0\u00a0 \u00a01 2<\/p>\n
### Disable Control -Alt -Delete keys on the console mode ###
\nvim \/etc\/init\/control-alt-delete.conf
\n______________________________
\n# start on control-alt-delete
\n# exec \/sbin\/shutdown -r now “Control -Alt -Delete pressed”
\n______________________________<\/p>\n
### Umask restrictions\u00a0 ###
\n# Set a umask of 077 for maximum security, which makes new files not readable by users other than the owner.
\nperl -npe ‘s\/umask\\s+0\\d2\/umask 077\/g’ -i \/etc\/bashrc
\nperl -npe ‘s\/umask\\s+0\\d2\/umask 077\/g’ -i \/etc\/csh.cshrc<\/p>\n
### Find users with empty passwords ###
\nawk -F: ‘($2 == “”) {print}’ \/etc\/shadow\u00a0\u00a0\u00a0 # Shouldn’t see anything amiss here
\nawk -F: ‘($3 == “0”) {print}’ \/etc\/passwd\u00a0\u00a0 # Only the root user has uid 0. No other user should ever have uid 0<\/p>\n
### Disable USB mass storage ###
\necho “Disabling USB Mass Storage”
\necho “blacklist usb-storage” > \/etc\/modprobe.d\/blacklist-usbstorage<\/p>\n
### Disable USB stick to detect ###
\nvim \/etc\/modprobe.d\/no-usb
\n_____________________________
\ninstall usb-storage \/bin\/true
\n_____________________________<\/p>\n
### Narrowing rights ###
\nchmod 700 \/root\u00a0 \u00a0\u00a0\u00a0 \u00a0\u00a0\u00a0 \u00a0\u00a0\u00a0 \u00a0# before 0550 dr-xr-x—
\nchmod 700 \/var\/log\/audit\u00a0\u00a0 \u00a0\u00a0\u00a0 \u00a0# before 0750 drwxr-x—
\nchmod 740 \/etc\/rc.d\/init.d\/iptables\u00a0\u00a0 \u00a0# before 0755 -rwxr-xr-x
\nchmod -R 700 \/etc\/skel\u00a0\u00a0 \u00a0\u00a0\u00a0 \u00a0\u00a0\u00a0 \u00a0# before 0755 drwxr-xr-x
\nchmod 640 \/etc\/security\/access.conf\u00a0\u00a0 \u00a0# before 0644 -rw-r–r–
\nchmod 600 \/etc\/sysctl.conf\u00a0\u00a0 \u00a0\u00a0\u00a0 \u00a0# before 0644 -rw-r–r–<\/p>\n
########################
\n### Network Security ###
\n########################<\/p>\n
### Sysctl ###
\nvim \/etc\/sysctl.conf
\n_______________________________________________
\n### ipv4 Security options ###<\/p>\n
# Disable IP Source Routing #
\n# Source Routing is used to specify a path or route through the network from source to destination.
\n# This feature can be used by network people for diagnosing problems.
\n# However, if an intruder was able to send a source routed packet into the network, then he could intercept the replies and your server might not know that it’s not communicating with a trusted server.
\nnet.ipv4.conf.all.accept_source_route = 0
\nnet.ipv4.conf.default.accept_source_route = 0<\/p>\n
# Disable ICMP Redirect Acceptance #
\n# ICMP redirects are used by routers to tell the server that there is a better path to other networks than the one chosen by the server.
\n# However, an intruder could potentially use ICMP redirect packets to alter the hosts’s routing table by causing traffic to use a path you didn’t intend.
\nnet.ipv4.conf.all.accept_redirects = 0<\/p>\n
# Enable IP Spoofing Protection #
\n# IP spoofing is a technique where an intruder sends out packets which claim to be from another host by manipulating the source address.
\n# IP spoofing is very often used for denial of service attacks.
