Linux Knowledge Point Summary _linux

1 My Linux requirements

I'm talking about the need for online Linux, so I'm just talking about a stable release and a more conservative version. For example, CentOS 7 XFS is not discussed, not to say that XFS is not good, but at present my Linux level needs to update a lot of XFS knowledge, the ride takes time. CentOS 7 will ifconfig,netstat and so on the original commonly used orders also killed. Let's use CentOS 6 as a base to talk about my basic requirements for Linux.

1.1 Minimal Installation

CentOS has a minimal version, compared to the standard version of the removal of a lot of service, such as network Manger, installed after the minimum version of the network configuration is required admin for the full manual configuration file configuration. I personally think this is better because you can better understand how the Linux kernel looks at these configuration files, which are really needed by the kernel, and those that are modified to directly change to the kernel's performance. For some of the necessary monitoring tools, can be completed through Yum install. The Standard Edition is more suitable for normal practice, as an online machine, or minimize the installation, do not open the service will not open, can be turned off the port to turn off, so that the precious hardware resources can be left to the application, but also to do more security, because the entrance of the attack is through the network.

1.2 Safe enough

In addition to turning off the ports that can be turned off and switching off services that are not available, security also requires that specific services be accessible only to specific content. Even in the root account, files and folders that cannot be accessed are inaccessible and cannot be manipulated. Because it is very likely that an attacker acquires root privileges, this is essentially nothing. After the SELinux is opened, the specified service can only access the specified resource without modifying the SELinux.

1.3 Resource on-demand scheduling

We often encounter such a problem, suppose the disk SDA mount to the/var directory, but because the log is too many or uploaded files and so on other factors to eat up the hard disk, and then create a SDB disk can not mount to the/var directory, in fact, the Linux self-contained LVM has solved this problem, and CentOS The default is to use LVM to manage the disk. We need to learn how to format a hard disk as an LVM and then mount it to the corresponding directory, and then add a hard disk before the space is eaten up to enlarge automatically.

1.4 Network Monitoring

The white is in the Linux local use good iptables, to plan the service which network traffic, discards which network traffic. As well as in the network when the need to use router for the creation of the gateway, in the face of networking problems through the Netstat to view network access anomalies. Network this piece of content a lot of miscellaneous, various parameters, TCP/IP protocol stack, etc., but often the problem is out of the network, so to give a high degree of concern.

2 concept and foundation of Linux

To Linux admiration such as the surging River ^_^, small talk about some of my understanding of Linux.

2.1 Linux File system

Linux sees everything as a file, and everyone knows it. What I want to say is that, in addition to the traditional ext file system, Linux in the abstraction of different resources in fact there are a variety of file systems, are from the needs and use, how convenient how to come, such as proc file system is for the process of abstraction, so that modify the value of the corresponding process can directly change the behavior of the process. For example, for remote SSH log on the PTS device, Linux has the corresponding devpts file system.

2.2 Linux's Rights Management

Linux-rwxrwxrwx Rights Management is also known as people, in fact, Linux itself is aware of the limitations of such a permission to manage. First of all, RWX's rights management is based on users and groups, and is only roughly divided into owner|group|other these three categories, can no longer be more fine-grained division. In view of this, Linux is currently managed by default ACL (Access control List), the so-called ACL is able to provide a more fine-grained user and group management, such as to clarify which user can have what permissions. The following example

GETFACL ABC
# FILE:ABC
# owner:someone
# group:someone
user::rw-
user:johny:r-x group::r--
mask::r-x
other::r--

And SELinux provides not based on user and group Rights Management, SELinux is based on the application, what kind of applications can use what resources, for these resources the application is capable of, this is the SELinux management method.

2.3 The service on Linux

The service on Linux is organized very clearly and, of course, by tradition. /etc/init.d/contains all the service startup scripts, the corresponding binaries in/usr/bin,/usr/sbin,/usr/local/bin directory, in general, the configuration file in/etc/app_name, There is also a chkconfig tool to manage the service that needs to be started under each runlevel. Such conventions make it very convenient for administrators to configure and use them. Linux standard service will log logs into the/var/log/messages, so that the system administrator does not need to read a variety of log, directly in the/var/log/messages can find most of the log to determine whether the current system is normal. Even more, after the SYSLOGD is replaced by RSYSLOGD, the contents of the/var/log/messages can be sent via UDP to the remote end with a professional log analysis tool for analysis. We need to learn these excellent programming habits and techniques for the service on Linux.

3 disk

Depending on the requirements in, it is primarily the creation of LVM under Linux, as well as some basic disk operations.

