CCP14
Methods, Problems and Solutions
Linux Information for Crystallography
Installing a Redhat 6.1 Linux and Win95 Dual Boot System via Local CD-ROM Install on a Toshiba Laptop
The CCP14 Homepage is at http://www.ccp14.ac.uk
Note: As of March 2000, Redhat 6.2 has been released but it took a while to make time to
update the tutorials. Refer to new tutorials on installing Redhat 6.2
unless there is a specific reason you have to use Redhat 6.0 or Redhat 6.1.
Things that don't seem to go OK (or kludges) when installing Redhat 6.1:
- FTP install for the Laptop crashed so used the HTTP install
- On a network and CD-ROM install it can lose some/all of the network setup information. (need to run linuxconf to fix this
is a user-friendly way)
- Requesting KDE desktop still installs the presently inferior Gnome desktop.
- There is no option in the install to disable un-necessary services such as sendmail that
offer potential hacker access.
Disclaimer
Note: Because of variations in install, multiple toolsets, (never knowing whether
a previous install might have affected the next one); some/all(?) of the following information
might be wrong; and there are probably better methods for doing the following. Keep this in
mind and feel free to think a bit before blindly following the instructions.
Note 2: Redhat does have a reputation of loading more than you really need and running
deamons that you may not really need. After installing, doing a security audit and removing
deamons you do not require is pretty much mandatory. Some of this is explained at the end
of install file. As stated above, this installation tutorial has been modified to try and have
this as hacker safe an installation as possible with by default, no scannable ports open.
Warning: (was advised by local department network support group to insert
the following) In some organisations and departments, installing unauthorized software
or operating systems such as Linux could be a sackable offence. If in doubt, check with
your network support group. Also, take note that some distributions and setup options may
also install software deemed to be "hacker tools". Presence of "hacker tools" on a
computer system could prompt management or criminal action against "offenders".
Also refer:
Backup your old stuff
The following method does the dual boot installation of Linux and Win95 from scratch using
an unpartitioned disk. It is possible to install Linux on an existing Windows system
without destroying the Windows area using FIPS or other similar non-destructive reformatting
software (e.g., Partition Magic). However implementing that is possibly part of a "future" X
hour hacking session; so we are doing "clean the disk - then install" method here.
"FIPS is a program for non-destructive splitting of harddisk partitions" -
FIPs Webpage at: http://bmrc.berkeley.edu/people/chaffee/fips/fips.html.
Note that an up to date FIPS is included in the Redhat Linux tools area.
If new to Linux, Expect to Initially Waste a Lot of Time
Like Austen Powers(?), "It's UNIX Baby Yeahhhh!"
Also refer Unix-haters handbook -
http://catalog.com/hopkins/unix-haters/handbook.html
Noting down the PC System Information
Note down all the information on your system including chip-sets, monitor refresh rates, etc.
If Linux makes a wrong choice, or prompts for a decision, you have to give it the
correct information. If you have Win95/Win98 or WinNT installed, you can
gain this information quite easily from the control panel (assuming the PC is
setup with the correct drivers). This also includes all the network information;
IP address, name, domain, gateway/router, NetMask, etc. Too much information
does not hurt, only too little. For network cards and the like, you may have to
go into Win95 or Win98 and get the memory addresses and the IRQs used. You tend to
find out what extra information you need the hard way.
