Install Fail2Ban on CentOS 7.3

      Fail2Ban on CentOS 7.3

Fail2ban is an intrusion prevention framework, which works together with a packet-control system or firewall installed on your server, and is commonly used to block connection attempts after a number of failed tries. The program works in background and continuously scans the log files for unusual login patterns and security breach attempts.

To install Fail2Ban on CentOS 7.3, we need to install EPEL (Extra Packages for Enterprise Linux) repository first.
# yum install epel-release
# yum install fail2ban fail2ban-systemd

If you have selinux  enabled, then we need to update the selinux policies.
# yum update -y selinux-policy* 

      Configure settings for Fail2Ban

Once installed, we will have to configure and customize the software with a jail.local configuration file.
Make a copy of the jail.conf file and save it with the name jail.local:

# cp -pf /etc/fail2ban/jail.conf /etc/fail2ban/jail.local
# vi /etc/fail2ban/jail.local

The file have many lines of codes which execute to prevent a ban on one or many IP addresses, set bantime duration, etc.
A typical jail configuration file contains the following lines.

[DEFAULT]

#
# MISCELLANEOUS OPTIONS
#

# "ignoreip" can be an IP address, a CIDR mask or a DNS host. Fail2ban will not
# ban a host which matches an address in this list. Several addresses can be
# defined using space separator.
ignoreip = 127.0.0.1/8

# External command that will take an tagged arguments to ignore, e.g. ,
# and return true if the IP is to be ignored. False otherwise.
#
# ignorecommand = /path/to/command
ignorecommand =

# "bantime" is the number of seconds that a host is banned.
bantime = 600

# A host is banned if it has generated "maxretry" during the last "findtime"
# seconds.
findtime = 600

# "maxretry" is the number of failures before a host get banned.
maxretry = 5

Ignoreip: Is used to set the list of IPs which will not be banned. The list of IP addresses should be given with a space separator.
Bantime: This Parameter used to set the duration of seconds for which a host needs to be banned.
Findtime: This parameter used to check if a host must be banned or not. When the host generates “maxrety” in its last “findtime”, it is banned.
Maxretry: This parameter used to set the limit for the number of retry's by a host, upon this limit, the host is banned.

      Running Fail2Ban service

You need to start and enable Centos Firewall
# systemctl enable firewalld
# systemctl start firewalld

Now execute the following lines of command to start Fail2Ban.
# systemctl enable fail2ban
# systemctl start fail2ban 

      Fal2Ban Status

Use the following command to check the status of the Fail2Ban.
# fail2ban-client status

      

      Failed login entries

With following command you can check whether there had been failed attempts to login to sever.
# cat /var/log/secure | grep 'Failed password'

      

      Banned ip’s by Fail2Ban

With following command you can get a list of banned IP addresses which were recognized as brute force threats.
# iptables -L -n

          

          Unbanning an IP address

In order to remove an IP address from the banned list, parameter IPADDRESS is set to appropriate IP which needs unbanning.
# fail2ban-client set sshd unbanip IPADDRESS

Install Moodle 3.0.3 on Centos 7

Moodle is primarily developed in Linux using Apache, MySQL and PHP.  

The basic requirements for Moodle are as follows:

1. OS - Linux and Windows are the most common choices.
2.Apache or IIS - Moodle will refuse to install on any other web server. Your web server needs to be correctly configured to serve PHP files.
3.PHP - The minimum version is currently 5.3.2. A number of extensions are required; see the PHP page for full details. Installation will halt at the environment check if any of the required extensions are missing.
4.Database - MySQL and PostgreSQL are the primary development database, the most comprehensively tested and have extensive documentation and support.

A)    Open Ports on Firewall:
# firewall-cmd --permanent --add-port=8080/tcp
# firewall-cmd --permanent --add-port=80/tcp
# firewall-cmd --permanent --add-port=443/tcp
# systemctl stop firewalld
# systemctl start firewalld

B)    Install Apache 
# yum install httpd
# systemctl enable httpd
# systemctl start  httpd
# systemctl status httpd

C)     Install MY SQL 5.7.9

Centos 7 comes with MariaDB instead of MySQL. MariaDb is an open source equivalent to MySQL.   To remove Mariadb run:

# yum remove mariadb mariadb-server

Now you need to add the MySQL-community repo:

# sudo rpm -Uvh http://dev.mysql.com/get/mysql-community-release-el7-5.noarch.rpm   

And then you can install MySQL like you normally do.

