• IP

• Subnet mask
• Gateway
• Static vs. DHCP

• Interface
• Interface MAC.

By: Imran Afzal

[Link]
• Interface Detection
• Assigning an IP address
• Interface configuration files
• /etc/[Link]
• /etc/hostname
• /etc/sysconfig/network
• /etc/sysconfig/network-scripts/ifcfg-nic
• /etc/[Link]

• Network Commands
• ping
• ifconfig
• ifup or ifdown
• netstat
• tcpdump

By: Imran Afzal

[Link]
NIC = Network Interface Card

Example:
ethtool enp0s3

Other NICs
lo = The loopback device is a special interface that your computer uses to communicate
with itself. It is used mainly for diagnostics and troubleshooting, and to connect to servers
running on the local machine

virb0 = The virbr0, or "Virtual Bridge 0" interface is used for NAT (Network Address
Translation). Virtual environments sometimes use it to connect to the outside network

By: Imran Afzal

[Link]
NIC = Network Interface Card (PC or laptop)

NIC(Network Interface Card) bonding is 2G

also known as Network bonding. It can 1G + 1G
be defined as the aggregation or
combination of multiple NIC into a
single bond interface.
Redundancy High Availability
It’s main purpose is to provide high Link Aggregation
availability and redundancy
By: Imran Afzal
[Link]
• modprobe bonding
• modinfo bonding
• Create /etc/sysconfig/network-scripts/ifcfg-bond0
• Edit /etc/sysconfig/network-scripts/ethernet1
• Edit /etc/sysconfig/network-scripts/ethernet2

nic1

nic2
bond0

• Restart network = systemctl restart network

By: Imran Afzal
[Link]
 New Network Utilities
What we will learn in this lecture…

• Getting started with NetworkManager

• Network configuration methods
• nmtui
• nmcli
• nm-connection-editor
• GNOME Settings.

By: Imran Afzal

[Link]
 New Network Utilities
✓ Getting started with NetworkManager
• NetworkManager is a service that provides set of tools designed specifically to make it easier to
manage the networking configuration on Linux systems and is the default network management
service on RHEL 8
• It makes network management easier
• It provides easy setup of connection to the user
• NetworkManager offers management through different tools such as GUI, nmtui, and
nmcli.

By: Imran Afzal

[Link]
 New Network Utilities
✓ Network configuration methods
• nmcli – Short for network manager command line interface. This tool is useful when access to a
graphical environment is not available and can also be used within scripts to make network
configuration changes
• nmtui – Short for network manager text user interface. This tool can be run within any terminal
window and allows changes to be made by making menu selections and entering data
• nm-connection-editor - A full graphical management tool providing access to most of the
NetworkManager configuration options. It can only be accessed through the desktop or console
• GNOME Settings - The network screen of the GNOME desktop settings application allows basic
network management tasks to be performed

• Let’s practice in our Linux machine…

By: Imran Afzal

[Link]
 Manage Linux Networking

✓ Using nmcli to configure static IP

• # nmcli device (Get the listing of network interface)

• # nmcli connection modify enp0s3 [Link]

[Link]/24

• # nmcli connection modify enp0s3 [Link]

[Link]

• # nmcli connection modify enp0s3 [Link]

manual

• # nmcli connection modify enp0s3 [Link]

[Link]

• # nmcli connection down enp0s3 && nmcli

connection up enp0s3

• # ip address show enp0s3

By: Imran Afzal
[Link]
 Manage Linux Networking

✓ Adding secondary static IP using nmcli

• # nmcli device status

• # nmcli connection show –active

• # ifconfig

• # nmcli connection modify enp0s3 +[Link]

[Link]/24

• # nmcli connection reload

• # systemctl reboot

• # ip address show

By: Imran Afzal

[Link]
• yum (CentOS), apt-get (other Linux)
• rpm (Redhat Package Manager)

By: Imran Afzal

[Link]
• Example of Windows browser

• Linux = wget

• Example in Linux:
wget [Link]

• Why???
Most of the servers in corporate
environment do NOT have internet access
By: Imran Afzal
[Link]
• Example of Windows browser

