[Linux]패스워드 정책 만들기

출처 : http://kbase.redhat.com/faq/FAQ_44_8148.shtm 
작성자의 요청이 있을경우 자삭 함.

패스워드 등록시 최소 길이, 대/소문자 넣기 등등의 정책을 만들경우 해당되는 내용임

Issue:
How can I force users to create passwords that meet complexity requirements, such as length, special characters and numbers?

Resolution:

Limitation:
Red Hat Enterprise Linux 3 Update 4 and later

In Red Hat Enterprise Linux Version 3 Update 4 and later, the PAM module pam_cracklib can be used to force password complexity requirements.

By making a simple change to the pam_cracklib.so line in /etc/pam.d/system-auth the following password characteristics can be required:

  • Minimum password length (minlen)
  • Minimum number of lower case letters (lcredit)
  • Minimum number of upper case letters (ucredit)
  • Minimum number of numeric characters (dcredit)
  • Minimum number of non-alphanumeric characters (ocredit)

The following example shows a modified /etc/pam.d/system-auth pam_cracklib line:

password    required      /lib/security/$ISA/pam_cracklib.so retry=3 minlen=8 dcredit=-1 ucredit=-1 lcredit=-1 ocredit=-1

With the above example users would be required to choose passwords that are at least 8 characters long, that have at least one lower case character, one uppercase character, one number and one special character. Note that to require any of these characteristics a negative number is specified.

The output below illustrates what happens when a user tries to make a password that does not meet these requirements:

[test500@localhost ~]$ passwd Changing password for user test500. Changing password for test500 (current) UNIX password: New UNIX password: BAD PASSWORD: is too simple New UNIX password:

Password complexity is one of the most effective, and simple, security measures an administrator can implement.



크리에이티브 커먼즈 라이센스
Creative Commons License
이올린에 북마크하기(0) 이올린에 추천하기(0)

Posted by 삐꾸강아쥐쥐

2008/09/03 11:28 2008/09/03 11:28
이올린 태그검색올블로그 태그검색테크노라티 태그검색태그스토리 태그검색티스토리 태그검색, 이올린 태그검색올블로그 태그검색테크노라티 태그검색태그스토리 태그검색티스토리 태그검색, 이올린 태그검색올블로그 태그검색테크노라티 태그검색태그스토리 태그검색티스토리 태그검색, 이올린 태그검색올블로그 태그검색테크노라티 태그검색태그스토리 태그검색티스토리 태그검색
Response
No Trackback , No Comment
RSS :
http://n-nuri.com/rss/response/563

Trackback URL : http://n-nuri.com/trackback/563

Leave a comment
[로그인][오픈아이디란?]
출처 : http://kbase.redhat.com/faq/FAQ_103_10986.shtm
작성사의 요청이 있을경우 자삭 합니다.

Issue:
When I try to install Windows XP or Windows (Server) 2003 as a fully virtualized guest under Red Hat Enterprise Linux 5 using Xen, I can start the installation using virt-manager, but Windows installer is hung at "Setup is starting Windows" stage. How can I proceed further?
Resolution:

The error "Setup is starting Windows" is a symptom of the Windows installer not recognizing the underlying HVM (hardware virtual machine), in particular the ACPI controller. However, these options don't work as expected if the guest OS is the 64bit version of Window XP or Windows Server 2003.

Currently, the version of XEN shipping with Red Hat Enterprise Linux 5 does not support 64bit installations of Windows XP and Windows Server 2003.

With 32 bit guests, either of the below will fix this issue:

The first option is during installation, when Windows says to press F6 to install additional drivers, press F5 instead of F6. This will then prompt the user to select the machine and ACPI controller type. Then from the next dialog box select "Standard PC" and continue the installation as usual.

The second method includes the known work around for Windows not seeing cdrom after first reboot as well as getting past the earlier error message.

Install Windows through virt-manager. When it starts installation of Windows, close the vnc console and run xm shutdown guest from a root console. In these examples, guest refers to the name of the guest in question.

Edit /etc/xen/guest and add the cdrom to the disk section. Change the following line:

disk = [ 'file:/var/lib/xen/images/guest,hda,w']

to

disk = ['file:/var/lib/xen/images/guest,hdx,w','phy:/dev/hdx,hdx:cdrom,r']

Replace /dev/hdx with the exact device of the system's cdrom or dvd drive. It can also be specified by file:/path/to/XP.iso for iso images.

Add boot = "d" under the disk section. Change acpi = 1 to acpi = 0. Lastly, run xm create guest.

