To begin, click on Start and Run and enter the command: dcpromo

The AD installer begins installing files. This may take several minutes.

At the AD Domain Services Wizard screen press Next

At the Operating System Compatibility screen press Next

Assuming this is a new domain, select Create a New domain in a new forest.

Enter your fully-qualified domain name

At the “Set Forrest Functional Level” select the best choice for your environment. In this case, Windows Server 2008 R2. You may need to choose an older version if you have other domain controllers running an older OS.

Check DNS Server and press Next

If you receive the following warning just ignore for now and press Yes

Select the locations to store Database, Log Files and SYSVOL.

Set password for Directory Services Restore Mode Administrator.

Review Summary and press Next

Installation will now run for several minutes.

When installation is complete press Finish

Press Restart Now to reboot

After reboot, you should now see your new domain at the login prompt

To begin managing your new domain, click on Start->Administrative Tools and select from the following Active Directory Tools

Active Directory Administrative Center

Active Directory Domains and Trusts

Active Directory Users and Computers

To begin, insert the installation DVD and power on the system. Select language and country preferences and press Next.

Press Install Now

Select OS version. In this case: Windows Server 2008 R2 Enterprise (Full Installation).

Accept license terms.

Select the second option “Custom” to install a new operating system.

Select the drive where the OS will be installed.

OS files are installed. May take several minutes.

Setup prompts to reboot. Press reboot.

System reboots. Screen says starting services.

Installation continues. May take several minutes.

Installation finishes and system boots up.

Press OK to set Administrator password.

Enter new password.

On first login Initial Configuration screen comes up. This screen has links to basic configuration settings. Click Configure Networking to set an ip address.

Right Click on Network Interface and select properties.

Select Internet Protocol Version 4 and press Properties.

Enter static IP information.

Return to the Initial Configuration Tasks screen and click on Provide computer name and domain.

Press the Change button to change the default host name.

Enter a host name for your server.

Press OK and reboot when prompted.

Next Steps:

Install Updates
Install AntiVirus
Install Applications

Not all of the below steps are appropriate for all systems. You will need to use your judgment to pick and choose which security measures are relevant to your environment.

1. Configure Security Banners/Disclaimers
2. Set GRUB boot loader password
3. Password protect single user mode
4. Configure Password Policy
5. Disable Unnecessary Services
6. Delete Unnecessary accounts and groups
7. Restrict su to sysadmin group
8. Prevent root login through ssh
9. Configure IP Access Controls with tcp_wrappers
10. Resource Limits

Configure Security Banners/Disclaimers

The Security Banner refers to the message that is displayed when users log in. Banners provide legal protection against unauthorized access attempts and provide a means to prosecute violators.

Here is an example of a generic banner:

Warning! This is a private system. Unauthorized access to or use of this system is strictly prohibited. Unauthorized users are subject to criminal prosecution and penalties.

To configure a banner in Redhat, edit the file /etc/issue:

su root
Enter root password
vi /etc/issue

Use vi commands to edit file and replace with your banner text. Enter ESC:x! when finished to save file.

In order for this banner to be displayed when users attempt to ssh to your server you will need to add it to the sshd_config file.

vi /etc/ssh/sshd_config

Arrow down to the line that begins with Banner. By default it should be

#Banner /some/banner

Edit this line, removing the # character and change the path to point to the /etc/issue file from above.

Banner /etc/issue

Enter ESC:x! when finished to save file.

Enter the following command to restart the ssh server for the changes to take effect:

/etc/init.d/sshd restart

Set GRUB boot loader password

Setting a password on the grub boot loader will require you to enter a password before booting the system. Although this is a recommended security practice, it is worth mentioning that this can be annoying, especially if you ever need to reboot the system remotely. I would not recommend this if you do not have physical access to the server.

The first step is to create a MD5 representation of your password. Enter the following to execute the grub md5 utility:

/sbin/grub-md5-crypt

Enter your password and confirm it. The program will generate an encrypted string. Carefully copy this string to a notepad.

Next you will need to edit the grub config file and add this encrypted password:

su root
Enter root password
vi /boot/grub/grub.conf

Insert a new line as following, placing your md5 password string after the –md5:

password –md5 $5Hhd9D4HEO7$%df8fHdLO9PDjU70

Save the file by entering ESC:x!

Reboot and verify that the new password is working.