• Linux = curl
• Linux = ping

• Example in Linux:
curl [Link]
curl –O [Link]

ping [Link]
By: Imran Afzal
[Link]
 FTP – File Transfer Protocol
• The File Transfer Protocol is a standard network protocol used for the transfer of
computer files between a client and server on a computer network. FTP is built
on a client-server model architecture using separate control and data
connections between the client and the server. (Wikipedia)

• Protocol = Set of rules used by computers to communicate

• Default FTP Port = 21

• For this lecture we need 2 Linux machines

• Client = MyFirstLinuxVM
• Server = LinuxCentOS7

By: Imran Afzal

[Link]
 FTP – File Transfer Protocol
• Install and Configure FTP on the remote server
• # Become root
• # rpm –qa | grep ftp
• # ping [Link]
• # yum install vsftpd
• # vi /etc/vsftpd/[Link] (make a copy first)

• Find the following lines and make the changes as shown below:
• ## Disable anonymous login ##
• anonymous_enable=NO

• ## Uncomment ##
• ascii_upload_enable=YES
• ascii_download_enable=YES

• ## Uncomment - Enter your Welcome message - This is optional ##

• ftpd_banner=Welcome to UNIXMEN FTP service.

• ## Add at the end of this file ##

• use_localtime=YES

• # systemctl start vsftpd

• # systemctl enable vsftpd
• # systemctl stop firewalld
• # systemctl disable firewalld
• # useradd iafzal (if the user does not exist). By: Imran Afzal
[Link]
 SCP – Secure Copy Protocol
• The Secure Copy Protocol or “SCP” helps to transfer computer files securely
from a local to a remote host. It is somewhat similar to the File Transfer Protocol
“FTP”, but it adds security and authentication

• Protocol = Set of rules used by computers to communicate

• Default SCP Port = 22 (same as SSH)

• For this lecture we need 2 Linux machines

• Client = MyFirstLinuxVM
• Server = LinuxCentOS7

By: Imran Afzal

[Link]
 SCP – Secure Copy
• SCP commands to transfer file to the remote server:

• Login as yourself (iafzal)

• touch jack
• scp jack iafzal@192.168.1.x:/home/iafzal
• Enter username and password

By: Imran Afzal

[Link]
 rsync – Remote Synchronization
• rsync is a utility for efficiently transferring and synchronizing files within the
same computer or to a remote computer by comparing the modification times
and sizes of files

• rsync is a lot faster than ftp or scp

• This utility is mostly used to backup the files and directories from one server to
another

• Default rsync Port = 22 (same as SSH)

• For this lecture we need 2 Linux machines

• Client = MyFirstLinuxVM
• Server = LinuxCentOS7

By: Imran Afzal

[Link]
rsync – Remote Synchronization

Client = A Server = B
ssh
rsync

2M 2M 2M sshd = 22

8M 8-2 = 6 8M
20M 20-8 = 12 20M

By: Imran Afzal

[Link]
 rsync – Remote Synchronization
• Basic syntax of rsync command
• # rsync options source destination

• Install rsync in your Linux machine (check if it already exists)

• # yum install rsync (On CentOS/Redhat based systems)
• # apt-get install rsync (On Ubuntu/Debian based systems)

• rsync a file on a local machine

• $ tar cvf [Link] . (tar the entire home directory (/home/iafzal)
• $ mkdir /tmp/backups
• $ rsync -zvh [Link] /tmp/backups/

• rsync a directory on a local machine

• $ rsync -azvh /home/iafzal /tmp/backups/

• rsync a file to a remote machine

• $ mkdir /tmp/backups (create /tmp/backups dir on remote server)
• $ rsync -avz [Link] iafzal@192.168.1.x:/tmp/backups

• rsync a file from a remote machine

• $ touch serverfile
• $ rsync -avzh iafzal@192.168.1.x:/home/iafzal/serverfile /tmp/backups By: Imran Afzal
[Link]
• Two type of upgrades yum update vs. upgrade
Major version = 5, 6, 7
Minor version = 7.3 to 7.4 upgrade = delete packages

Major version = yum command update = preserve

Minor version = yum update

Example:
yum update –y

By: Imran Afzal

[Link]
• What is local repository?