After this, Windows XP should boot normally and not hang at "setup is starting Windows".

Remove the boot = "d" line from the configuration file before starting the machine on the first reboot.

크리에이티브 커먼즈 라이센스
Creative Commons License
이올린에 북마크하기(0) 이올린에 추천하기(0)

Posted by 삐꾸강아쥐쥐

2008/08/13 13:54 2008/08/13 13:54
이올린 태그검색올블로그 태그검색테크노라티 태그검색태그스토리 태그검색티스토리 태그검색, 이올린 태그검색올블로그 태그검색테크노라티 태그검색태그스토리 태그검색티스토리 태그검색, 이올린 태그검색올블로그 태그검색테크노라티 태그검색태그스토리 태그검색티스토리 태그검색, 이올린 태그검색올블로그 태그검색테크노라티 태그검색태그스토리 태그검색티스토리 태그검색
Response
No Trackback , No Comment
RSS :
http://n-nuri.com/rss/response/559

Trackback URL : http://n-nuri.com/trackback/559

Leave a comment
[로그인][오픈아이디란?]
RHEL의 vsftpd 는 기본적으로 standalone 모드로 동작 한다.

그런데 만약 xinetd 모드로 동작을 해야 한다면

/etc/xinetd.d/이름
ex) /etc/xinetd.d/ftpd
파일을 만들고 아래의 내용을 입력 한다.

service ftp
{
       socket_type     = stream
       wait            = no
       user            = root
       server          = /usr/sbin/vsftpd
       log_on_failure  += USERID
       disable         = no
}

그리고 /etc/vsftpd/vsftpd.conf 에

listen=YES <== 주석 처리

여기서 주의 할점은 기존 vsftpd 데몬은 꼭 off 시키고 runlevel 에서도 off 시켜야 한다.

아래의 netstat 정보로 확인 가능

netstat -ntlp ## standalone 모드
tcp        0      0 0.0.0.0:21                  0.0.0.0:*                   LISTEN      6521/vsftpd    
netstat -ntlp ## xinetd 모드
tcp        0      0 0.0.0.0:21                  0.0.0.0:*                   LISTEN      6486/xinetd 
크리에이티브 커먼즈 라이센스
Creative Commons License
이올린에 북마크하기(0) 이올린에 추천하기(0)

Posted by 삐꾸강아쥐쥐

2008/08/11 12:05 2008/08/11 12:05
이올린 태그검색올블로그 태그검색테크노라티 태그검색태그스토리 태그검색티스토리 태그검색, 이올린 태그검색올블로그 태그검색테크노라티 태그검색태그스토리 태그검색티스토리 태그검색, 이올린 태그검색올블로그 태그검색테크노라티 태그검색태그스토리 태그검색티스토리 태그검색, 이올린 태그검색올블로그 태그검색테크노라티 태그검색태그스토리 태그검색티스토리 태그검색, 이올린 태그검색올블로그 태그검색테크노라티 태그검색태그스토리 태그검색티스토리 태그검색, 이올린 태그검색올블로그 태그검색테크노라티 태그검색태그스토리 태그검색티스토리 태그검색, 이올린 태그검색올블로그 태그검색테크노라티 태그검색태그스토리 태그검색티스토리 태그검색
Response
No Trackback , No Comment
RSS :
http://n-nuri.com/rss/response/556

Trackback URL : http://n-nuri.com/trackback/556

Leave a comment
[로그인][오픈아이디란?]

[Linux] RHEL Appendix B. Fence Device Parameters

출처 : http://www.redhat.com/docs/manuals/csgfs/browse/4.5/SAC_Cluster_Administration/ap-fence-device-param-CA.html

작성자의 요구시 자삭 합니다.


Appendix B. Fence Device Parameters

This appendix provides tables with parameter descriptions of fence devices.

Note

Certain fence devices have an optional Password Script parameter. The Password Scriptparameter allows specifying that a fence-device password is supplied from a script rather than from the Password parameter. Using the Password Script parameter supersedes the Password parameter, allowing passwords to not be visible in the cluster configuration file (/etc/cluster/cluster.conf).

Field Description
Name A name for the APC device connected to the cluster.
IP Address The IP address assigned to the device.
Login The login name used to access the device.
Password The password used to authenticate the connection to the device.
Password Script (optional) The script that supplies a password for access to the fence device. Using this supersedes the Password parameter.