In this case:
- Toshiba Tecra 520CDT Laptop Pentium 166 with 32 Meg RAM
- 3Com (3C562D-3C563D) EL III Lan + 336 Modem PC Card (From Win95 - Input/Output Range 0110-011F)
- Network card: IRQ = 3
- Modem card: IRQ = 9
- Yamaha OPL3-SAx Sound System - IRQ = 5
- 800x600 256 Colour (32h) Thin Film Transistor (TFT) LCD display - 60 Hz (can do high colour)
- Monitor Scanning Frequency:
- 800x600 16Mil Colours Vert: 60 Hz, Horiz: 37.9Hz
- 800x600 32k/64k Virtual Colours Vert: 60 Hz, Horiz: 48.5Hz
- 800x600 32k/64k Colours Vert: 60/75/85 Hz, Horiz: 31.5/37.6/43.2Hz
- 640x480 16Mil Colours Vert: 60 Hz, Horiz: 31.5Hz
- 640x480 32k/64k Colours Vert: 60/75/85 Hz, Horiz: 31.5/37.6/43.2Hz
- PCIC or compatiable PCMCIA Card / Multifunction Parent Card: IRQ = 3
- Toshiba IDE CD-ROM XM-1502BN
- Generic IDE/ESDI Hard Disk Type01 (4 Gig)
- Generic NEC Floppy Disk
- Chips and Technologies 65555 PCI Video Card - DirectDraw Version 4 - 2 Meg RAM
- Toshiba CPI to PCI bridge
- Hard-disk controller IRQ = 14 / IRQ = 15
- Keyboard IRQ = 1
- PCI IRQ = 11
- Serial Ports = IRQ = 10 (COM2) IRQ = 4 (COM1)
- Printer Port = IRQ = 7
- Internal 2-button laptop mouse and external PS/2 MS 3 button Intellimouse.
(NOTE: If using an external mouse as we are here (having the 3 buttons is far more
convenient than emulating an X-mouse via 2 mouse buttons), it would be safest to
configure your Laptop BIOS to not use both internal and external mice simultaneious as erratic things
can occur). If you have an external serial port mouse (not PS/2), Redhat may not be able to recognise
and use this mouse, so you may be stuck with using the internet Laptop mouse. A quick solution to this is
to get a "serial to PS/2" adapter for the mouse.
Either buying or Creating your Own Install CD-ROM
Buying the Redhat CD-ROM would be the easiest option but the following
installation used a home made CD-ROM by downloading the files from an FTP
mirror. Most of these sites also have ISO CD-ROM images that can be used to
create bootable CD-ROM images.
Refer to Redhat Mirrors at http://www.redhat.com/mirrors.html.
If you are working from an academic UK site, the following sites are good:
FTP Load
IP Address = 193.63.255.4
Name = src.doc.ic.ac.uk
/pub/Mirrors/ftp.redhat.com/pub/redhat/redhat-6.1/i386/
or
FTP Load
IP Address = 148.88.2.15 or 148.88.2.11
Name = ftp.mirror.ac.uk
/sites/ftp.redhat.com/pub/redhat/redhat-6.1/i386
(restricted to academic users during normal working hours)
The directory structure of the CD-ROM was as follows (with extras to make it
as freestanding as possible):
- /doc
- /dosutils
- /images
- /linux
- /ranish (freeware Ranish Partition Manager which includes a boot manager)
- /Redhat
- /updates
- Some useful tools are also included like the latest Apache web-server source code, tcl/tk source, etc.
Note: You may not have enough room to put all the updated rpms so may have to optimised
the ones you don't think you will need.
Deciding now on the partitions
Summary: the old Redhat 5.2 manual recommends you partition the hard-disk into segments.
You can if you want to just partition the disk into one large partition that
everything fits into if you want to - this can be much simpler but might hurt you
in the future. I prefer to put everything on one partition with this laptop as
expanding harddisk space is not a practical option - thus everything has to fit.
(Please note that decisions made now can cause much pain and gnashing of teeth later).
The following decisions were made due to limitations of a 2 Gig Hard-disk (of which ~1 Gig is
for Linux and partitioning involved quite a bit of trial and error).
Basically try and have a Gig for /usr/local and a
Gig or more for /usr and maximise your home space after that. Things
are actually more complicated depending on the applications you wish to run.
Server applications (e.g., logging) may require a large "/var" and/or "/tmp" area.
- 950 meg for Win95 and Windows programs (FAT 32)
- 120 Meg of Linux SWAP - mandatory - don't forget to make the LINUX SWAP area
- rest goes to /
- The Previous Partitioning was as follows - but the above is far simpler
- 950 meg for Win95 and Windows programs (FAT 32)
- 5 Meg for /boot (very important partition for dual booting)
- 48 Meg of Linux SWAP - mandatory - don't forget to make the LINUX SWAP area
- 80 Meg of / (root partition - /var and /tmp will also go here)
- 65 Meg of /opt (KDE desktop rpm binary installs should be happy with this http://www.kde.org)
- 550 Meg of /usr (large number of Linux Packages get installed here)
- 110 Meg of /home (juggle this with /usr/local)
- rest goes to /usr/local
Obtain the Ranish Partition Manager for DOS and create a Win95 Boot disk
After mucking around with a few utilities, the freeware Ranish Partition Manager for DOS
is a work of genius for managing partitions and boot managing.