Note: If for some reason this doesn’t work you may be locked out of your system. You will need to insert the RedHat installation CD/DVD and boot the system in recovery mode in order to undo the changes. To undo above edit the /boot/grub/grub.conf file and remove or comment out the password line.

Password protect single user mode

Single user mode is a system maintenance mode similar to windows safemode. If an attacker obtains access to the console he/she could potentially exploit this capability to bypass security controls and obtain root access to the system. It is a good idea to protect single user mode with a password to help prevent this.

Doing so is actually quite easy. Edit the /etc/inittab as followsg:

su root
Enter root password
vi /etc/inittab

Insert the following line:

~~:S:wait:/sbin/sulogin

Type ESC:x! to save and exit.

Configure Password Policy

The following settings force users to change their password every 90 days and enforce passwords at least 8 characters long.

su root
Enter root password
vi /etc/login.defs

Edit the file as follows:

PASS_MAX_DAYS 90
PASS_MIN_DAYS 1
PASS_MIN_LEN 8
PASS_WARN_AGE 14

Type ESC:x! to save and exit

Disable Unnecessary Services

An important security principle is “if you don’t need it, disable it”. All running services expose the system to some level of risk. Obviously, some services are much more vulnerable than others but often you don’t know what the vulnerabilities of any given service are, and some may yet to have been discovered.

To see what services are enabled enter:

/sbin/chkconfig –list

To disable a service enter:

/sbin/chkconfig -del service

At a minimum the following should be disabled:

/sbin/chkconfig -del bluetooth
/sbin/chkconfig -del cups
/sbin/chkconfig -del autofs
/sbin/chkconfig -del isdn
/sbin/chkconfig -del portmap
/sbin/chkconfig -del vncserver
/sbin/chkconfig -del mdmonitor
/sbin/chkconfig -del winbind

It is also a good idea to go through the /etc/xinetd.d directory and delete any unused services here. For example:

rm /etc/xinetd.d/gssftp
rm /etc/xinetd.d/krb5-telnet
rm /etc/xinetd.d/tftp
rm /etc/xinetd.d/daytime*
rm /etc/xinetd.d/chargen*
rm /etc/xinetd.d/ekrg5-telnet*

Delete Unnecessary accounts and groups

There are a number of default accounts and groups that you probably will never need and having them around can be a potential risk. Use the following commands to delete them:

/sbin/userdel adm
/sbin/groupdel adm
/sbin/userdel lp
/sbin/groupdel lp
/sbin/userdel shutdown
/sbin/groupdel shutdown
/sbin/userdel halt
/sbin/groupdel halt
/sbin/userdel news
/sbin/groupdel news
/sbin/userdel uucp
/sbin/groupdel uucp
/sbin/userdel operator
/sbin/groupdel operator
/sbin/userdel games
/sbin/groupdel games
/sbin/userdel gopher
/sbin/groupdel gopher
/sbin/userdel ftp
/sbin/groupdel ftp
/sbin/userdel mail
/sbin/groupdel mail
/sbin/userdel xfs
/sbin/groupdel xfs
/sbin/userdel ntp
/sbin/groupdel ntp
/sbin/userdel mailnull
/sbin/groupdel mailnull
/sbin/userdel pcap
/sbin/groupdel pcap

Restrict su to sysadmin group

Another layer of protection is to prevent unprivileged users from being able to execute the su command, denying them the ability to become more powerful users.

The first step is to create a system administrators group. Only trusted system admins should be made members of this group.

/usr/sbin/groupadd sysadmin

Next, enter the following commands to restrict the su command to this group:

chgrp sysadmin /bin/su
chmod o-rwx /bin/su

Finally, make sure to add existing system admins to the sysadmin group. For each account execute the following:

/usr/sbin/usermod -g sysadmin username

Prevent root login through ssh

There is one very well known account that you can’t really get rid of: root. However, one measure you can take to prevent people from trying to access this account is to disallow login as root through ssh.

This is another very easy one to implement. All you need to do is edit the /etc/ssh/sshd_config, uncomment the PermitRootLogin line and set it to no.

su root
Enter root password
vi /etc/ssh/sshd_config

Change the line:

#PermitRootLogin yes

To:

PermitRootLogin no

Configure IP Access Controls with tcp_wrappers

TCP_Wrappers is a security framework used to enforce ip address access controls on services such as ssh and ftp. It is installed by default in RedHat and most linux/unix distros. It can be used two ways: you can deny specified ip address or you can restrict access to only allowed ip addresses. In the following example we will do the later.