Table B.1. APC Power Switch


Field Description
Name A name for the Brocade device connected to the cluster.
IP Address The IP address assigned to the device.
Login The login name used to access the device.
Password The password used to authenticate the connection to the device.
Password Script (optional) The script that supplies a password for access to the fence device. Using this supersedes the Password parameter.

Table B.2. Brocade Fabric Switch


Field Description
IP Address The IP address assigned to the PAP console.
Login The login name used to access the PAP console.
Password The password used to authenticate the connection to the PAP console.
Password Script (optional) The script that supplies a password for access to the fence device. Using this supersedes the Password parameter.
Domain Domain of the Bull PAP system to power cycle

Table B.3. Bull PAP (Platform Administration Processor)


Field Description
Name The name assigned to the DRAC.
IP Address The IP address assigned to the DRAC.
Login The login name used to access the DRAC.
Password The password used to authenticate the connection to the DRAC.
Password Script (optional) The script that supplies a password for access to the fence device. Using this supersedes the Password parameter.

Table B.4. Dell DRAC


Field Description
Name A name for the BladeFrame device connected to the cluster.
CServer The hostname (and optionally the username in the form of username@hostname) assigned to the device. Refer to the fence_egenera(8) man page.
ESH Path (optional) The path to the esh command on the cserver (default is /opt/pan- mgr/bin/esh)

Table B.5. Egenera SAN Controller


Field Description
Name A name for the GNBD device used to fence the cluster. Note that the GFS server must be accessed via GNBD for cluster node fencing support.
Server The hostname of each GNBD to disable. For multiple hostnames, separate each hostname with a space.

Table B.6. GNBD (Global Network Block Device)


Field Description
Name A name for the server with HP iLO support.
Hostname The hostname assigned to the device.
Login The login name used to access the device.
Password The password used to authenticate the connection to the device.
Password Script (optional) The script that supplies a password for access to the fence device. Using this supersedes the Password parameter.

Table B.7. HP iLO (Integrated Lights Out)


Field Description
Name A name for the IBM BladeCenter device connected to the cluster.
IP Address The IP address assigned to the device.
Login The login name used to access the device.
Password The password used to authenticate the connection to the device.
Password Script (optional) The script that supplies a password for access to the fence device. Using this supersedes the Password parameter.

Table B.8. IBM Blade Center


Field Description
Name A name for the RSA device connected to the cluster.
IP Address The IP address assigned to the device.
Login The login name used to access the device.
Password The password used to authenticate the connection to the device.
Password Script (optional) The script that supplies a password for access to the fence device. Using this supersedes the Password parameter.

Table B.9. IBM Remote Supervisor Adapter II (RSA II)


Field Description
IP Address The IP address assigned to the IPMI port.
Login The login name of a user capable of issuing power on/off commands to the given IPMI port.
Password The password used to authenticate the connection to the IPMI port.
Password Script (optional) The script that supplies a password for access to the fence device. Using this supersedes the Password parameter.
Authentication Type none, password, md2, or md5
Use Lanplus True or 1. If blank, then value is False.

Table B.10. IPMI (Intelligent Platform Management Interface) LAN


Field Description
Name A name to assign the Manual fencing agent. Refer to fence_manual(8) for more information.

Table B.11. Manual Fencing


Warning

Manual fencing is not supported for production environments.

Field Description
Name A name for the McData device connected to the cluster.
IP Address The IP address assigned to the device.
Login The login name used to access the device.
Password The password used to authenticate the connection to the device.
Password Script (optional) The script that supplies a password for access to the fence device. Using this supersedes the Password parameter.

Table B.12. McData SAN Switch


Field Description
Name A name for the WTI RPS-10 power switch connected to the cluster.
Device The device the switch is connected to on the controlling host (for example, /dev/ttys2).
Port The switch outlet number.

Table B.13. RPS-10 Power Switch (two-node clusters only)


Field Description
Name A name for the SANBox2 device connected to the cluster.
IP Address The IP address assigned to the device.
Login The login name used to access the device.
Password The password used to authenticate the connection to the device.
Password Script (optional) The script that supplies a password for access to the fence device. Using this supersedes the Password parameter.

Table B.14. QLogic SANBox2 Switch


Field Description
Name Name of the node to be fenced. Refer to fence_scsi(8) for more information.

Table B.15. SCSI Fencing


Field Description
Name Name of the guest to be fenced.

Table B.16. Virtual Machine Fencing


Field Description
Name A name for the Vixel switch connected to the cluster.
IP Address The IP address assigned to the device.
Password The password used to authenticate the connection to the device.
Password Script (optional) The script that supplies a password for access to the fence device. Using this supersedes the Password parameter.

