Linux Networking and Security

  • View

  • Download

Embed Size (px)


Linux Networking and Security. Chapter 5. Configuring File Sharing Services. Configure an FTP server for anonymous or regular users Set up NFS file sharing between Linux and UNIX systems Understand NetWare NCP-Based file sharing Use SMB to share files and printers with Windows-based PCs. - PowerPoint PPT Presentation

Text of Linux Networking and Security

  • Linux Networking and SecurityChapter 5

  • Configuring File Sharing ServicesConfigure an FTP server for anonymous or regular usersSet up NFS file sharing between Linux and UNIX systemsUnderstand NetWare NCP-Based file sharing Use SMB to share files and printers with Windows-based PCs

  • Running an FTP serverThe File Transfer Protocol (FTP) was designed for efficient distribution of a single file to multiple remote clientsSome design characteristics of FTP:FTP operates in real-timeFTP was designed to be used by the public and this is called anonymous FTPFTP is very effective for transferring large filesFTP was not designed as a shared local disk

  • Using an FTP ClientAccessing an FTP site requires an FTP clientLinux includes a text-mode FTP client, some Linux systems include a newer and refined text-mode ftp system called ncftpAn FTP client session begins with the ftp commandIf the system connects, users are prompted for username and password

  • Using an FTP Client

  • Using an FTP Client

  • Using an FTP Client

  • Using an FTP Client

  • Introducing FTP ServersThe most widely used FTP server on Linux is the Washington University server, wu-ftpSetting up the FTP server is done via a number of configuration filesIn addition to configuration files, there is the anonymous user home directory:Anonymous users do not see the entire file system and are limited to a working area, or home directory that designates downloadable files

  • Introducing FTP Servers

  • Setting Up FTP Configuration FilesThe FTP server is configured using the ftpaccess file in the /etc directoryThere are three types of FTP users: Anonymous, Real, and GuestClasses of users can be created, which allow you to assign permissions based on groupingsPermit FTP users to perform file actions using a series of directives naming the file action, followed by yes or no, followed by the classes of user to which the directive applies

  • Setting Up FTP Configuration Files

  • Setting Up FTP Configuration Files

  • Sharing Files with NFSThe Network File System (NFS) provides access to remote files systems as if they are part of the local directory structureNFS was designed for permanent, long-term connections where remote file systems are used as part of the regular user environmentNFS does have security concerns and was designed with a trusted network in mindNFS is UNIX-centric and does not typically perform well with Windows or NetWare servers

  • Running the NFS DaemonsThe NFS protocol is implemented by several daemons, each handling different tasksNFS communication is built on the remote procedure call (rpc) systemThis system functions almost like a superserver in that programs are assigned an rpc numberA program called portmap watches for rpc requests from programs like NFS daemons, then maps them to TCP or UDP portsNFS uses the rpc.mountd daemon to make new connections

  • Accessing Remote NFSFile SystemsActing as a client to an NFS server is straightforward; use the mount command for any local hard disk partitioning containing a file system needing access The mount point must be created and the host must have allowed mounting of the directoryMount options include altering the default buffer size for NFS transfers, read-only or read-write permission, hard or soft mounts, and suppressing automatic mounting at system startup

  • Exporting Your File SystemUsing NFSTo make parts of your file system accessible over the network to other systems, NFS daemons must be running and NFS traffic must be allowed to pass between the hosts Beyond this, the /etc/exports file must be set up to define which of the local directories will be available to remote users and how each is usedNFS uses a security concept called squashing to prevent a user from gaining access to a user account (especially to the root account) simply because they have an ID on the NFS client

  • NetWare File and Printer SharingNetWare protocols can be used on Linux to act as NetWare file and print servers, or as a client to other NetWare servers To use either the client or server tools for NetWare, IPX must be installed on LinuxNetWare uses a transport protocol called the NetWare Core Protocol (NCP)NetWare is a dedicated network operating system, but in the context of Linux, these servers are limited to file and printer sharing

  • Accessing NetWare Serversas a ClientThe ncpfs package implements NCP and provides a number of client utilities allowing log in, file transfer, printing and so forthThe ncpfs package is not installed by defaultThe ncpfs utilities allow the specification of command-line parameters for server contactAlternatively, create a .nwclient file in the home directory that contains the NetWare default settings