Repos
Repos

Redhat or CentOS
Linux repository
Server

• Command
createrepo
By: Imran Afzal
[Link]
 Rollback Updates and Patches

• Virtual machine
• Physical machine

• Rollback a package or patch

• yum install <package-name>
• yum history undo <id>

• Rollback an update
• Downgrading a system to minor version (ex: RHEL7.1 to RHEL7.0) is not
recommended as this might leave the system in undesired or unstable state

• yum update= Update will preserve them

• yum upgrade = Upgrade will delete obsolete packages
• yum history undo <id>

By: Imran Afzal

• Purpose?
Hostname to IP (A Record)
IP to Hostname (PTR Record)
Hostname to Hostname (CNAME Record)

• Files
/etc/[Link]
/var/named

• Service
systemctl restart named

By: Imran Afzal

[Link]
 Download, Install and Configure DNS
• Create a snapshot of your virtual machine
• Setup:
• Master DNS
• Secondary or Slave DNS
• Client

• Domain Name = [Link]

• IP address = My local IP address on enp0s3

• Install DNS package

• yum install bind bind-utils –y

• Configure DNS (Summary)

• Modify /etc/[Link]
• Create two zone files ([Link] and [Link])
• Modify DNS file permissions and start the service

• Revert back to snapshot

By: Imran Afzal
[Link]
• Commands used for DNS lookup
• nslookup
• dig

By: Imran Afzal

[Link]
• Purpose?
Time synchronization

• File
/etc/[Link]

• Service
systemctl restart ntpd

• Command
ntpq

By: Imran Afzal

[Link]
 New System Utility Command (timedatectl)

• The timedatectl command is a new utility for RHEL/CentOS 7/8 based distributions, which comes as a
part of the systemd system and service manager
• It is a replacement for old traditional date command
• The timedatectl command shows/change date, time, and timezone
• It synchronizes the time with NTP server as well
• You can either use chronyd or ntpd and make the ntp setting in timedatectl as yes
• Or you can use systemd-timesyncd daemon to synchronize time which is a replacement for ntpd and
chronyd

Please note:
Redhat/CentOS does not provide this daemon in its standard repo. You will have to download it separately.

By: Imran Afzal

[Link]
• Purpose = Serve webpages

• Service or Package name = httpd

• Log Files = /var/log/httpd/
• Files = /etc/httpd/conf/[Link]
= /var/www/html/[Link]

• Service
systemctl restart httpd
systemctl enable httpd

By: Imran Afzal

[Link]
• Purpose = Generate logs or collect logs from other servers

Client
• Service or package name = rsyslog

• Configuration file= /etc/[Link]

• Service Client Server Client

systemctl restart rsyslog

systemctl enable rsyslog

Client

By: Imran Afzal

[Link]
 Linux OS Hardening
• User Account
• Remove un-wanted packages
• Stop un-used Services
• Check on Listening Ports
• Secure SSH Configuration
• Enable Firewall (iptables/firewalld)
• Enable SELinux
• Change Listening Services Port Numbers
• Keep your OS up to date (security patching)

By: Imran Afzal

[Link]
 Trace Network Traffic (traceroute)
• The traceroute command is used in Linux to map the journey that a packet
of information undertakes from its source to its destination. One use for
traceroute is to locate when data loss occurs throughout a network, which
could signify a node that's down.
• Because each hop in the record reflects a new server or router between
the originating PC and the intended target, reviewing the results of a
traceroute scan also lets you identify slow points that may adversely affect
your network traffic.

• Example
# traceroute [Link]

By: Imran Afzal

[Link]
 Configure and Secure SSH

• SSH
• SSH stands for secure shell
provides you with an interface to the Linux system. It takes in
your commands and translate them to kernel to manage hardware

pwd

$ bash
csh ksh

# ls
Hardware
cp

• Open SSH is a package/software Kernel

• Its service daemon is sshd

Shell
• SSH port # 22
Utilities
By: Imran Afzal
[Link]
 Configure and Secure SSH

• SSH itself is secure, meaning communication through SSH is always encrypted, but there
should be some additional configuration can be done to make it more secure
• Following are the most common configuration an administrator should take to secure SSH