• Df-lah to view disk usage
• Fdisk-l View the hard drive inserted into the disk drive; SD (A,B,C) (1,2,3), where a is the first disk, B is the second disk, and 1,2,3 represents the primary partition on the disk, up to 4. Use Fdisk to create partitions from disk and format them.
• LVM (Logical Volume manager), mainly to meet the hard drive can write data directly, without the disk full, and then hang. LVM has several concepts, VG, PV, LVM, format the disk LVM, create PV, create the VG, add the PV to the VG, and then create the LVM in VG, then you can dynamically increase the size. Note that the disk is formatted as LVM, but the LV format needs to be ext before it can be mount. Refer to this article CentOS 6-volume group mounted hard disk tutorial
• MOUNT-T type (EXT4|NFS)/dev/sdxn/path/dir to mount. If you want the reboot to take effect, you must write the mount information to the/etc/fstab
• Disk IO efficiency (IOPS) needs to be viewed with tools such as Vmstat, top, and so on.

4 Network

The network pit is many, need to put the network straightened not a 3, 4 years difficult. The following from the network's basic configuration file, a simple way to sort out the content of the network. The most difficult aspect of the network should be how to build a reasonable and efficient LAN or metropolitan area network, this need to have professional network knowledge.

4.1 Configuration Files

/etc/hosts private IP corresponding host name
IP for/etc/resolv.confnameserver DNS
/etc/sysconfig/network which networking= want to have network, hostname= host name, networking_ipv6= support IPv6 No
/etc/sysconfig/network-scripts/ifcfg-xxx which device= network card code, bootproto= whether to use Dhcp,hwaddr,ipaddr,netmask,onboot,gateway
4.2 Network design to some of the commands

Router-n View the routing commands, especially if you want to see the Gateway with G, and the representation with U up.
NETSTAT-ANP View the applications of all the Tcp,udp,unix stream launches, as well as their status, can refer to Tcp/ip,javasocket for a simple analysis of the article.
5 Security

5.1 PAM

Pam on the whole simply need to understand on the line, is a pluggable authentication module. In my opinion, it is a reusable component of the Geek who developed Linux. For example, now there is an app that wants to verify that the current logged-on user has permission to manipulate a directory, so there are ready-made modules in Pam, and the app just needs to include this module, give a configuration file, and it's OK. There is a very good video tutorial on Pam, please see here

• Pam is used by applications for authentication. Early authentication and the application itself were coupled, and then the authentication was extracted separately and managed via Pam
• /ETC/PAM.D/XXX is an application Pam setting that can be managed with Pam and is installed when the application is installed. /etc/security/mmm,/lib/security/pam_mmm is a set.
• In general, Pam uses the mechanism provided by the Linux system itself to authenticate

5.2 SELinux

About SELinux also has a very good video tutorial, please see here

• Getenforce to see if SELinux is enabled
• /etc/sysconfig/selinux enforcing Enable SELinux
• SELinux configures and checks for "run program" to manipulate the "object" (file system), whereas a normal ACL (RWX) is based on the owner of the file and the group it belongs to. SELinux depends on whether the bin's type and directory file type are compatible to determine whether the bin can manipulate resources
  

5.3 Firewall

For Iptables is also a smattering of knowledge, so the following is only a few excerpts from learning time. In particular, to open the kernel parameter net.ipv4.ip_forward=1, in the/etc/sysctl.conf file, use Sysctl-p to save. The so-called Ip_forward refers to the kernel-supplied IP packet forwarding from one iface to another, such as forwarding IP packets from 192.168.1.10 eth0 to 10.0.0.123 eth1. Professional firewall configuration is a need for professional skills.

Tcp_wrapper need libwrap.so support, all the ldd out of the bin, can not use Tcp_wrapper
Iptables is based on the rules of short-circuit judgment, that is, meet the conditions 1-> execution action1-> end
Iptables-save to see more clearly
First delete all the rules, and then add, relatively simple. When you add, add the policy, and then add the detail rules. Generally speaking, what we need to focus on is the input and output of the filter table
Iptables-a (I) INPUT (Output,forward)-I (o) iface-p TCP (Ump,imp,all)-S (!) Source-d dest-j ACCEPT (Reject,drop), also supported parameters-dport-sport
6 Tools

A good Linux command reference site

6.1 CPU

• Top pay special attention to load
• PS aux and PS-EF special attention to process status
• Vmstat 1 means a collection per second
• Sar-u 1 View all CPU-related running times