Menu driven, it is a breeze to create and delete partitions,
multiple primary partitions, configure the MBR area. It easily will fit on a Windows/DOS
boot floppy with the rest of your boot utilities.
Now before you consider deleting Windows, create a boot disk (format a: /u/s) and copy
over the required utility software.
- Copy over the following to the floppy disk:
- Ranish Partition Manager
- format.com
- fdisk.exe
- edit.com
- sys.com
- xcopy.exe
- xcopy32.exe
- himem.sys
- scandisk.exe
- CD-ROM driver and MSCDEX.EXE
- Anything else you fancy and that will fit.
- Configure the config.sys and autoexec.bat on the floppy so that it
will enable the CD-ROM on bootup; plus himem.sys and any country
specific drivers. Set MSCDEX to use D: drive for the CD-ROM. (We will
be formatting the DOS partition of the hard-disk as C: drive.)
In the case of this Toshiba Laptop:
- Note: Having a loaded CD-ROM pointing to C: drive can possibly
stuff up the partitioning process later on; though Ranish Partition
Manager will probably warn you that something is going wrong.
If in doubt, remove the CD-ROM booting from the config.sys and autoexec.bat.
Creating the LINUX Boot Images on Floppy Disk
Using the files located on the Redhat Linux CD-ROM or a mirror,
create the three Image disks depending on how you are installing (local or
network) and hardware type (PCMCIA); netboot, pcmcia and rescue. You can try
installing direct from the Redhat 6.1 CD-ROM if your system supports
booting from the CD-ROM. In theory, you only have to create the pcmcia.img
disk to install Redhat Linux 6.1 on a Laptop.
These are generally in the images directory of the media you intend
to install from.
For example, via FTP, Imperial College mirror (choose closest Redhat Linux mirrors via
http://www.redhat.com/mirrors.html or
ftp://ftp.redhat.com/pub/MIRRORS.html
Use rawrite or rawrite2for DOS from the dosutils directory to write/burn the images
onto the CD. Standard "copy" command will not work. Just type rawrite and answer the questions.
Alternatively, if you are already on a LINUX PC, you can use the command:
- dd if=filename.img of=/dev/fd0 bs=1440k
- dd if=bootnet.img of=/dev/fd0 bs=1440k
- dd if=pcmcia.img of=/dev/fd0 bs=1440k
- dd if=rescue.img of=/dev/fd0 bs=1440k
Determine the Install Process/Method you are going to Use
You have a variety of options to install the Redhat 6.1 Linux
distribution. In this case, we are using a CD-ROM. Though a page on
FTP/HTTP based network installation is also available.
Booting from Your DOS/Windows Floppy Boot Disk, Deleting Existing Partitions and Editing Master Boot Manager (MBR) Options
Boot from your DOS/Windows Floppy Boot Disk and run the menu driven Ranish Partition Manager.
- Delete the existing partitions.
- Highlight the MBR (Master Boot Record) and:
- Set the MBR Executable to "Boot Manager"
- Boot Interface type to "Compact"
- Check for Viruses "No" (otherwise you may not be allowed to save to the MBR)
- Boot prompt timeout = "6" is nice?
- Default Boot Choice of "Prompt User"
- Save (F2), then out of habit from using DOS, reboot to the floppy again. This may or
may not be optional.
Booting from Your DOS/Windows Floppy Boot Disk and Creating Partitions
Note: There are many possible permutations and combinations but the following
seems to work for me. Despite the literature, setting active partitions and
boot managers can be quite quirky due to limitations/nuances in PC hardware and the
various pieces of software.
Boot from your DOS/Windows Floppy Boot Disk and run the menu driven Ranish Partition Manager.
- (If you want a nice graphical boot manager, select Text 25x80
under the MBR config, then add a "small" "Boot Manager" Partition (4 Meg) as the first Primary partition
using the INS key (which gives a menu list of the possible file systems that can be added)) and
set this as the Bootable Partition . Then, taking into account the above, continue on with the following.
