How to Disable Root SSH Login on Linux

Open ssh config file # vim /etc/ssh/sshd_config
#PermitRootLogin yes

Replace this line by:
 PermitRootLogin no

In this file we can also change the "Port number" and "Banner" details as well and much more.

# service sshd restart

after when we login as "root" user it will show "Access denied" message.

Now login as a normal user and switch as root.

How to Decoding an SSL Certificate

Problem: You want to view information about a given SSL certificate, stored in a PEM file

Solution:
# openssl x509n-text -in filename

This is a quick way to learn who issued a certificate, its begin and end dates, and other pertinent details.

This is a quick way to learn who issued a certificate, its begin and end dates, and other pertinent details.

How to Validate an SSL Certificate

Problem: You want to check that an SSL certificate is valid,

Solution: IF your system's certificates are kept in a file ( as in Red Hat)

# openssl .... -CAfile file_of_CA_certificates.....

To check the certificate of a secure web site

# openssl s_client -quiet -CAfile /usr/share/ssl/cert.pem -connect www.comain.com:443

How to Generate an SSL Certificate Signing Request(CSR)

Problem: You want to obtain an SSL certificate from a trusted certifying authority(CA)
 
Solution: Generate a Certificate Signing Request(CSR)

# make -f /usr/share/ssl/certs/Makefile filename.csr
OR
# openssl req -x509 -nodes -days 365 -newkey rsa:2048 
 -keyout mysitename.key -out mysitename.crt

and send filename.csr to the CA

Make sure that the certificate you have received is in PEM format. Suppose it's in the file cert.pem then decrypt your private key and append it to this file

# openssl rsa -in foo.key >> cert.pem

and then as root

# chown root.root cert.pem
# chmod 400 cert.pem

OR

First, generate a private key on the Linux server that runs Apache webserver using openssl command as shown below.

Generating RSA private key, 1024 bit long modulus.

 

# openssl genrsa -des3 -out www.ctechz.com.key 1024

 

Using the key generate above, you should generate a certificate request file (csr) using openssl as shown below.

 

# openssl req -new -key www.ctechz.com.key -out www.ctechz.com.csr

How to Create Access Control List using PAM

Problem: You need to apply an ACL to an existing service that does no explicitly support ACL's.
 
Solution: Use the listfile PAM module

First make ure the server in question uses PAM for
authentication, and find out which PAM service name it uses. This may be in the server documentation, or it may be clear from examining the server itself and perusing the contents of /etc/pam.d.

Suppose you are dealing with the IMAP mail server. First notice that there is a file called /etc/pam.d/imap Furhter the result of:

# locate imapd
.....
.......
/usr/sbin/imapd

shows that the IMAP server is in /usr/sbin/imapd, and:

# ldd /usr/sbin/imapd
libpam.so.0 => /lib/libpam.so.0 (0x40027000)

Shows that the server is dynamically linked against the PAM library(libpam.so).Create an ACL file for the IMAP service, let's say /etc/imapd.acl and make sure it is not world-writable:

# chmod o-w /etc/imapd.acl

Edit thsi file and place in it the usernames of those accounts authorized to use the IMAP server, one name per line. Then add the following to /etc/pam.d/imap

# account required /lib/security/pam_listfile.so file=/etc/imapd.acl item=user sense=allow onerr=fail

With this configuration, only those users listed in the ACL file will be allowed access to the IMAP service. If the ACL file is missing, PAM will deny access for all accounts. Entries in ACL file can be not only usernames, but also:

Terminal lines (item=tty)
Remote host(item=rhost)
Remote user(item=ruser)
Group membership(item=group)
Login shell(item=shell)

The sense keyword determines how the ACL file is interpreted. sense=allow means that access will be allowed only if the configured item is in the file, and denied otherwise. sense=deny means the opposite.

The onerr keyword indicates what to do if some unexpected error occurs during PAM processing of the "listfile" module-for instance if the ACL file does not exist.

NOTE: To debug problems with PAM modules, look for PAM-specific error messages in /var/log/messages and /var/log/secure.

How to Enforce Password Strength using PAM

Problem: You want your users to employ strong passwords.
 
Solution: Use the pam_cracklib PAM module to test and enforce password strength requirements automatically. 

edit the parameters in the pam_cracklib module in 
/etc/pam.d/system-auth.

To increase the number of consecutive times a user can enter an incorrect password, change the retry parameter from its default of 3;

password required /lib/security/pam_cracklib.so retry=3

NOTE: PAM allows recursion via the pam_stack module that is, one PAM module can invoke another.

How to Prohibit root logins on Terminal Devices

Problem: You want to prevent the superuser,root from logging in directly over a terminal or pseudo-terminal

Soution: Edit /etc/securetty, this file contains device names, one per line, that permit root logins.Make sure there are no pseudo-ttys(pty) devices listed, so root cannot log in via the network, and remove any others of concern to you.

 /etc/securetty

 # serial lines
 tty1
 tty2
 # devfs devices
 vc/1
 vc/2
 
If possible dont permit root to log in directly.