✓ Configure Idle Timeout Interval

Avoid having an unattended SSH session, you can set an Idle timeout interval

▪ Become root
▪ Edit your /etc/ssh/sshd_config file and add the following line:
▪ ClientAliveInterval 600
▪ ClientAliveCountMax 0
▪ # systemctl restart sshd

The idle timeout interval you are setting is in seconds (600 secs = 10 minutes). Once the interval
has passed, the idle user will be automatically logged out
By: Imran Afzal
[Link]
 Configure and Secure SSH

✓ Disable root login

Disabling root login should be one of the measures you should take when setting up
the system for the first time. It disable any user to login to the system with root
account

▪ Become root
▪ Edit your /etc/ssh/sshd_config file and replace PermitRootLogin yes to no
▪ PermitRootLogin no
▪ # systemctl restart sshd

By: Imran Afzal

[Link]
 Configure and Secure SSH

✓ Disable Empty Passwords

You need to prevent remote logins from accounts with empty passwords for
added security.

▪ Become root
▪ Edit your /etc/ssh/sshd_config file and remove # from the following line
▪ PermitEmptyPasswords no
▪ # systemctl restart sshd

By: Imran Afzal

[Link]
 Configure and Secure SSH

✓ Limit Users’ SSH Access

To provide another layer of security, you should limit your SSH logins to only certain
users who need remote access

▪ Become root
▪ Edit your /etc/ssh/sshd_config file and add
▪ AllowUsers user1 user2
▪ # systemctl restart sshd

By: Imran Afzal

[Link]
 Configure and Secure SSH

✓ Use a different port

By default SSH port runs on 22. Most hackers looking for any open SSH servers will
look for port 22 and changing can make the system much more secure

▪ Become root
▪ Edit your /etc/ssh/sshd_config file and remove # from the following line and
change the port number
▪ Port 22
▪ # systemctl restart sshd

By: Imran Afzal

[Link]
 Configure and Secure SSH

✓ SSH-Keys - Access Remote Server without Password

Watch the next video

By: Imran Afzal

[Link]
 Configure and Secure SSH
Access Remote Server without Password (SSH-Keys)

• Two reasons to access a remote machine

• Repetitive logins
• Automation through scripts

• Keys are generated at user level

• iafzal
• root
By: Imran Afzal
[Link]
 Configure and Secure SSH
Access Remote Server without Password (SSH-Keys)
Server = LinuxCentOS7
Client = MyFirstLinuxVM
SSH

Username?
Password?

Generate Keys Copy over the Keys from

client to server Username?
Password?

Client = MyFirstLinuxVM SSH

Step 1 — Generate the Key
# ssh-keygen

Step 2 — Copy the Key to the server

# ssh-copy-id root@192.168.1.x

Step 3 — Login from client to server

# ssh root@192.168.1.x
# ssh –l root 192.168.1.x
By: Imran Afzal
[Link]
 SSH without a Password
• SSH is a secure way to login from host A to host B
• Repetitive tasks require login without a password

What we will learn…

• How to generate SSH keys on the server
• Add SSH keys to the client
• Verify by logging through SSH.

By: Imran Afzal

[Link]
Access Remote Server without Password (SSH-Keys)

• Two reasons to access a remote machine

• Repetitive logins
• Automation through scripts

• Keys are generated at user level

• iafzal
• root

By: Imran Afzal

[Link]
 Access Remote Server without Password (SSH-Keys)
Client = MyFirstLinuxVM Server = LinuxCentOS7
SSH

Username?
Password?

Generate Keys Copy over the Keys from

client to server Username?
Password?

SSH
Client = MyFirstLinuxVM
Step 1 — Generate the Key
# ssh-keygen

Step 2 — Copy the Key to the server

# ssh-copy-id root@192.168.1.x

Step 3 — Login from client to server

# ssh root@192.168.1.x
# ssh –l root 192.168.1.x
By: Imran Afzal
[Link]
 Introduction to Firewall 1/2

• What is Firewall
• A wall that prevents the spread of fire

• When data moves in and out of a server its packet information is tested against the
firewall rules to see if it should be allowed or not

• In simple words, a firewall is like a watchman, a bouncer, or a shield that has a set
of rules given and based on that rule they decide who can enter and leave