Table B.17. Vixel SAN Switch


Field Description
Name A name for the WTI power switch connected to the cluster.
IP Address The IP address assigned to the device.
Password The password used to authenticate the connection to the device.
Password Script (optional) The script that supplies a password for access to the fence device. Using this supersedes the Password parameter.

Table B.18. WTI Power Switch


크리에이티브 커먼즈 라이센스
Creative Commons License
이올린에 북마크하기(0) 이올린에 추천하기(0)

Posted by 삐꾸강아쥐쥐

2008/06/09 18:02 2008/06/09 18:02
이올린 태그검색올블로그 태그검색테크노라티 태그검색태그스토리 태그검색티스토리 태그검색, 이올린 태그검색올블로그 태그검색테크노라티 태그검색태그스토리 태그검색티스토리 태그검색, 이올린 태그검색올블로그 태그검색테크노라티 태그검색태그스토리 태그검색티스토리 태그검색
Response
No Trackback , No Comment
RSS :
http://n-nuri.com/rss/response/537

Trackback URL : http://n-nuri.com/trackback/537

Leave a comment
[로그인][오픈아이디란?]

[Linux] 시스템 정보 보기 DMIDECODE

출처 : RHEL5 man page

DMIDECODE(8)                                                      DMIDECODE(8)

NAME
       dmidecode - DMI table decoder

SYNOPSIS
       dmidecode [OPTIONS]

DESCRIPTION
       dmidecode  is  a  tool for dumping a computer’s DMI (some say SMBIOS) table contents in a human-readable format. This table contains a
       description of the system’s hardware components, as well as other useful pieces of information such as serial numbers and  BIOS  revi-
       sion.  Thanks  to this table, you can retrieve this information without having to probe for the actual hardware.  While this is a good
       point in terms of report speed and safeness, this also makes the presented information possibly unreliable.

       The DMI table doesn’t only describe what the system is currently made of, it also can report the  possible  evolutions  (such  as  the
       fastest supported CPU or the maximal amount of memory supported).

       SMBIOS  stands  for  System Management BIOS, while DMI stands for Desktop Management Interface. Both standards are tightly related and
       developed by the DMTF (Desktop Management Task Force).

       As you run it, dmidecode will try to locate the DMI table. If it succeeds, it will then parse this table and display a list of records
       like this one:

       Handle 0x0002
           DMI type 2, 8 bytes.
           Base Board Information
               Manufacturer: Intel
               Product Name: C440GX+
               Version: 727281-001
               Serial Number: INCY92700942

       Each record has:

       · A  handle.  This is a unique identifier, which allows records to reference each other. For example, processor records usually refer-
         ence cache memory records using their handles.

       · A type. The SMBIOS specification defines different types of elements a computer can be made of. In this  example,  the  type  is  2,
         which means that the record contains "Base Board Information".

       · A  size.  Each  record  has a 4-byte header (2 for the handle, 1 for the type, 1 for the size), the rest is used by the record data.
         This value doesn’t take text strings into account (these are placed at the end of the record), so the actual length  of  the  record
         may be (and is often) greater than the displayed value.

       · Decoded  values.  The  information presented of course depends on the type of record. Here, we learn about the board’s manufacturer,
         model, version and serial number.
OPTIONS
       -d, --dev-mem FILE
              Read memory from device FILE (default: /dev/mem)

       -q, --quiet
              Be less verbose. Unknown, inactive and OEM-specific entries are not displayed. Meta-data  and  handle  references  are  hidden.
              Mutually exclusive with --dump.

       -s, --string KEYWORD
              Only  display  the value of the DMI string identified by KEYWORD.  KEYWORD must be a keyword from the following list: bios-ven-
              dor, bios-version, bios-release-date, system-manufacturer,  system-product-name,  system-version,  system-serial-number,  base-
              board-manufacturer,  baseboard-product-name,  baseboard-version, baseboard-serial-number, baseboard-asset-tag, chassis-manufac-
              turer, chassis-version, chassis-serial-number, chassis-asset-tag, processor-manufacturer, processor-version.  Each keyword cor-
              responds  to  a given DMI type and a given offset within this entry type.  Not all strings may be meaningful or even defined on
              all systems. Some keywords may return more than one result on some systems (e.g.  processor-version on a  multi-processor  sys-
              tem).   If  KEYWORD  is  not  provided or not valid, a list of all valid keywords is printed and dmidecode exits with an error.
              This option cannot be used more than once, and implies --quiet.  Mutually exclusive with --type and --dump.