- In the first "Primary" Partition, create a 950 Meg Windows FAT-32 Partition (when promped, save
but DO NOT format as results may not be predictable. We use the Windows format.com program later.)
Set this as your default Boot area using the B key. (Don't be too worried at this point if Ranish is
unhappy about not letting it format the partition and says the DOS/Windows Boot Sector does not have valid information.
Once it is formatted using the format.com program, it should have valid information).
- In the second "Primary" Partition, create a 130 Meg Linux SWAP area
Partition (when promped, save)
- In the third "Primary" Partition, leave the rest as a Linux Partition (this will be "/") (when promped, save)
Formatting the C: Drive - Windows FAT-32
Boot from your DOS/Windows Floppy Boot Disk and run the menu driven Ranish Partition Manager.
- From the floppy disk, type format c: /s and when prompted:
Y - you want to proceed. (/s puts the boot files on the hard-disk)
- Give it a volume name of DOS
- If you want to, you can now install Win95; but I would wait until after getting Linux
happily installed in case some partition nuances (didn't allocate enough space to an
important partition) come to haunt you.
- Take the floppy disk out of the disk drive (to check the boot manager is happy).
- Reboot the PC and you should be given a prompt of HD/1. If you have a Compact boot manager
menu, entering 1 should take you into a command line based Win95/DOS prompt. You
can install more elaborate boot manager menus described in this text (Text
25x80 menu system on startup) if you want to but I was in a "minimalist" mood on this particular occassion.
But now the Text 25x80 menu system is my favourite.
Also Refer:
- reading linux ext2fs partitions with DOS/Windows
Redhat Linux Install
- Making sure the network is connected and you have all the relevant information
specified above, insert Laptop Rehat Linux Network Boot Loader for local/PCMCIA install
(pcmcia.img) floppy disk and reboot. (bootnet.img is for network install of Desktop PCs)
- Redhat Linux will then give you a Welcome to Red Hat Linux screen. Important:
type "text" then press [ENTER] to do this via the text based
non-GUI install which gives access to some extra important install options.
In this case, REDHAT detects various peripherals and will probe the SCSI card
(if you do not get above, but instead get a kernel panic and can't read file system message;
check that you have not accidentally inserted the "Linux Boot (recovery) Disk" you made during
the last attempt to install Redhat Linux before you wiped it)
- When prompted Press OK to continue
- When prompted, choose the language you would prefer to use during
the installation (English seems best for me) Note: Tab toggles between menu
options.
- When prompted, select your keyboard type (in my case, UK)
- When again welcomed to Redhat, Press OK to continue.
- For Installation Type, I tend to go for Install Custom System to get flexibility in
what I want (such as being prompted to install the Fortran compilers, and
especially when working on a laptop with limited space, but may want
to use as a server later on). Thus select custom.
- Now you should be in Disk Druid (assuming you correctly followed the instructions
under "Booting from Your DOS/Windows Floppy Boot Disk and Creating Partitions":
- Edit the DOS partition and give it the name of /dos
- Edit/Add an ~120 Meg Linux Swap file/partition
- Edit/Add the Linux partition as / (root partition - everything goes under here)
- (There are probably other better ways of doing the above but I found it
this is the most flexible for relatively small amounts of disk space)
- After Editing Disk Druid, select OK to continue.
- If you get prompted about not having much memory, just press YES to continue. (32 Meg is considered
a low amount of memory)
- When prompted about formatting, press OK to format. If unsure about the quality
of you hard-disk, also check for bad blocks
- IMPORTANT BIT: Here we come to the whole point of mucking around
with Ranish Partition Manager for DOS. When prompted about the "Lilo Installation", put
the bootloader in the First sector of the boot partition (not the Master boot record).
This way, things actually have a good change of "dual"-booting up as desired on a restart. When
asked about "special options"; unless you know of some that you have to use, just select OK
which should work.