• There are 2 type of firewalls in IT

• Software = Runs on operating system

• Hardware = A dedicated appliance with firewall software

By: Imran Afzal

[Link]
 Introduction to Firewall 2/2

rule = A is allowed for 22

SSH = 22

Connection established
B
A

rule = A is NOT allowed for ftp

ftp = 21

Connection refused
B
A

By: Imran Afzal

[Link]
 Firewall (iptables – tables, chains and targets) 1/4

• There are 2 tools to manage firewall in most of the Linux distributions

• iptables = For older Linux versions but still widely used
• firewalld = For newer versions like 7 and up

• You can run one or the other

• In this lecture we will work with iptables to manage firewall

• Before working with iptables make sure firewalld is not running and disable it
• service OR systemctl stop firewalld = To stop the service
• systemctl disable firewalld = To prevent from starting at boot time
• systemctl mask firewalld = To prevent it from running by other programs

• Now check if you have iptables-services package installed

• rpm –qa | grep iptables-services
• yum install iptables-services - If not installed then

• Start the service

• systemctl start iptables
• systemctl enable iptables

• To check the iptables rules

• iptables –L

• To flush iptables.
• iptables -F By: Imran Afzal
[Link]
 Firewall (iptables – tables, chains and targets) 2/4

• The function of iptables tool is packet filtering

• The packet filtering mechanism is organized into three different kinds of structures: tables, chains
and targets

1. tables = table is something that allows you to process packets in specific ways. There
are 4 different types of tables, filter, mangle, nat and raw

2. chains = The chains are attached to tables, These chains allow you to inspect traffic at
various points. There are 3 main chains used in iptables
▪ incoming traffic
▪ going to a router, from one device to another
▪ outgoing traffic
• chains allow you to filter traffic by adding rules to them
• Rule = if traffic is coming from [Link] then go to defined target

3. targets = target decides the fate of a packet, such as allowing or rejecting it. There are 3
different type of targets
▪ connection accepted
▪ Send reject response
▪ drop connection without sending any response

By: Imran Afzal

[Link]
 Firewall (iptables – tables, chains and targets) 3/4

Let’s draw it out:

Table

If IP, port etc. matches

Rule

Rule

Rule

chains Target

• To check the iptables rules

• iptables -L

By: Imran Afzal

[Link]
 Firewall (iptables – tables, chains and targets) 4/4

Output of iptables -L Types of chain

chain

The destination IP address or subnet of the

traffic, or anywhere

The source IP address or subnet of the traffic, or anywhere

Rarely used, this column indicates IP options

Target The protocol, such as tcp, udp, icmp, or all

By: Imran Afzal

[Link]
 Firewall (iptables – practical examples) 1/2

• Drop all traffic coming from a specific IP ([Link])

• iptables –A INPUT –s [Link] –j DROP

• Drop all traffic coming from a range of IPs ([Link])

• iptables –A INPUT –s [Link]/24 –j DROP

• List all rules in a table by line numbers

• iptables –L --line-numbers

• Delete a specific rule by line number

• iptables –D INPUT 1

• To flush the entire chain

• iptables –F

• To block a specific protocol with rejection (e.g. ICMP)

• iptables -A INPUT -p icmp -j REJECT

• To block a specific protocol without rejection (e.g. ICMP)

• iptables -A INPUT -p icmp -j DROP

• To block a specific port # (e.g. http port 80)

• iptables -A INPUT -p tcp --dport 80 -j DROP
By: Imran Afzal
[Link]
 Linux Firewall (iptables – practical examples) 2/2

Practical:

• Block connection to a network interface

• iptables -A INPUT -i enps03 -s [Link] -j DROP

• Drop all traffic going to [Link]

• host -t a [Link] = find IP address
• iptables –A OUTPUT –d [Link] –j DROP
• IMPORTANT: The iptables read the rules in
• Block all outgoing traffic to a network range sequence
• iptables –A OUTPUT –d [Link]/24 –j DROP • DROP first then it will drop all
without going to the next one
• Block all incoming traffic except SSH • So make sure to ACCEPT first with –I
• iptables -A INPUT -p tcp --dport 22 -j ACCEPT option instead of -A
• iptables -P INPUT DROP

• After making all the changes save the iptables. Again make sure firewalld is not running
• iptables-save = The file is save in /etc/sysconfig/iptables

• iptables saved file can also be restored

• iptables-restore /LOCATION/FILENAME

• By default everything is logged in

• /var/log/messages
By: Imran Afzal
[Link]
 Firewall (firewalld) 1/2

• Firewalld works the same way as iptables but of course it has it own commands
• firewall-cmd

• It has a few pre-defined service rules that are very easy to turn on and off
• Services such as: NFS, NTP, HTTPD etc.