       -t, --type TYPE
              Only display the entries of type TYPE. TYPE can be either a DMI type number, or a comma-separated list of type  numbers,  or  a
              keyword  from the following list: bios, system, baseboard, chassis, processor, memory, cache, connector, slot. Refer to the DMI
              TYPES section below for details.  If this option is used more than once, the set of displayed entries will be the union of  all
              the  given  types.   If  TYPE is not provided or not valid, a list of all valid keywords is printed and dmidecode exits with an
              error.  Mutually exclusive with --string.

       -u, --dump
              Do not decode the entries, dump their contents as hexadecimal instead.  Note that this is still a text output, no  binary  data
              will  be thrown upon you. The strings attached to each entry are displayed as both hexadecimal and ASCII. This option is mainly
              useful for debugging.  Mutually exclusive with --quiet and --string.

       -h, --help
              Display usage information and exit

       -V, --version
              Display the version and exit
DMI TYPES
       The SMBIOS specification defines the following DMI types:

       Type   Information
       ----------------------------------------
          0   BIOS
          1   System
          2   Base Board
          3   Chassis
          4   Processor
          5   Memory Controller
          6   Memory Module
          7   Cache
          8   Port Connector
          9   System Slots
         10   On Board Devices
         11   OEM Strings
         12   System Configuration Options
         13   BIOS Language
         14   Group Associations
         15   System Event Log
         16   Physical Memory Array
         17   Memory Device
         18   32-bit Memory Error
         19   Memory Array Mapped Address
         20   Memory Device Mapped Address
         21   Built-in Pointing Device
         22   Portable Battery
         23   System Reset
         24   Hardware Security
         25   System Power Controls
         26   Voltage Probe
         27   Cooling Device
         28   Temperature Probe
         29   Electrical Current Probe
         30   Out-of-band Remote Access
         31   Boot Integrity Services
         32   System Boot
         33   64-bit Memory Error
         34   Management Device
         35   Management Device Component
         36   Management Device Threshold Data
         37   Memory Channel
         38   IPMI Device
         39   Power Supply

Additionally, type 126 is used for disabled entries, type 127 is an end-of-table marker, and types 128 to  255  are  for  OEM-specific
       data.  dmidecode will display these entries by default, but cannot decode them.

       Keywords can be used instead of type numbers with --type.  Each keyword is equivalent to a list of type numbers:

       Keyword     Types
       ------------------------------
       bios        0, 13
       system      1, 12, 15, 23, 32
       baseboard   2, 10
       chassis     3
       processor   4
       memory      5, 6, 16, 17
       cache       7
       connector   8
       slot        9

       Keywords are matched case-insensitively. The following command lines are equivalent:

       · dmidecode --type 0 --type 13

       · dmidecode --type 0,13

       · dmidecode --type bios

       · dmidecode --type BIOS

FILES
       /dev/mem

BUGS
       More often than not, information contained in the DMI tables is inaccurate, incomplete or simply wrong.

AUTHORS
       Alan Cox, Jean Delvare

SEE ALSO
       biosdecode(8), mem(4), ownership(8), vpddecode(8)

dmidecode                         August 2005                     DMIDECODE(8)

크리에이티브 커먼즈 라이센스
Creative Commons License
이올린에 북마크하기(0) 이올린에 추천하기(0)

Posted by 삐꾸강아쥐쥐

2008/04/22 12:43 2008/04/22 12:43
이올린 태그검색올블로그 태그검색테크노라티 태그검색태그스토리 태그검색티스토리 태그검색, 이올린 태그검색올블로그 태그검색테크노라티 태그검색태그스토리 태그검색티스토리 태그검색, 이올린 태그검색올블로그 태그검색테크노라티 태그검색태그스토리 태그검색티스토리 태그검색, 이올린 태그검색올블로그 태그검색테크노라티 태그검색태그스토리 태그검색티스토리 태그검색
Response
No Trackback , No Comment
RSS :
http://n-nuri.com/rss/response/524

Trackback URL : http://n-nuri.com/trackback/524

Leave a comment
[로그인][오픈아이디란?]

리눅스에서

history 하면 ... 나의 행적이... 쭈루룩 나오게된다.

ㅡ.ㅡ 너무 많이 나온다 생각이 된다면...

profile 파일에...

HISTSIZE= ??? 를 조정하면

해당 줄수로 조정이 된다.

Linux는 기본 1000 Line 이다.

크리에이티브 커먼즈 라이센스
Creative Commons License