- When prompted for LILO configuration, as we are using the Ranish partition manager, have
Redhat install the bootloader into the First sector of boot partition
- When prompted about Bootable partitions; Linux at this point does not know that
we have "spat upon" its LILO loader for "dual booting", and that we are using Ranish Partition Manager's
MBR based program for dual booting. So just keep Linux happily deluded and select OK to
continue. Go with defaults (If you get the "Edit Boot Label" option, you pressed ENTER instead
of TAB, then ENTER to the OK button) and things should be happy.
- When prompted for your hostname configuration, either confirm or insert the name of your computer.
- Redhat should then prompt for the network configuration. (IP, Netmask, Default Gateway IP, Primary Nameserver)
Enter this information. If it doesn't, continue on as any glitches in recognising the network card can be
fixed later (though hopefully not requiring a fresh install)
- When prompted for Mouse Selection, select you type of mouse (Generic -2 button Mouse PS/2, and Emulate 3
buttons), then press OK to continue.
- Under "Configure Timezone", select it. (Europe, London for me)
- When prompted for the Root Password, enter a good, secure password. No dictionary words
and should have some numbers in it.
- When prompted with "Add User", add a user (yourself would be good). Then continue on.
- Under Authentication Configuration, just go with the default (Shadow, MD5 Passwords but not NIS)
- When prompted for packages to Install, in the list of options I tend to go for the KDE desktop but
it is up to you to choose the desktop of your liking (Gnome or KDE). KDE presently seems slicker
and more oriented towards users though as mentioned above, there will be some extra work later to
get KDE working as Rredhat 6.1 seems to enable Gnome anyway.
- Change from old documentation for the following - select the extra Extra Documentation as
it may have information required to tighten up on security.
- When prompted for packages to Install, I tend to go for the defaults except:
- Deselect Gnome and go for KDE
- DOS/Windows Connectivity
- Graphics Manipulation
- Games
- Disable Dialup Workstation
- Development
- Extra Documentation
- Utilities
- I normally do not load Emacs (I am a "vi" type of person)
- I normally do not load Emacs with X windows (nuff said though
this can be quite user friendly if you don't like the UNIX "vi" editor)
- Important: to get all the compilers (C, C++ and Fortran), select the
C development, Development Libraries, C++ Development
then at the end, go into Select Individual Packages and select OK,
using the space bar, expand Development/Languages
and manually select egcs-g77 otherwise you will
not have a Fortran 77 compiler for compiling up crystallographic programs.
- Then select DONE to continue.
- If you are prompted about Dependencies, go with "Install packages to satisfy dependencies" and
continue.
- The install then does a "PCI Probe" and says it detects the video card, (in this case a
PCI Entry: 655555, X Server: SVGA)
A happy event indeed given getting X-windows to actually work can be a major pain and this is
encouraging. Thus select OK to continue; after which the relevant XFree-86 program will
be downloaded for installation.
- When prompted whether you wish to create a Boot Disk, you would normally say yes, but
I tend not to due to installing and reinstalling operating systems all the time.
- Redhat Install might(?) tell you it will be keeping a log of everything in /tmp/install.log With this
reassurance, continue by selecting OK
- Redhat Install will then create the partitions/filesystems then download the packages.
- Redhat will then say it is preparing to install, then will start downloading the packages
off the CD-ROM. Don't be too concerned if some things seem to stall for a
while or you get a long download time. This can change over time once it
starts getting into the install. In this example, it first stated that
package installation would take 2 to 3 hours, but this went down to 20 to 30 minutes
after the first few packages came across the net at this particular time.
- After downloading, Redhat will then do some post install configuration before
prompting for the Monitor Setup.
- After downloading, Redhat will then do some post install configuration before
prompting for the Monitor Setup.
- Be wary that giving the wrong monitor setup can dammage the video monitor so check this
out with the hardware manual.
(in this case, Extended Super VGA, 800x600 @ 60 Hz, 640 x 480 @ 72Hz; then 50-70 for vertical
Sync Range)
Also, if some of the following does go pear shaped, continue on
and after installation, you can run Xconfigurator to try another Xwindows setup. This
information is given below.
- Input the monitor details. If on probing, Redhat has a problem, just ignore it for now
and this can be fixed up later.