• Firewalld also has the following:

• Table
• Chains
• Rules
• Targets

By: Imran Afzal

[Link]
 Firewall (firewalld) 2/2

• You can run one or the other

• iptables or firewalld

• Make sure iptables is stopped, disabled and mask

• systemctl stop iptables
• systemctl disable iptables
• systemctl mask iptables

• Now check if filewalld package is installed

• rpm –qa | grep firewalld

• Start firewalld
• systemctl start/enable firewalld

• Check the rule of firewalld

• firewall-cmd --list-all

• Get the listing of all services firewalld is aware of:

• firewall-cmd --get-services

• To make firewalld re-read the configuration added

• firewall-cmd --reload
By: Imran Afzal
[Link]
 Firewall (firewalld – Practical Examples) 1/3

• The firewalld has multiple zone, to get a list of all zones

• firewall-cmd --get-zones

• To get a list of active zones

• firewall-cmd --get-active-zones

• To get firewall rules for public zone

• firewall-cmd --zone=public --list-all
OR
• firewall-cmd --list-all

• All services are pre-defined by firewalld. What if you want to add a 3rd party service
• /usr/lib/firewalld/services/[Link]
• Simply cp any .xml file and change the service and port number

Version of XML

Service
Service

Port
Description By: Imran Afzal
[Link]
 Firewall (firewalld – Practical Examples) 2/3

• To add a service (http)

• firewall-cmd --add-service=http

• To remove a service
• firewall-cmd --remove-service=http

• To reload the firewalld configuration

• firewall-cmd --reload

• To add or remove a service permanently

• firewall-cmd --add-service=http --permanent
• firewall-cmd --remove-service=http --permanent

• To add a service that is not pre-defined by firewalld

• /usr/lib/firewalld/services/[Link]
• Simply cp any .xml file [Link] and change the service and port number (32)
• systemctl restart firewalld
• firewall-cmd --get-services (to verify new service)
• Firewall-cmd --add-service=sap

By: Imran Afzal

[Link]
 Firewall (firewalld – Practical Examples) 3/3

• To add a port
• firewall-cmd --add-port=1110/tcp

• To remove a port
• firewall-cmd --remove-port=1110/tcp

• To reject incoming traffic from an IP address

• firewall-cmd --add-rich-rule='rule family="ipv4" source address=“[Link]" reject’

• To block and unblock ICMP incoming traffic

• firewall-cmd --add-icmp-block-inversion
• firewall-cmd --remove-icmp-block-inversion

• To block outgoing traffic to a specific website/IP address

• host -t a [Link] = find IP address
• firewall-cmd --direct --add-rule ipv4 filter OUTPUT 0 -d [Link] -j DROP

By: Imran Afzal

[Link]
 Tune System Performance 1/8

Linux system comes fined tunned by default when you install, however there are a few tweaks
that can be done based on system performance and application requirements

In this lesson we will learn…

• Optimize system performance by selecting a tuning profile managed by the tuned daemon
• Prioritize or de-prioritize specific processes with the nice and renice commands

By: Imran Afzal

[Link]
 Tune System Performance 2/8

What is tuned?

• Tuned pronounced as tune-d

• Tune is for system tuning and d is for daemon
• It is systemd service that is used to tune Linux system performance
• It is installed in CentOS/Redhat version 7 and 8 by default
• tuned package name is tuned
• The tuned service comes with pre-defined profiles and settings (List of profile will be discussed in the next page)
• Based on selected profile the tuned service automictically adjust system to get the best
performance. E.g. tuned will adjust networking if you are downloading a large file or it will adjust
IO settings if it detects high storage read/write
• The tuned daemon applies system settings when the service starts or upon selection of a new
tuning profile.

By: Imran Afzal

[Link]