# yum install mysql mysql-server
# systemctl start mysqld
# systemctl status mysqld
# /usr/bin/mysql_secure_installation

Give it a new root password. For Example (xxxxxxx)

Press YES on all Messages
•    Set root password? [Y/n] Y
•    Remove anonymous users? [Y/n] Y
•    Disallow root login remotely? [Y/n] Y
•    Remove test database and access to it? [Y/n] Y
•    Reload privilege tables now? [Y/n] Y

# systemctl enable mysqld.service

D)   Configure MySQL character set to UTF-8
We need to edit my.cnf to support utf8
# vi /etc/my.cnf

Add the bellow:
character-set-server = utf8
skip-character-set-client-handshake
Save the file

# systemctl restart mysqld
# mysql -u root –p

mysql> status;

Check them like this:

Server characterset: utf8
Db     characterset:    utf8
Client characterset:     utf8   
Conn.  characterset: utf8

 

E)    Create user on  mysql
# mysql -u root -p
]> CREATE DATABASE moodle character set utf8;
]> CREATE USER 'muser@localhost' IDENTIFIED BY 'xxxxxxx';
]> GRANT ALL PRIVILEGES ON moodle.* TO muser@localhost IDENTIFIED BY 'xxxxxxx';
]>  FLUSH PRIVILEGES;
]>  Exit

F)    Installing PHP Version 5.4.16
# yum install php php-mysql
# yum install php-iconv php-mbstring php-curl php-openssl php-tokenizer php-xmlpc php-soap php-ctype php-zip php-gd php-simplexml php-spl php-pcre php-dom php-xml php-intl php-json php-ldap php-pecl-apc

G)    Install Moodle 3.0.3

Download latest version of Moodle and configure web services accordingly
#  cd  /root
# wget https://download.moodle.org/download.php/direct/stable30/moodle-3.0.3.zip
#  unzip moodle-3.0.3.zip -d /var/www/html/
#  chown -R apache:apache /var/www/html/moodle
#  chmod -R 755 /var/www/html/moodle

Additionally, we have to create a data director  for moodle under /var/www/ named as ‘moodledata’ which will be used by moodle, change permissions and ownership for that directory as required.
#  cd /var/www/
#  mkdir moodledata
#  chmod -R 755 /var/www/moodledata
#  chown -R apache:apache /var/www/moodledata

Restart httpd services
# systemctl restart httpd

Installation process is over at this stage, lets configure moodle server.

Open a browser type http://(Your IP Address)/moodle

How to install JDK, MySQL and Tomcat on Centos 7

1)  Open Tomcat and MySQL Ports on Centos Firewall:
# firewall-cmd --permanent --add-port=8080/tcp
# firewall-cmd --permanent --add-port=80/tcp
# firewall-cmd --permanent --add-port=443/tcp
# firewall-cmd --permanent --add-port=3306/tcp
# firewall-cmd –reload
# systemctl status firewalld

It is highly recommended that the local Linux firewall be used to restrict access to the MySQL server. Only hosts requiring connectivity to the MySQL server should be granted network access. MySQL listens on TCP port 3306 by default.

