Ottawa Valley SAGE

Archive for the ‘Training/Education’ Category

For those who are unaware, the LISA 2010 conference registration has been opened. Visit the Usenix event page for detailed information and to register.

For the unknowing or uninformed, LISA is the big annual System Administration conference sponsored by Usenix. LOPSA has a hand in there as well. If you are really going to make this a career and not just a job, you should attend one of these conferences. Words do not really describe the experience. Ask Kelly some time.

To give you an idea of what is happening, this is the schedule for the week:

I have uploaded the config files I talked about during the meeting. These files make reference to some extra items such as greylisting and spamassassin, as well as the use of self-signed SSL certificates. You will notice a new menu item on the site under About called ovSAGE Downloads. Go there for the tarball which contains the default and production files as well as diff files for each pair.

The main documents for all of this are located on the CentOS website. The following items describe the docs and their locations:

• If you are starting over, the basic postfix install document is located here: Postfix HOWTO
• In order to do the greylisting under postfix, have a look at the Greylisting HOWTO
• To get spamassassin running, you need the spamassassin rpm installed. There is a HOWTO on using it along with anti-virus software at PostfixMail.com. I believe I just installed the package, enabled it and ran the update rules script to get it working. This site is a little more ambitious.
• One final item is creating and managing self-signed SSL certificates. I normally do this from the command line, but I had heard of a project for keeping track and managing them. It’s called tinyCA and you can find it at sm-zone.net. It uses  X-windows, so you will need to run it on one of your unix boxes. I can go over the usage next meeting after the presentation, but it is pretty straight forward and playing with it should work out OK. Don’t worry if you mess up at first, just revoke and delete any bad certificates. Unless you are a security paranoid and like generating certificates, make your certs longer than one year.

I think that covers everything. I am using all of the stuff we discussed to redo the ovsage mail server and provide authenticated SMTP from outside as well as secure IMAP access for my smartphone and laptop.

A future session will cover setting up squirrelmail as an SSL protected web front-end to your mailserver. As I have not installed this yet, I’ll probably do it live so you can all see it being done.

This was the first evening where we started the virtual server configuration for our mythical SMB type environment. We went over the text based install of CentOS 5.4 and initial package selection, as well as running services on the box.

After a few technical difficulties while looking up some packages (trousers and fipscheck) that were installed that had not been selected, the rest of the install was reviewed. During the ‘firstboot’ process, we went through the list of services, which was rather enlightening for all involved. It appears that a number of things that you do not normally think about are enabled by default, even when unnecessary.

TrouSerS is an implementation of the Trusted Computing Group’s Software
Stack (TSS) specification. You can use TrouSerS to write applications that
make use of your TPM hardware. TPM hardware can create, store and use RSA
keys securely (without ever being exposed in memory), verify a platform’s
software state using cryptographic hashes and more.

FIPSCheck is a library for integrity verification of FIPS validated
modules. The package also provides helper binaries for creation and
verification of the HMAC-SHA256 checksum files.

Links:

• Installation and configuration of postfix
• The kickstart file for our base install base kickstart file (137)
• The list of services after configuration Services List from Basic Install (140)
• Configurations settings for the virtual machine Virtual Box configuration for the VM container (117)

During the time between now and the next meeting, we will be launching a forum section on the site to discuss the installation and address any questions, as well as try to establish some effective methodology (formerly “Best Practices”). This is a community effort and while I am willing to provide some guidelines and direction at the start, this is very much going to be a group effort, along with all that entails. We will document as we go and hopefully at the end we will have a useful set of procedures as well as lessons learned.

On a side note, to explain the “Best Practices” comment in the preceding paragraph, the term “Best Practices” is often used to convey the idea that this is the best method to do something. Without some unbiased way of judging the relative merits against all other implementations, this is just an opinion or a popular consensus as to methodology. In my opinion, it also predisposes you to think that this is THE WAY to do it and you stop thinking about ways to improve a process. It may very well be the best way, but there is no reason to be blind to other interpretations or be constrained to a particular implementation that doesn’t fit what you need just because it’s a “Best Practice”. Best practice for whom?

Current minimal resources for the project:

• CentOS 5.4 available from the CentOS project site.
• Oracle VirtualBox available from Oracle Corporation. We are using the binary distribution, not the community edition for cross platform similarity and ease of installation.