6.2 Memory

• Free
• Vmstat 1 Note the relationship between the swap RAM blocks
• Sar-r 1 Memory usage
• Sar-w 1 View swap to see if a large memory exchange is generated due to insufficient memory
  

6.3 IO

• Lsof-i:port query which process is taking up this port number
• Lsof-u username User-opened files
• Lsof-p PID Process open files
  

Miscellaneous

A reference to the running script after the system is installed

#!/bin/bash flagfile= "/root/centos6-init.executed" PreCheck () {if [["$ (WhoAmI)"!= "root"]]; then echo "Please R Un this script as root. ">&2 Exit 1 fi if [f" $flagFile]; Then echo "This script had been executed, please don't execute again!!" >&2 exit 1 fi echo-e "\033[31m W arning! This SCRIPT would \033[0m\n "ECHO-E" \033[31m *1 update the system; \033[0m\n "ECHO-E" \033[31m *2 setup security permissions; \033[0m\n "ECHO-E" \033[31m *3 stop irrelevant services; \033[0m\n "Echo-e" \033[31m *4 reconfig kernel; \033[0m\n "ECHO-E" \033[31m *5 setup timezone and sync time periodically; \033[0m\n "ECHO-E" \033[31m *6 setup tcp_wrapper and NetFilter firewall; \033[0m\n "ECHO-E" \033[31m *7 setup vsftpd; \033[0m\n "Sleep 5} yum_update () {yum-y update #update system at 5:40pm Daily echo" 3 * * Root yum-y u Pdate && Yum Clean packages ">>/etc/crontab} permission_config () {#chattr +I/etc/shadow #chattr +i/etc/passwd} selinux () {sed-i ' s/selinux=disabled/selinux=enforcing/g '/etc/sysconfig/seli Nux Setenforce 1} stop_services () {for server in ' chkconfig--list |grep ' {print $} ' do 3:on|awk- -level 3 $server off doing for server in Crond network rsyslog sshd iptables do chkconfig--level 3 $server o N Done} limits_config () {cat >>/etc/security/limits.conf <<eof * Soft nproc 65535 * hard Nproc 65535 * FT nofile 65535 * Hard nofile 65535 EOF echo "Ulimit-sh 65535" >>/etc/rc.local} sysctl_config () {sed-i ' s/net.i pv4.tcp_syncookies.*$/net.ipv4.tcp_syncookies = 1/g '/etc/sysctl.conf sed-i ' S/net.ipv4.ip_forward.*$/net.ipv4.ip_ Forward = 1/g '/etc/sysctl.conf cat >>/etc/sysctl.conf <<eof net.ipv4.tcp_max_syn_backlog = 65536 NET.CORE.N Etdev_max_backlog = 32768 Net.core.somaxconn = 32768 Net.core.wmem_default = 8388608 Net.core.rmem_default = 8388608 net.c Ore.rmem_max = 16777216 Net.core. Wmem_max = 16777216 Net.ipv4.tcp_timestamps = 0 Net.ipv4.tcp_synack_retries = 2 net.ipv4.tcp_syn_retries = 2 net.ipv4.tcp _tw_recycle = 1 Net.ipv4.tcp_tw_reuse = 1 Net.ipv4.tcp_mem = 94500000 915000000 927000000 Net.ipv4.tcp_max_orphans = 32768
  Net.ipv4.ip_local_port_range = 1024 65535 EOF sysctl-p} sshd_config () {if [!-F "/root/.ssh/id_rsa.pub"]; then Ssh-keygen-t rsa-p '-f/root/.ssh/id_rsa cat/root/.ssh/id_rsa.pub >>/root/.ssh/authorized_keys chmod 600 /root/.ssh/authorized_keys fi #sed-i '/^ #Port/s/#Port 22/port 65535/g '/etc/ssh/sshd_config sed-i '/^ #UseDNS/s/#U
  Sedns no/usedns yes/g '/etc/ssh/sshd_config #sed-i ' s/#PermitRootLogin yes/permitrootlogin no/g '/etc/ssh/sshd_config Sed-i ' s/#PermitEmptyPasswords yes/permitemptypasswords no/g '/etc/ssh/sshd_config sed-i ' s/passwordauthentication ye S/passwordauthentication no/g '/etc/ssh/sshd_config/etc/init.d/sshd restart} time_config () {#timezone echo ' TZ= ' A Sia/shanghai '; Export TZ">>/etc/profile # Update time if [!] -F "/usr/sbin/ntpdate"]; Then yum-y install ntpdate fi/usr/sbin/ntpdate pool.ntp.org echo "3 * * * Root (/usr/sbin/ntpdate POOL.N tp.org &&/sbin/hwclock-w) &>/dev/null ">>/etc/crontab/sbin/service crond Restart} iptables () {Cat >/etc/sysconfig/iptables << EOF # Firewall configuration written by System-config-securitylevel # Manual C
Ustomization of this file isn't recommended. *filter:input DROP [0:0]: FORWARD ACCEPT [0:0]: OUTPUT ACCEPT [0:0]: Syn-flood-[0:0]-A input-i lo-j accept-a INPUT -M state--state related,established-j accept-a input-p tcp-m State--state new-m TCP--dport 22-j INPUT- p tcp -m state --state NEW -m tcp --dport 80 -j ACCEPT
-A INPUT -p icmp -m limit --limit 100/sec --limit-burst 100 -j ACCE  Pt-a input-p icmp-m limit--limit 1/s--limit-burst 10-j accept-a input-p tcp-m tcp--tcp-flags FIN,SYN,RST,ACK SYN -j syn-flood-a Input-jREJECT--reject-with icmp-host-prohibited-a syn-flood-p tcp-m limit--limit 3/sec--limit-burst 6-j return-a Syn-floo
  D-j REJECT--reject-with icmp-port-unreachable COMMIT eof/sbin/service iptables Restart Source/etc/profile} other () { # initdefault sed-i ' s/^id:.*$/id:3:initdefault:/'/etc/inittab/sbin/init Q # PS1 #echo ' ps1= ' \[\e[32m\][\[ \e[35m\]\u\[\e[m\]@\[\e[36m\]\h \[\e[31m\]\w\[\e[32m\]]\[\e[36m\]$\[\e[m\] "' >>/etc/profile # Wrong Password Five times locked 180s sed-i ' 4a auth required pam_tally2.so deny=5 unlock_time=180 '/etc/pam.d/system-auth} VSF Tpd_setup () {yum-y install vsftpd Mv/etc/vsftpd/vsftpd.conf/etc/vsftpd/vsftpd.conf.bak touch/etc/vsftpd/chroot_l 
ist setsebool-p ftp_home_dir=1 Cat >>/etc/vsftpd/vsftpd.conf <<eof # Normal user settings Local_enable=yes Write_enable=yes local_umask=022 Chroot_local_user=yes Chroot_list_enable=yes chroot_list_file=/etc/vsftpd/chroot_ List local_max_rate=10000000 #Anonymous settings Anonymous_enable=yes no_anon_password=yes anon_max_rate=1000000 data_connection_timeout=60 idle_ SESSION_TIMEOUT=600 # SSL Settings #ssl_enable =yes #allow_anon_ssl =no #force_local_data_ssl =yes #force_loca L_logins_ssl=yes #ssl_tlsv1 =yes #ssl_sslv2 =no #ssl_sslv3 =no #rsa_cert_file =/ETC/VSFTPD/VSFTPD.PEM # server Setti
NGS max_clients=50 max_per_ip=5 Use_localtime=yes dirmessage_enable=yes xferlog_enable=yes
Xferlog_std_format=yes listen=yes pam_service_name=vsftpd tcp_wrappers=yes #banner_file =/etc/vsftpd/welcome.txt 
 
