I was wondering if anybody can share some installation steps on Redhat Satellite server. I tried to look at Google but couldn't find relevant.
It would be really great help.
Thanks in advance,
Suman
Really? "redhat satellite server installation" query in Google yields a metric ton of results, including: Official RedHat Installation Guide
The command to register a RHEL system with RHN is:
rhn_register
• After the system is registered with RHN, you should fully update the system and reboot before attempting to install Satellite.
• To update a RHEL system with all current updates:
yum -y update
• Update HOSTNAME in /etc/sysconfig/network with the xxx.xxx.
• Configure IPTables to allow inbound TCP ports 80, 443, and 5222.
• Restart the IPTables service.
• Configure IPTables to allow inbound TCP ports 80, 443, and 5222.
o Add the following to /etc/sysconfig/iptables after the line with “dport 22”:
-A INPUT -m state --state NEW -m tcp -p tcp --dport 80 -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 443 -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 5222 -j ACCEPT
• Restart the IPTables service.
serviceiptables restart
• Mount the satellite ISO in root’s home directory to /mnt:
mount -o loop /setupfiles/satellite-5.5.0-20120911-rhel-6-x86_64.iso /mnt
cd /mnt
./install.pl --disconnected
rhn-satellite start
Done
Related
I would like to block traffic to a VM running on my machine except for certain ports. I added some rules to virtual bridge to accept traffic on port 80 in the filter table in the FORWARD chain, since the virtual bridge is set up to forward traffic from the VMs.
I wrote the following:
sudo iptables -F
sudo iptables -I FORWARD -o [bridge_iface] -p tcp --dport 80 -m state --state NEW,ESTABLISHED -j ACCEPT
sudo iptables -I FORWARD -i [bridge_iface] -p tcp --sport 80 -m state --state NEW,ESTABLISHED -j ACCEPT
sudo iptables -I FORWARD -o [bridge_iface] -p tcp --dport 53 -m state --state NEW,ESTABLISHED -j ACCEPT
sudo iptables -I FORWARD -i [bridge_iface] -p tcp --sport 53 -m state --state NEW,ESTABLISHED -j ACCEPT
sudo iptables -P FORWARD DROP
When I connect tot he vm on the bridge i can't connect to an external web site. If i remove the last line, of course, everything works but everything is open too. So that's not quite right.
IF you want to drop the traffic TO your VM, why are you filtering also the other direction, do you really want to prevent your VM from accessing the internet?
iptables -I FORWARD -o [bridge_iface] -m state --state NEW,ESTABLISHED -j DROP
iptables -I FORWARD -o [bridge_iface] -p tcp -m state --state NEW,ESTABLISHED --dport 80 -j ACCEPT
iptables -I FORWARD -o [bridge_iface] -p udp -m state --state NEW,ESTABLISHED --dport 53 -j ACCEPT
Please note: DNS is using mostly UDP, not TCP, so you should filter for UDP.
The whole idea about my setup: you should ALLOW your computer to forward anything, only DROP connections to a specific interface by default, and open the specific ports also on thad device.
I suspect that you're using port forwarding on incoming connections on port 80 and 53 to be served by the VM, am i correct ?
If you want to deny your VM from accessing the internet, except for the 2 ports we just set up, you have to change -o to -i in the script.
I'm working with an Ubuntu 12.04 LTS, 64 Bit server there I have used the following commands to send all http request on port 80 to port 8080
Commands:
cat /proc/sys/net/ipv4/ip_forward #returns 1
sudo iptables -A PREROUTING -t nat -i eth0 -p tcp --dport 80 -j REDIRECT --to-port 8080
sudo iptables -A INPUT -p tcp -m tcp --sport 80 -j ACCEPT
sudo iptables -A OUTPUT -p tcp -m tcp --dport 80 -j ACCEPT
From there I wanted to proxy the requests based on (sub)domain to some other ports (i.e. 9000, 3000, 9615) using http-master. I'm having some problems getting this done and had it right once on a VPS on amazon aws where those ports where opened.
So what I'm asking is if it's necessary to open every port and how I can do that on the command line?
After some further research and experimentation I concluded that it's only necessary to open the port that we use as entry points. If we then route it with a proxy or even with NAT configuration to another PORT, the latter will be used only to "listen".
I've installed Confluence on Debian Linux 7.0. It runs on 8081 port (for connector, 8091 is used as TomCat server port). I've configured Apache to act as reverse proxy and serve on https://confluence.<mydomain>.com (SSL is configured on Apache side).
The configuration worked perfect unless I set up firewall rules. It still works as expected but became extremely slow (memory and CPU utilisations are low). Switching firewall off brings the performance back to normal. The set of firewall rules for IPv4 is:
*filter
-P INPUT DROP
-P FORWARD DROP
-P OUTPUT ACCEPT
# Allow all loopback (lo0) traffic
-A INPUT -i lo -j ACCEPT
# Accept all established inbound connections
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
# Allow ping
-A INPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT
# Allows SSH connections
-A INPUT -p tcp --dport 22 -j ACCEPT
# Allow all HTTP and HTTPS connections
-A INPUT -p tcp --dport 80 -j ACCEPT
-A INPUT -p tcp --dport 443 -j ACCEPT
COMMIT
IPv6 traffic is completely disabled:
*filter
-P INPUT DROP
-P FORWARD DROP
-P OUTPUT DROP
COMMIT
I'm using Oracle JVM (1.7), startup options are configured in the following way:
JAVA_OPTS="-Xms512m -Xmx2048m -XX:MaxPermSize=1024m $JAVA_OPTS -Djava.awt.headless=true"
Confluence version is "Confluence 5.4.2 - Standalone (TAR.GZ Archive)", license is Starter (10 users). Database is locally installed PostreSQL.