For example: If the CentOS firewall is enabled, then a rule allowing access to the MySQL server on port 3306/tcp from host e.g. 10.2.1.10 can be added.
# firewall-cmd --permanent --zone=trusted --add-source=10.2.1.10/32
# firewall-cmd --permanent --zone=trusted --add-port=3306/tcp
# firewall-cmd  --reload

2) Install Oracle Java 8 JDK

Note: If you would like to install a different release of Oracle Java 8 JDK, go to the Oracle Java 8 JDK Downloads Page, accept the license agreement, and copy the download link of the appropriate Linux .gz package. Start by creating a new directory “java” at /usr

# mkdir /usr/java
# cd /usr/java 
# wget --no-cookies --no-check-certificate --header "Cookie: gpw_e24=http%3A%2F%2Fwww.oracle.com%2F; oraclelicense=accept-securebackup-cookie" http://download.oracle.com/otn-pub/java/jdk/8u65-b17/jdk-8u65-linux-x64.tar.gz

Unpack jdk-8u65-linux-x64.tar.gz  in the /usr/java directory using tar -xzf:

# tar -xzf jdk-8u65-linux-x64.tar.gz

This will create the directory /usr/java/jdk1.8.0_65. This will be our JAVA_HOME.
We can now set JAVA_HOME and put Java into the path of our users.

To set it for your current session, you can issue the following from the CLI:

# JAVA_HOME=/usr/java/jdk1.8.0_65 
# export JAVA_HOME
# PATH=$JAVA_HOME/bin:$PATH
# export PATH

To set the JAVA_HOME permanently, however, we need to add below to the ~/.bash_profile of the user (in this case, root). We can also add it /etc/profile and then source it to give to all users.

# cd /
# cd  root
# vi .bash_profile

Add the below: 
JAVA_HOME=/usr/java/jdk1.8.0_65 
export JAVA_HOME
PATH=$JAVA_HOME/bin:$PATH
export PATH
Save the file

Once you have added the above to ~/.bash_profile, you should log out, then log back in and check that the JAVA_HOME is set correctly.

# echo $JAVA_HOME
# /usr/java/jdk1.8.0_65 

3) Download and extract Tomcat 8.0.28  
# java –version 
# yum install net-tools unzip wget 

We will install Tomcat 8 under /usr/share. Switch to the /usr/share directory: 
# cd /usr/share  
# wget http://apache.cc.uoc.gr/tomcat/tomcat-8/v8.0.28/bin/apache-tomcat-8.0.28.tar.gz  
# tar -xzf apache-tomcat-8.0.28.tar.gz 

This will create the directory /usr/share/apache-tomcat-8.0.28

4) Configure Tomcat to Run as a Service.

We will now see how to run Tomcat as a service and create a simple. Change to the /etc/init.d directory and create a script called 'tomcat' as shown below.

# cd /etc/init.d
# vi tomcat

Copy paste the Script:

#!/bin/bash
# description: Tomcat Start Stop Restart
# processname: tomcat
# chkconfig: 234 20 80
JAVA_HOME=/usr/java/jdk1.8.0_65
export JAVA_HOME
PATH=$JAVA_HOME/bin:$PATH
export PATH
CATALINA_HOME=/usr/share/apache-tomcat-8.0.28

case $1 in
start)
sh $CATALINA_HOME/bin/startup.sh
;;
stop)  
sh $CATALINA_HOME/bin/shutdown.sh
;;
restart)
sh $CATALINA_HOME/bin/shutdown.sh
sh $CATALINA_HOME/bin/startup.sh
;;
esac   
exit 0

The above script is simple and contains all of the basic elements you will need to get going.  As you can see, we are simply calling the startup.sh and shutdown.sh scripts located in the Tomcat bin directory (/usr/share/apache-tomcat-8.0.28/bin).
CATALINA_HOME is the Tomcat home directory (/usr/share/apache-tomcat-8.0.28)
Now, set the permissions for your script to make it executable:

# chmod 755 tomcat  

We now use the chkconfig utility to have Tomcat start at boot time. In my script above, I am using chkconfig: 234 20 80. 2345 are the run levels and 20 and 80 are the stop and start priorities respectively. You can adjust as needed.

# chkconfig --add tomcat
# chkconfig --level 234 tomcat on

Verify it:

# chkconfig --list tomcat  

Now, let's test our script. Start Tomcat:
# service tomcat start  

We can now access the Tomcat Manager page at: http://YourIPaddress:8080 and we should see the Tomcat home page.

5) Setup Tomcat User account:

Finally we need to create user accounts to secure and access admin/manager pages.

Edit conf/tomcat-users.xml file in your editor and paste inside tags.