There are two configuration files that control the access: /etc/hosts.allow and /etc/hosts.deny. As the names imply, hosts.allow lists ip addresses that are allowed, and hosts.deny lists ip addressses that are not allowed.

In the following example we will first configure the hosts.deny file to deny ALL, and then configure the hosts.allow file to only permit ssh for users on the 192.168.1 subnet.

su root
Enter root password
vi /etc/hosts.deny

add the line:

ALL: ALL

ESC:x! to save

vi /etc/hosts.allow

add the line:

sshd: 192.168.1

ESC:x! to save

Resource Limits

These settings will prevent users from consuming too many resources. These changes will have the following effects: file sized will be limited to 100 MB and users can have a maximum of 150 concurrent processes running.

su root
Enter root password
vi /etc/security/limits

Insert the following lines at the bottom of the file:
hard fsize 102400
hard nproc 150

This document outlines the steps to install VMware tools on Redhat 5.4. This document assumes a fresh vanilla install as described in the post
Installing RedHat 5.4 64 bit.

To begin log into your RedHat server as a user and right click on the desktop to open a terminal window.

Enter the command su and enter your root password to become root.

Change directories to the temp directory:

cd /tmp

From the VMWare file menu click on VM and click on “Install VMware Tools”

Enter the following command to mount the cdrom:

mount -o ro /dev/cdrom /mnt

Enter the following command to copy files from the /mnt mointpoint to the current directory (/tmp):

cp /mnt/* .

There are two files: an rpm and a tar.gz archive. I have not had the best of luck with the rpm, so instead we will install the generic way using the perl script contained within the archive.

Enter the following to unzip the archive:

gunzip VM*.gz
tar -xvf VM*.tar

Change directories to the newly created vmware-tools-distrib directory:

cd vmware-tools-distrib

Enter the following to execute the vmware-install perl script:

perl vmware-install.pl

Continue to press Enter at prompts to accept defaults until script completes

Script completes in about a minute and you’re all done

Please post questions or comments below

Insert CD/DVD and power on system. At the splash screen press Enter key to begin install.

Select OK and press Enter to run a media test (optional).

Review License Agreement and press Close to continue

Press Next

Select Language

If you have an Installation Number enter it here. Otherwise select Skip.

If you are installing on a fresh disk you will receive a message indicating that no partition table was found. Press Yes to initialize disk.

Leave default selected (”Remove linux partitions on selected drives and create default layout”) but check the box “Review and Modify Partition Layout”

At warning Press Yes to continue creating new partitions (existing data will be deleted)

On the following screen you may review default partitions. By default there are only two partitions: swap and / (root). 1 GB of swap should be good for most systems. Some people use the rule of thumb: swap equals twice physical memory; however, nowadays systems typically have multiple gigs of memory in which case this much swap is overkill.

In this build we will modify the / partition and reallocate space to create additional partitions for /var and /opt. This step is optional, but it separates logs (mostly on /var) and applications (often in /opt) into their own partitions, providing some insurance to prevent them from filling up disk space on the root partition.

Click on the / partition and press the edit button.

On the popup screen, select / and press Edit. Reduce the size to allow for the creation of the /var and /opt partitions. In this case we will make the / partition 8992 MB (Use your judgment to decide how much to assign depending on how much space is available and what types of applications will be running).

Press the Add button to create new partitions for /var and /opt. In this case we will make /var 4000 MB and /opt 4288 MB.

Review partitions one more time and press Next

Leave defaults and press next (if you want to be super secure, you may configure a password for the grub loader, which requires a password to boot the system. This can be very annoying if you are doing remote administration).

Enter static IP address and network configuration

Select time zone

Enter root password

The software development option gives you all kinds of useful stuff like perl and java. These are a pain to install manually so it’s nice to let the installer do it for you here.

If this is going to be a web server you may choose to check the web server box, but I am not a fan of the default apache package so I prefer to build it manually post-install.

Select Software Development and press next

Press Next

OS will be installed. May take about 10-15 minutes

When installation is complete press Reboot

After reboot there will be a few more configuration items. Press Forward to continue

Read License Agreement and press Forward

RedHat comes with a server-based firewall. Select services to be enabled and/or add any port exceptions. Since we don’t really know what this server will be used for at this point the only one we will worry about is ssh.

We will leave default setting for SELinux security settings.

We will enable kdump to capture information in the event of a crash and leave the default 128 memory allocation.

We will use NTP to keep the system clock in-sync. Click on the Network Time Protocol tab and enter NTP servers (if unsure skip and just leave default).