\nnet.ipv4.conf.all.rp_filter = 1
\nnet.ipv4.conf.default.rp_filter = 1<\/p>\n
# Enable Ignoring to ICMP Requests #
\nnet.ipv4.icmp_echo_ignore_all = 1<\/p>\n
# Enable Ignoring Broadcasts Request #
\nnet.ipv4.icmp_echo_ignore_broadcasts = 1<\/p>\n
# Enable Bad Error Message Protection #
\nnet.ipv4.icmp_ignore_bogus_error_responses = 1<\/p>\n
# Enable Logging of Spoofed Packets, Source Routed Packets, Redirect Packets #
\nnet.ipv4.conf.all.log_martians = 1<\/p>\n
# This help a little wtih SYN flood attacks. This suppliments a good firewall ruleset #
\nnet.ipv4.tcp_syncookies = 1<\/p>\n
# This is a server, not a router. Disable packet forwarding #
\nnet.ipv4.ip_forward = 0<\/p>\n
# Others ipv4 security options #
\nnet.ipv4.conf.all.send_redirects = 0
\nnet.ipv4.conf.all.secure_redirects = 0
\nnet.ipv4.conf.default.accept_redirects = 0
\nnet.ipv4.conf.default.secure_redirects = 0
\nnet.ipv4.conf.default.send_redirects = 0
\nnet.ipv4.tcp_max_syn_backlog = 1280
\nnet.ipv4.tcp_timestamps = 0<\/p>\n
### ipv6 Security options ###
\nnet.ipv6.conf.all.disable_ipv6 = 1<\/p>\n
### Memory\/Swap Use ###
\nvm.swappiness = 1
\nvm.vfs_cache_pressure = 50
\n_______________________________________________<\/p>\n
sysctl -p<\/p>\n
### IPTables ###
\nsudo vim \/etc\/sysconfig\/iptables
\n____________________________________________________________________________
\n#Drop anything we aren’t explicitly allowing. All outbound traffic is okay
\n*filter
\n:INPUT DROP [0:0]
\n:FORWARD DROP [0:0]
\n:OUTPUT ACCEPT [0:0]
\n:RH-Firewall-1-INPUT – [0:0]
\n-A INPUT -j RH-Firewall-1-INPUT
\n-A FORWARD -j RH-Firewall-1-INPUT
\n-A RH-Firewall-1-INPUT -i lo -j ACCEPT
\n-A RH-Firewall-1-INPUT -p icmp –icmp-type echo-reply -j ACCEPT
\n-A RH-Firewall-1-INPUT -p icmp –icmp-type destination-unreachable -j ACCEPT
\n-A RH-Firewall-1-INPUT -p icmp –icmp-type time-exceeded -j ACCEPT
\n# Accept Pings
\n-A RH-Firewall-1-INPUT -p icmp –icmp-type echo-request -j ACCEPT
\n# Log anything on eth0 claiming it’s from a local or non-routable network
\n# If you’re using one of these local networks, remove it from the list below
\n-A INPUT -i eth0 -s 10.0.0.0\/8 -j LOG –log-prefix “IP DROP SPOOF A: ”
\n-A INPUT -i eth0 -s 172.16.0.0\/12 -j LOG –log-prefix “IP DROP SPOOF B: ”
\n-A INPUT -i eth0 -s 192.168.0.0\/16 -j LOG –log-prefix “IP DROP SPOOF C: ”
\n-A INPUT -i eth0 -s 224.0.0.0\/4 -j LOG –log-prefix “IP DROP MULTICAST D: ”
\n-A INPUT -i eth0 -s 240.0.0.0\/5 -j LOG –log-prefix “IP DROP SPOOF E: ”
\n-A INPUT -i eth0 -d 127.0.0.0\/8 -j LOG –log-prefix “IP DROP LOOPBACK: ”
\n# Accept any established connections
\n-A RH-Firewall-1-INPUT -m state –state ESTABLISHED,RELATED -j ACCEPT
\n# Accept ssh traffic. Restrict this to known ips if possible.
\n#-A RH-Firewall-1-INPUT -m state –state NEW -m tcp -p tcp –dport 22 -j ACCEPT
\n#Log and drop everything else
\n-A RH-Firewall-1-INPUT -j LOG
\n-A RH-Firewall-1-INPUT -j DROP
\nCOMMIT
\n______________________________________________________________________________<\/p>\n
### Detecting Listening Network Ports ###
\nnetstat -tulpn<\/p>\n
### Services configuration ###
\nchkconfig –list\u00a0\u00a0 \u00a0\u00a0\u00a0 \u00a0# list all known services
\nchkconfig –list | grep 3:on\u00a0\u00a0 \u00a0# list running services
\nchkconfig [service] on\/off\u00a0\u00a0 \u00a0# turn on \/ off service<\/p>\n
for i in atd blk-availability bluetooth mdmonitor lvm2-monitor iscsi iscsid nfslock rpcbind rpcgssd rpcidmapd livesys livesys-late pcscd openct postfix fcoe ip6tables; do service $i stop; chkconfig $i off; done<\/p>\n
##############
\n### Others ###
\n##############<\/p>\n
### Wake-on-lan ###
\necho ‘\/usr\/sbin\/ethtool -s eth0 wol g’ >> \/etc\/rc.d\/rc.local
\nor
\nvim \/etc\/sysconfig\/network-scripts\/ifcfg-eth0
\n_____________________
\nDEVICE=eth0
\nTYPE=EThernet
\nONBOOT=yes
\nETHTOOL_OPTS=”wol g”
\n______________________
\nchkconfig network on<\/p>\n
Wake up the computer from internet
\nThis involves enabling port forwarding of UDP port 9 to the destination computer in the router’s administration webpage.