  • Accessing NetWare Serversas a Client

  • Making Linux Into aNetWare ServerMost Linux distributions contain a package that lets a system emulate a NetWare serverThe Martin Stovers NetWare Emulator package (mars-nwe) provides NetWare-specific protocols In addition to NCP transport protocol, mars-nwe provides the NetWare Routing Information Protocol (RIP) and the Service Addressing Protocol (SAP) that let Linux act as a peer with other NetWare serversConfigure mars-nwe using the /etc/nwserv.conf

  • Windows File and Print Integration with SambaTo implement the Windows-based protocols such as Server Message Block (SMB), Common Internet File System (CIFS) and NetBIOS in Linux, use the Samba suiteThe server portion of Samba allows a Linux system to appear in Windows networks as if it were another Windows systemThe client portions of Samba also let Linux access Windows systems that are configured to share their resources

  • Using Samba Client UtilitiesSamba client utilities allow access to shared Windows resources as if another Windows-based computerThe smbclient utility is a command-line utility that allows logging into a Windows host, and interacting using a series of commandsTo graphically access a Windows system, mount a Windows share as part of Linux by the standard mount command using a file system type of smbfs Printing to a Windows printer is done using the smbprint command

  • Using Samba Client Utilities

  • Using Samba Client Utilities

  • Using Samba Client Utilities

  • Using Samba Client Utilities

  • Setting Up a Samba ServerSamba includes two server daemons:nmbd, which implements the NetBIOS servicesmbd, which implements the SMB file and print sharingBoth of these daemons must be running to implement a Samba serverBoth are managed using a single script in /etc/rc.d/init.dSamba configuration files are typically stored in /etc/samba

  • Creating Samba UsersThe user security model requires users to log in with a valid user name and password before using a share on the Samba serverSeveral utilities included with the Samba suite allow for everyone with a Linux user account to also log in via SambaThe following command creates a Samba password for all Linux users: cat /etc/passwd | > /etc/samba/smbpasswd

  • Using SWAT to Configure SMBSWAT is a browser-based graphical interface that sets up the smb.conf file, restarts the Samba server, and provides some status information on server utilizationSWAT runs a network service managed by the superserverTo use SWAT, the SWAT service must be included in the /etc/services fileSWAT must also be enabled in the superserver configuration

  • Using SWAT to Configure SMB

  • Using SWAT to Configure SMB

  • Using SWAT to Configure SMB

  • Accessing Samba from WindowsOnce a Samba server is up and running, there is access to Linux files and printers from any Windows-based hostAll that is required is the correct Windows networking configuration and a valid username and passwordSamba uses only TCP/IP, so TCP/IP should be configured in the Windows environment

  • Accessing Samba from Windows

  • Chapter SummaryFTP is a widely used Internet protocol that was designed for efficient transfer of files from a server to multiple clients at diverse locationsThe anonymous feature of FTP makes it popular for public download archivesTo access an FTP server, you can use the text-mode client, ftp, graphical clients such as gFTP or IglooFTP, or a Web browserThe standard FTP server is wu-ftpdYou can configure classes of users in ftpaccess, then assign permissions to perform different file actions

  • Chapter SummaryThe Network File System (NFS) lets you access remote file systems as part of your local directory structure by using the mount command to contact an NFS serverAn NFS server consists of several possible daemons; at the least, nfsd and rpc.mountd are requiredAn NFS server is configured using the /etc/exports file, which defines which local directories are available for remote users to mountNFS is prone to security holes, but it relies on several layers of security

  • Chapter SummaryThe NetWare network operating system can be emulated on Linux as a powerful file-and-print server using the mars-nwe packageThe mars-nwe NetWare emulator is configured using the /etc/nwserv.conf fileLinux can access NetWare servers as clients using the ncpfs package, which provides a number of command-line tools to manage NetWare serversWindows networking uses the NetBIOS and SMB (also called CIFS) protocols, both of which are implemented by the Samba suite in Linux

  • Chapter SummaryUsing the Samba client utility smbclient and mounting Windows file systems of type smbfs provide convenient access to shared resourcesA simple Samba server configuration in smb.conf involves defining the server name, basic security options