Setup software updates. If you have a subscription to red hat you may setup software updates here.

It’s a bad idea to log in as root all the time so you should create a user account. Enter your username and password.

We don’t have a sound card so we skip this.

At this point we are done the OS install. Press Finish.

Press OK to Reboot.

Please leave comments below if you have any questions or would like to add anything to this build.

I recommend you also review this article on Redhat 5.4 Security

Formatting Disks

In this example we will be working with a single 80 GB volume. Most likely in a production environment you will be storing your database on mirrored storage and/or a SAN. Ideally, it is best to store the OS and the data files on separate physical disks. However, in this example we will simply separate them by creating partitions.

Below are the partitions that will be used in this build. These sizes are for illustration purposes. The actual sizes will vary depending on the intended use of the database.

• C – Windows – 14 GB
  
• G – Data – 16 GB
  
• H – Backups – 32 GB
  
• L – Logs – 12 GB
  
• Z – Apps – 6 GB
  

Enter 14000 and press Enter

We will leave the rest of the disk unformatted for now, and use disk manager to create the rest of the partitions after the OS is installed. Press Enter to instal Windows on this partition.

After Windows is installed Right Click on My Computer and select Manage. Then click on Disk Management.

Right click on the available part of the disk to create the first partition.

For the first drive (G drive) we will create a primary partition

Enter the size for the g drive

Select drive letter

Leave defaults, enter drive label

Since we only have one disk in this example, and Windows only allows up to 4 primary partitions per disk, we will need to use an extended partition and create logical drives for the H and the L.

Right click on the available disk space and select New partition. This time choose extended partition

Assign enough space to cover the H (backups) and the L (logs) drives. In this case 44 GB.

After the extended partition is created, right click on it and create the two logical partitions on top of it.

Use the remaining space for the Z (apps) drive.

When finished you should have the following drives in My Computer

After formatting the drives, we will run windows update to make sure we have all the latest patches. Open the browser and goto windowsupdate.microsoft.com and follow prompts to update system.

In this demo, we will show how to stream video using the oflaDemo app that ships with the Red5 server.

The first step is to install/activate the app via the Red5 web GUI.

Open a browser and navigate to http://IPADDRESS:5080 and click on the link: Click here to install demos

On the installation screen, select oflaDemo and press the Install button

The streaming files go in the directory /usr/share/red5/webapps/oflaDemo/streams/

To make sure this directory is writable, log in via the console and execute the following command:

sudo chmod 777 /usr/share/red5/webapps/oflaDemo/streams/

Copy the flv file to be streamed to the red5 server. In this example we use WinSCP (Any SCP/SFTP will do ie filezilla, etc).

Now configure a flash video player to point to the red5 server. In this example we will use the Longtail JW Player, which can be configured automatically using the wizard on their website.

There are 2 flash variables that are required. file is the flv file, and streamer is the url to the red5 server and the application path. In this example we will use ESXi.flv and rtmp://builddocs.com/oflaDemo

Here is the working demo:

Please leave questions or comments below.

This document outlines installation of the Red5 Virtual Appliance referenced in the previous post:

Building a Red5 Virtual Appliance on Jeos

In this document we will be using VMWare Workstation 6.5. The process should be simalar for VMWare Server or ESX.

In Workstation, click on File and Import

Press Next

And Next again

For type of source, select Virtual Appliance

Press Browse and navigate to the red4server.ovf file

Click Next on the Virtual Appliance details page

Accept license agreement

For destination select the type of platform you are running. In this case we will select Other Virtual Machine.

Enter a name for your inventory and a directory where you want the vm files to be stored

Leave defaults: “Import and Convert (full-clone)” and “Allow virtual disk to expand”

Leave defaults: “Bridged Networking”

Press Next

Press Finish

The Virtual Appliance will be imported. This will take a few minutes. When finished press close

Press the green start button to power on the virtual appliance

The server should boot up in less than a minute. When prompted login in with username: red5 password: password.

Carefully follow instructions to change password. Note: you must first enter the default password and then enter a new password twice to change it.

To change password at a later time enter the command passwd at the command prompt.

Carefully follow instructions to set static ip address. Note: you will need to enter your password again for network changes to take effect.

To change your ip address in the future, you will need to edit the /etc/network/interfaces files and to change DNS /etc/resolv. In order for changes to take effect enter the command /etc/init.d/networking restart (or just reboot)