- Redhat will then run Xwindows. Click OK if you get the screen. Do not be worried
if the screen is a bit strange, we will fix this in the post install fixup. When prompted if you
want to start X on booting, I tend to respond No. I like to boot up in the command line, then
type "startx" to start Xwindows.
- At this point, the Installer should be saying something like Congratulations. (If not,
such is life and it implies things are not happy - most likely in the file partitions)
Before selecting OK to continue, take out the
Boot Floopy you created and if you used a commercial CD or generated a CD from an ISO,
remove the CD as well (it could be bottable) otherwise. If you don't do this, on reboot, it will
prompt to re-install the operating system. If you do end
up booting from the Boot Floppy or CD-ROM. into the installer, exit at first available
opportunity. (or
press [CNTRL] [ALT] [DELETE] to restart)
- When the PC restarts, you should now be prompted with HD/1 Press 2 (the second
primary partition) to boot up linux. (A minimalist boot manager I have already admitted but
it should get the job done in a reproduceable manner - But installing a more visually
exiting menu implementation of the boot manager is described above)
Post Install Fixup for Redhat 6.1 Linux
- While Redhat 6.1 may have given the impression that things went OK. It is probably that
a few things did not actually get implemented as advertised. Thus reboot redhat and log
in as root and we will get into the fixing up and securing the installation.
- Try and ping a local or foreign computer, e.g., "ping www.apple.com. If you get no response
or a host unknown, it would look like Redhat did not correctly setup the network. This can be
fixed in a relatively user-friendly way by running linuxconf from the command line. The
main problem is usually the default domain and DNS server information not be retained correctly.
- As root, run linuxconf from the command line.
- Redhat Linux 6.1 is quite woeful in letting lots of un-necessary services run that could be
a hacker's dream so, we will be runing these off.
- As root, run /usr/sbin/setup and enter System Services. From the menu, disable:
- inet
- linuxconf (deamon)
- lpd
- portmap
- sendmail
- The above changes in services will be enabled on reboot.
- Redhat 6.1 probably did OK in correctly setting up the Desktop Video card and monitor. If it didn't
and stuffed up the config of the Xserver/Xwindows, we can again go into
/usr/sbin/setup and fix this up. Thus tpye /usr/sbin/setup and go into the X configuration.
- Continue when given a welcome message
- The PCI Probe should then detect the Chips and Technologies 65555 card
- In the above case, use the custom setup to set the monitor setting.
- Then Probe (this time it should work)
- When "Probing Finished" message comes up, do not accept the 8 bit colour depth and
instead select Let me Choose, and for this video card go for "16 bit, 800x600".
- Not let X be tested.
- Confirm that you can see this message and as per personal preference, I will not have
X start up on booting.
- Once back in Text Mode Setup program, you can quit.
- To not advertise port 6000 while running Xwindows, edit the "/usr/X11R6/bin/startx" file
and under "clientargs" and "serverargs" add -nolisten tcp within the quotes.
- Even though KDE was requested, Redhat 6.1 will try and force GNOME GUI desktop on you.
To get around this (KDE is on the system), goto your home directory (as a plain user)
and edit a new file called .xsession which has the line of startkde in it.
Then copy .xsession to .xinitrc (cp .xsession .xinitrc)
- Now might be a good time to reboot to enable all the above changes to the network services .
- Warning: Doing the following - and even just downloading nmap - may be a sackable offense
in many organisations. Check with your network support group first before downloading nmap and any other related
tools.
Providing this is consistent with your network usage policies,
you can now try running a "scanner/probe" on the new Linux machine once it is connected to
the network. A very good scanner program is nmap (http://www.insecure.org/nmap/).
Nmap (using "nmap -sS -O -vv 127.0.0.1") should say there are no open ports.
Then run Xwindows (using the startx command), nmap should still state that there are no open ports. If
there are open ports, you may have forgot to turn a System Service off when using /usr/sbin/setup.
- When running KDE desktop, you can change that the active Window is the one the Mouse is over by
going into Settings, Window Behavoir, Properties
and set "Focus Policy" to Focus Follows Mouse.