For example we use username: admin and password: P@ssw0r%.  

Be sure to use a strong password

# cd /usr/share/apache-tomcat-8.0.28/conf
# vi tomcat-users.xml

Add the following:

<role rolename="manager-jmx"/>
<role rolename="manager-status"/>
<role rolename="admin-gui"/>
<role rolename="admin-script"/>
<user username="admin" password=" P@ssw0r%" roles="manager-gui,manager-script,manager-jmx,manager-status,admin-gui,admin-script"/>

Save the File

6) Manage Memory Usage Using JAVA_OPTS.

Open the Catalina.sh file located under /usr/share/apache-tomcat-8.0.28/bin with a text editor or vi.  Since we are using 512 Mb for both initial and maximum heap size, add the following line to Catalina.sh

# cd /usr/share/apache-tomcat-8.0.28/bin
# vi catalina.sh

Add the following line to Catalina.sh, JAVA_OPTS="-Xms512m –Xmx512m"

#!/bin/sh 
JAVA_OPTS="-Xms512m –Xmx512m" 
# Licensed to the Apache Software Foundation (ASF) under one or more
# contributor license agreements.  See the NOTICE file distributed with
# this work for additional information regarding copyright ownership.

7) Install MySQL

Centos 7, comes with MariaDB instead of MySQL. MariaDb is an open source equivalent to MySQL. You need to add the MySQL-community repo:

# sudo rpm -Uvh http://dev.mysql.com/get/mysql-community-release-el7-5.noarch.rpm  

And then you can install MySQL like you normally do.

# yum install mysql mysql-server
# systemctl start mysqld
# /usr/bin/mysql_secure_installation

Give it a new root password. Press YES on all Messages

• Set root password? [Y/n] Y
• Remove anonymous users? [Y/n] Y
• Disallow root login remotely? [Y/n] Y
• Remove test database and access to it? [Y/n] Y
• Reload privilege tables now? [Y/n] Y

# systemctl enable mysqld.service

8) MySQL configure character set to UTF-8

We need to edit my.cnf to support utf8
# vi /etc/my.cnf 

Add the bellow 
character-set-server = utf8 
skip-character-set-client-handshake

Save the file

# systemctl restart mysqld 
# mysql -u root –p

mysql> status;
# check them like this 

Server characterset: utf8 
Db     characterset: utf8 
Client characterset: utf8 
Conn.  characterset: utf8

Install MySQL on Centos 7

Install MySQL

Centos 7 comes with MariaDB instead of MySQL. MariaDb is an open source equivalent to MySQL.
So you need to add the MySQL DB manual:

Run
# sudo rpm -Uvh http://dev.mysql.com/get/mysql-community-release-el7-5.noarch.rpm  

Then you can install MySQL like you normally do.
# yum install mysql mysql-server
# systemctl start mysqld
# /usr/bin/mysql_secure_installation

Give it a new root password, for example (en2015!)
Press yes on all messages and the enable the service:
# systemctl enable mysqld.service
   
 
Change MySQL default character set to UTF-8

We need to edit my.cnf to support utf8 for Greek Characters
# vi /etc/my.cnf

The configuration file ('/etc/my.cnf' for example) should look like that:
[mysqld]
character-set-server = utf8
skip-character-set-client-handshake

When you save the file you need to restart the service   
# systemctl restart mysqld

Now try to logon to MySQL
# mysql -u root –p

Type: mysql> status

And,check them like this
   Server characterset:  utf8
   Db     characterset:    utf8
   Client characterset:   utf8
   Conn.  characterset:  utf8


Create a user “nike” and a db “diskpart” for Server

# mysql -u root –p
Enter the root password (en2015!)
mysql>  CREATE DATABASE diskpart character set utf8;
mysql>  CREATE USER 'nike@localhost' IDENTIFIED BY 'en2015!';
mysql>  GRANT ALL PRIVILEGES ON diskpart.* TO nike@localhost IDENTIFIED BY 'en2015!';
mysql>  FLUSH PRIVILEGES;
mysql>  Exit

Thats it......