\nTo fully benefit from WOL you should configure a dynamic DNS service.
\nJust make sure to use your dynamic DNS provided address and the destination computer’s MAC.<\/p>\n
### Wine & wine fonts ###
\nrpm -ev –nodeps wine-tahoma-fonts.noarch<\/p>\n
sudo setsebool -P wine_mmap_zero_ignore 1
\nsudo grep wine-preloader \/var\/log\/audit\/audit.log | audit2allow -M mypol
\nsudo semodule -i mypol.pp<\/p>\n
wget http:\/\/files.polosatus.ru\/winefontssmoothing_en.sh
\nbash winefontssmoothing_en.sh<\/p>\n
# Wine bottles #
\nenv WINEPREFIX=~\/.wine\/CounterStrike wine CounterStrike1.6.exe<\/p>\n
### dd ###
\n# format a USB #
\ndd if=\/dev\/zero of=\/dev\/sdX
\n# see the progress of dd #
\nps -A | grep dd
\nsudo kill -USR1 {nr of PID}<\/p>\n
### mc ###
\ngnome-terminal –geometry=239×68 -e “mc -S featured.ini”<\/p>\n
### GIT HUB ###
\nssh-keygen -t rsa -C “contact.sergiuniculescu@gmail.com”
\nvim ~\/.ssh\/id_rsa.pub\u00a0 # copy key and paste it to github.com<\/p>\n
git config –global user.name “Sergiu Niculescu”
\ngit config –global user.email contact.sergiuniculescu@gmail.com<\/p>\n
### Kernel compile ###
\nyum install gcc ncurses ncurses-devel
\nyum update
\nwget http:\/\/www.kernel.org\/pub\/linux\/kernel\/v3.0\/linux-3…
\ntar -jxvf linux-3*
\ncd linux-3*
\nmake menuconfig\u00a0\u00a0 # allows you to select the already running kernel\u2019s configuration file (resides in \/boot\/), and accepts the defaults for all options that were introduced between the old and the new version of the kernel
\nmake oldconfig\u00a0\u00a0\u00a0 # automatically finds the configuration file in \/boot\/ and asks you questions for all the new configuration options
\nmake
\nmake modules_install install<\/p>\n
### Find commands ###
\nfind \/home -iname name\u00a0\u00a0 \u00a0# Files Using Name and Ignoring Case
\nfind \/ -type d -name directory_name\u00a0 # Find Directories Using Name
\nfind \/ -perm \/u=r\u00a0 # Find all Read Only files
\nfind \/ -perm \/a=x\u00a0 # Find all Executable files
\nfind . -type f -perm 0777 -print\u00a0 # Find all the files whose permissions are 777
\nfind \/ -type f -perm 0777 -print -exec chmod 644 {} \\;\u00a0 # Find all 777 permission files and use chmod command to set permissions to 644
\nfind \/ -type d -perm 777 -print -exec chmod 755 {} \\;\u00a0\u00a0 # Find Directories with 777 Permissions and Chmod to 755
\nfind . -type f -name “tecmint.txt” -exec rm -f {} \\;\u00a0\u00a0\u00a0 # To find a single file called tecmint.txt and remove it
\nfind . -type f -name “*.mp3” -exec rm -f {} \\;\u00a0\u00a0 \u00a0\u00a0\u00a0 \u00a0# Find and remove Multiple File with extension “.mp3”
\nfind \/tmp -type f -empty\u00a0\u00a0 \u00a0# To file all empty files under certain path
\nfind \/tmp -type d -empty\u00a0\u00a0 \u00a0# To file all empty directories under certain path
\nfind \/tmp -type f -name “.*”\u00a0\u00a0 \u00a0# File all Hidden Files
\nfind \/ \\( -perm -4000 -o -perm -2000 \\) -print\u00a0\u00a0 \u00a0 # Identify unwanted SUID and SGID Binaries
\nfind \/ -path -prune -o -type f -perm +6000 -ls\u00a0\u00a0 # Identify unwanted SUID and SGID Binaries
\nfind \/dir -xdev -type d \\( -perm -0002 -a ! -perm -1000 \\) -print\u00a0\u00a0 # Identify world writable files
\nfind \/dir -xdev \\( -nouser -o -nogroup \\) -print\u00a0\u00a0 # Identify orphaned files and folders<\/p>\n
### Netstat commands ###
\nnetstat -a | more\u00a0\u00a0 \u00a0# Listing all the LISTENING Ports of TCP and UDP connections