Anyone has an idea on what I'm doing wrong?
I'm using RHEL or CentOS. I just want to know how to limit the concurrent/simultaneous connection counts.
Lets say:
I have a Media Streaming Server
(According to the Server Performance) I want my Server to be strictly serving to only 100 Viewers at a time. (Only 100 Viewers can be Viewing/ Downloading from my Server)
Is it possible and how to do it please?
Check out the iptables rate limiting feature:
http://codingfreak.blogspot.com/2010/01/iptables-rate-limit-incoming.html
iptables -I INPUT -p tcp --dport 80 -i eth0 -m state --state NEW -m recent --set
iptables -I INPUT -p tcp --dport 80 -i eth0 -m state --state NEW -m recent --update --hitcount 50 -j DROP
i REALLY need some help before my laptop goes through the wall.
I want to run a virtual machine through tor middlebox. I want the entire VM`s connection to go through the tor network. (Im wanting to setup my hidden service and for my needs this will work best)
I started by looking here - http://www.howtoforge.com/how-to-set-up-a-tor-middlebox-routing-all-virtualbox-virtual-machine-traffic-over-the-tor-network
I know this is old but i figured i`d give it a go anyway.
For reference my Host machine is running Ubuntu 13.04 and the VM will be running 12.04LTS. On virtualbox
Well i have tor installed as per the guide, i have gone though the setup steps. But it didnt work. My VM will not connect to the net. I checked ifconfig and i am recieving an ip address, but i cant get a connection to the web to check i am running through tor.
I`ve spent a good few hours on this but i cant get it working, im just at point and click mode now. Looked at so many sites, and almost all of them point back to the original. I have tried tweaking the settings, and looked at numerous forums. But i cant get this working.
If i try using the tor browser bundle, it refuses to start tor, stating the it hasn`t got permission or cant listen on 172.16.0.1:53. tried using vidalia bundle for the tor install but that refuses to find the tor exec (not really an issue)
Here are the settings i am trying to run with...
/etc/network/interfaces
as stated in guide
/etc/dnsmasq.conf
interface=vnet0
listen-address=192.168.1.1
dhcp-range=172.16.0.2,172.16.0.254,1h
/etc/tor/torrc
VirtualAddrNetwork 10.192.0.0/10
AutomapHostsOnResolve 1
TransPort 9040
TransListenAddress 172.16.0.1
TransListenAddress 192.168.1.1
DNSPort 53
DNSListenAddress 172.16.0.1
DNSListenAddress 192.168.1.1
middlebox.sh
#!/bin/sh
# destinations you don't want routed through Tor
NON_TOR="192.168.1.0/24 192.168.0.0/24"
# the UID Tor runs as
TOR_UID="109"
# Tor's TransPort
TRANS_PORT="9040"
# your internal interface
INT_IF="vnet0"
iptables -F
iptables -t nat -F
iptables -t nat -A OUTPUT -o lo -j RETURN
iptables -t nat -A OUTPUT -m owner --uid-owner $TOR_UID -j RETURN
iptables -t nat -A OUTPUT -p udp --dport 53 -j REDIRECT --to-ports 53
for NET in $NON_TOR; do
iptables -t nat -A OUTPUT -d $NET -j RETURN
iptables -t nat -A PREROUTING -i $INT_IF -d $NET -j RETURN
done
iptables -t nat -A OUTPUT -p tcp --syn -j REDIRECT --to-ports $TRANS_PORT
iptables -t nat -A PREROUTING -i $INT_IF -p udp --dport 53 -j REDIRECT --to-ports 53
iptables -A FORWARD -i $INT_IF -p udp -j DROP
iptables -t nat -A PREROUTING -i $INT_IF -p tcp --syn -j REDIRECT --to-ports $TRANS_PORT
iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
for NET in $NON_TOR 127.0.0.0/8; do
iptables -A OUTPUT -d $NET -j ACCEPT
done
iptables -A OUTPUT -m owner --uid-owner $TOR_UID -j ACCEPT
iptables -A OUTPUT -j REJECT
Does this article help you? http://www.mike-warren.com/articles/routing-vm-traffic-through-tor.html
The short version is:
host runs a tun/tap device
host runs a VDE switch (which puts packets from the VM into the tap device)
host has iptables NAT rules to shovel tap device traffic into Tor
host runs Tor as transparent proxy
VM has static IP, connected to VDE switch
Instead of all that, you could run TAILS instead. https://tails.boum.org/
Consider running tails as vm guest.
Use a vm snapshot to avoid booting from tails live dvd (iso)