Dual_log_enable=yes pasv_min_port=65400 pasv_max_port=65410 EOF chkconfig--level 3 vsftpd on service vsftpd Restart} Main () {PreCheck printf "\033[32m================%40s================\033[0m\n" "Updating the System" Yu M_update printf "\033[32m================%40s================\033[0m\n" "re-config permission" Permission_confi G printf "\033[32m================%40s================\033[0m\n "" Enabling SELinux "SELinux printf" \033[32m================%40s================\033[0m\n "" "stopping irrelevant services" stop_services printf "\033[32m================%40s================\033[0m\n"/e Tc/security/limits.config "Limits_config printf" \033[32m================%40s================\033[0m\n ""/etc/sys      ctl.conf "Sysctl_config printf" \033[32m================%40s================\033[0m\n "sshd re-configuring "Sshd_config printf" \033[32m================%40s================\033[0m\n "" Configuring Time "Time_ Config printf "\033[32m================%40s================\033[0m\n" "Configuring Firewall" # Iptables p rintf "\033[32m================%40s================\033[0m\n" "Someother Stuff" other printf "\033[32m======= =========%40s================\033[0m\n "" done!
 Rebooting "touch" $flagFile ' Sleep 5 reboot} main

Above is a detailed summary of Linux knowledge points, I hope to help you learn.