\nnetstat -at\u00a0\u00a0 \u00a0\u00a0\u00a0 \u00a0# Listing only TCP (Transmission Control Protocol) port connections
\nnetstat -au\u00a0\u00a0 \u00a0\u00a0\u00a0 \u00a0# Listing only UDP (User Datagram Protocol ) port connections
\nnetstat -l\u00a0\u00a0 \u00a0\u00a0\u00a0 \u00a0# Listing all active listening ports connections
\nnetstat -lt\u00a0\u00a0 \u00a0\u00a0\u00a0 \u00a0# Listing all active listening TCP ports
\nnetstat -lu\u00a0\u00a0 \u00a0\u00a0\u00a0 \u00a0# Listing all active listening UDP ports
\nnetstat -lx\u00a0\u00a0 \u00a0\u00a0\u00a0 \u00a0# Listing all active UNIX listening ports
\nnetstat -s\u00a0\u00a0 \u00a0\u00a0\u00a0 \u00a0# Showing Statistics by Protocol
\nnetstat -r\u00a0\u00a0 \u00a0\u00a0\u00a0 \u00a0# Display Kernel IP routing table<\/p>\n
### Change the MAC address of Network Interface ###
\nifconfig eth0 hw ether AA:BB:CC:DD:EE:FF<\/p>\n
### Mount an ISO Image ###
\nmount -t iso9660 -o loop \/home\/tecmint\/Fedora-18-i386-DVD.iso \/mnt\/iso\/
\nsudo umount \/mnt\/iso<\/p>\n
### Mount a partition with read-write permission ###
\nmount -o remount,rw \/<\/p>\n
### Clone the boot partition ###
\nsudo dd if=\/dev\/sdb1 of=\/dev\/sdc1 bs=4096 conv=notrunc,noerror
\ndd if=\/dev\/sdb of=mbr.img bs=512 count=1
\ndd if=mbr.img of=\/dev\/sdc bs=446 count=1\u00a0 # If you only want to restore the boot loader
\ndd if=mbr.img of=\/dev\/sdc bs=1 skip=446 count=64\u00a0 # To restore only the partition table<\/p>\n
### rsync ###
\nrsync -a –progress rsync:\/\/ftp.astral.ro\/distros\/centos\/6.8\/os\/x86_64\/ \/opt\/mirror\/centos<\/p>\n
system-config-kickstart\u00a0 #\u00a0 A graphical interface for making kickstart files<\/p>\n
#############
\n### Games ###
\n#############<\/p>\n
### UrbanTerror ###
\ntar -xjvf UrbanTerror42.tar.gz
\ncd UrbanTerror42
\nchmod u+x UrTUpdater_Ded.x86_64 Quake3-UrT.x86_64
\n.\/UrTUpdater_Ded.x86_64
\n.\/Quake3-UrT.x86_64<\/p>\n","protected":false},"excerpt":{"rendered":"
########################### ### RHEL\/CentOS install ### ###########################<\/p>\n
### Link for netinstall ## http:\/\/ftp.astral.ro\/distros\/centos\/6.8\/os\/x86_64\/<\/p>\n
########### ### yum ### ###########<\/p>\n
yum update # update toate pachetele si dependintele lor yum search nume_pachet # cauta un anume pachet, pot fi mai multe pachete trecute yum info nume_pachet # afiseaza detalii despre un anume pachet yum list nume_pache # afiseaza […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[5],"tags":[],"_links":{"self":[{"href":"https:\/\/mohan.sg\/index.php?rest_route=\/wp\/v2\/posts\/5979"}],"collection":[{"href":"https:\/\/mohan.sg\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mohan.sg\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/mohan.sg\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/mohan.sg\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=5979"}],"version-history":[{"count":1,"href":"https:\/\/mohan.sg\/index.php?rest_route=\/wp\/v2\/posts\/5979\/revisions"}],"predecessor-version":[{"id":5981,"href":"https:\/\/mohan.sg\/index.php?rest_route=\/wp\/v2\/posts\/5979\/revisions\/5981"}],"wp:attachment":[{"href":"https:\/\/mohan.sg\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=5979"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mohan.sg\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=5979"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mohan.sg\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=5979"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}