1. Beginning Linux user training
Linux Basics
a. Useful commands
1. Dangerous Commands or procedures
2. basic everyday commands
3. ssh, scp and rsync
4. grep
5. sed
6. awk
7. lsof
8. netstat
9. screen
10. chkconfig
11. mount
12. help
13. diff and patch
b. vi the only editor you need
c. Command Prompt and IO redirection
d. bash
e. Filesystem
f. Boot up, runlevels, system processes and shutdown
g. Users & Groups
h. File types
i. Networking
j. Automating tasks with cron
k. rpm
l. LVM
m. RAID
n. SELinux
2. Linux basics test
3. Hardware and network wiring
4. Initial OS installation
5. Preparing for IT Work
6. Advanced Linux
a. Spacewalk overview
Spacewalk Management
b. RPMs and Koji
c. Subversion
d. kickstart
e. ldap
f. Nagios & Cacti
g. DRBD
h. RT
i. iscsi and fiberchannel
j. Condor
k. Advanced SELinux - policy writing
l. virtualization
7. Script archive
edit pam.d files for pam_tally2

Why we do what we do.

We use Linux systems here because the power and flexibility allows us to provide a better product than with any other operating system. We use RedHat Enterprise Linux (RHEL) because it has state of the art management tools like RPMs for package management and Spacewalk for system management all integrated with the most comprehensive security process available called SELinux with Multi-Level Security (MLS).

We do all of this because it makes our product outstanding for our customers.

RPMs

RedHat created the Redhat Package Management (RPM) process very early in the life of the company. It allows system administrators to know easily what software is on the system and what version it is. The RPM metadata includes dependencies for each package. This allows for reliable updates as the sysadmin can verify all the prerequisites are in place before installing or upgrading a package. Now it's known in advance that the correct libraries are in place.

RPM security

RPM packages have metadata that is a frontline defense for system security. The packages are signed with a security key. If that signature is tampered with, the system will refuse to install the package. This blocks trojaned packages from being installed. If the package is not signed with a known security key, the system will refuse to install it without an admin override.

At FOOBAR INC, we have a package build process (Koji) that includes signing all packages.

The RPM process also tracks information such as the installation date, size of all files and a MD5 checksum of all binaries. This allows admins to verify that an installed package is still exactly as it was when it was deployed originally.

Spacewalk

Spacewalk is a large scale RHEL system management tool. It provides mechanisms to deploy, configure and update RHEL systems individually or in defined groups. It acts as a repository of RPMs.

Spacewalk security

Spacewalk provides reports showing the status of system packages for all deployed machines. It provides a ready list of systems that need to be updated and whether those updates are for security patches, bug fixes or just package enhancements. Systems can be joined to an automatic update process so that approved security patches are applied as soon as they are available.

At FOOBAR INC, all systems are joined to the Spacewalk network for package security and maintenance.

SELinux

Security Enhanced Linux (SELinux) began with the original kernel patches provided by the National Security Agency (NSA). Prior to SELinux, the internal system security model was a Discretionary Access Control (DAC) form. This was the original UNIX style owner, group, world read, write, execute process. A user could change a file or directory they owned to be world read, write and execute. SELinux uses a Mandatory Access Control (MAC) model. A user can't change the MAC data on a file or directory even if they own it. To do so requires a security user to make the changes.

SELinux security models

SELinux has different ways of working. In targeted mode only select network daemons are protected. In strict mode, the entire system is protected.

FOOBAR INC uses strict mode predominately for servers and targeted mode for desktops.

SELinux policies

There are policy types for SELinux. These policies dictate how the kernel allows or blocks data flow between processes, files and connections. Multi-Category Security (MCS) is a non-hierarchical method that has multiple containers like "company confidential" and "patient record". Multi-Level Security is MCS plus additional hierarchical levels like "secret" and "top secret".

FOOBAR INC applies MLS policy to servers that need to enforce hierarchical levels.

Linux Training : IT Training and HowTo's