- NOTE: When running System S single crystal suite by Ton Spek; in
for Redhat 6 and Redhat 6.1, bash shell causes a core dump so run "cshell" (type csh)
Things to do Now that Basic Linux has been Installed
- For some strange reason, Redhat put updates in a separate area and has no transparent way to
check for updates during and after installation. So when installing a version of Redhat fresh
off the internet, you may still be getting the old, buggy programs that may have security flaws. Thus
go to the Redhat website and find out what updates are available and relevant for your installation.
To to the updates directory at the FTP site you are downloading from; grab and install any updates
for programs you are using. These are in the form of RPMs. Thus install via rpm -Uvh filename.rpm.
An automatic/pseudo-transparent way of doing automatic updates or packages and RPMs with Redhat Linux
(and other versions of Linux) is to use autorpm that will do all of this for you once it
has been installed.
Debian Linux does a much better job of this having an automated update system warning that newer programs
are available. (http://www.debian.org using the apt program
- refer: http://www.debian.org/security/).
- You can now try running a "scanner/probe" on the new Linux machine once it is connected to
the network such as nmap (http://www.insecure.org/nmap/).
Nmap should say there are no open ports. Then run Xwindows (using the startx command), nmap should
still state that there are no open ports.
- Get and compile the excellent snarf program for being able to quickly get programs via FTP and HTTP via a command line -
http://www.xach.com/snarf/
ftp://ftp.mint.net/pub/snarf/snarf-latest.tar.gz
One of the advantages for UNIX is that it can work on a command line. Useful when you have limited memory or are
remotely logging in. Snarf can be a lifesaver to quickly pull over install files off the internet,
saving you loading up a GUI netscape or bothering with Lynx which can occassionaly be quite finicky for downloading.
- Compile/Install Secure Shell (SSH) for Linux
and disable superfluous inetd.conf based deamons - telnetd, logind, rshd - which should not be running
as inetd was disabled in the installation.
- Add a user or two (yourself for one). As per the above note: if you are adding
users and groups; check if they have to conform to some UID/GID naming scheme consistent over
the entire site.
- The above install makes this superfluous but just in case you did not go this way:
Disable unnecessary deamons in the portmapper, inetd.conf
(pretty much everything you don't need; ftpd, telnetd, fingerd, etc)
This means edit the /etc/inetd.conf file and remove everything you don't like the
look of. If you have installed SecureShell, you can pretty much REM out everything.
Then type killall -HUP inetd to restart inetd deamon.
- Refer to the TinityOS documentation which is quite excellent on how to
secure up and administer Linux - http://www.ecst.csuchico.edu/~dranch/LINUX/TrinityOS.wri
- For limiting hacking on your system, by default, Redhat Linux comes with TCPWrappers enabled (tcpd) - which
can protect defined services or a global ALL for programs run from within inetd.
Again, superfluous if you followed the above in disabling inetd but you may have ignored this advice.
Do a man tpcd which sort of describes what this is about and gives some examples.
If you only want people from your domain to be able to access services, following are examples of
/etc/hosts.allow and /etc/hosts.deny that you can modify. You can create a banner depending on whether
the user is authorized or not to use this service from the particular domain they are logging in from.
- /etc/hosts.deny
ALL: ALL : banners /usr/etc/tcpwrap/banner1
- /etc/hosts.deny
ALL: LOCAL, 127.0.0.1 : banners /usr/etc/tcpwrap/banner2
ALL: .dl.ac.uk, .ccp14.ac.uk : banners /usr/etc/tcpwrap/banner2
- Where the /usr/etc/tcpwrap/banner1 directory has files depending on the service you wish to
give a message about - ftpd nul rlogind telnetd
e.g, for telnetd:
*********************************************************
* UNAUTHORIZED ACCESS TO THIS MACHINE IS PROHIBITED *
(and very naughty) *
*********************************************************
- Where the /usr/etc/tcpwrap/banner2 directory has files depending on the service you wish to
give a message about - ftpd nul rlogind telnetd
e.g., for telnetd: Hello, Hello %u@%h.
- Unlike the standard UNIX portmapper, the Redhat linux portmapper is protected by TCP Wrappers as described above.
This is important if you are running NFS and allowing some systems to nfs mount your directory areas; and
limit probes on your system.
- Check around some Securing Linux sites for extra info on keeping your system "unhacked":
- Fill up hard-disk with stuff