Took RHCE - - Failed

custangro · 03-26-2009, 10:29 AM

Quote:

Originally Posted by descarte

I don't deny tcp_wrappers can be handy. but as pointed out earlier, got to becareful though. apps that do not implement libwrap.so cannot be controlled by tcpwrappers. So you have to be familiar with it and not spend time troubleshooting problems that you create for yourself in the exams. say for eg,

oops httpd is running ant not in the list.

I got my rhce without using tcp_wrappers. I believe custango got his with tcp_wrappers. everyone works differently and it is the result that matters in the exam. But as a good sys admin and looking beyond the certificate, we have to know all possible methods of achieving certain result, or at least know how things work in the backend. I know sysadm who just keep using yum or apt-get. When dealing with extreme scenario like rescue environment, the rpm command line mastery becomes important.

Agreed.

And yes I got my RHCE using tcp_wrappers, but you're right...you need to KNOW which services are controlled by tcp_wrappers and which rely on thier own ACLs (i.e. samba, httpd, etc).

And the RPM commands are VERY essential! It not has only helped me on the test...but it's saved me at work too!

-C

latinmusic74 · 03-26-2009, 12:53 PM

Do you really need to use tcp_wrapper or iptables to control host/network/user access to the service? Can you control host/user/network httpd using ALLOW, DENY statements?

custangro · 03-26-2009, 12:55 PM

Quote:

Originally Posted by latinmusic74

Do you really need to use tcp_wrapper or iptables to control host/network/user access to the service? Can you control host/user/network httpd using ALLOW, DENY statements?

Depends on what service you are talking about...

iptables is almost always a must. But tcp_wrappers doesn't work with everything...

-C

latinmusic74 · 03-26-2009, 11:51 PM

Do not you can deny or allow access to http using httpd.conf configuration file too?

custangro · 03-27-2009, 10:01 AM

Quote:

Originally Posted by latinmusic74

Do not you can deny or allow access to http using httpd.conf configuration file too?

Yes.

But tcp_wrappers doesn't work with httpd, so you HAVE to use iptables/httpd.conf file.

-C

latinmusic74 · 03-27-2009, 02:35 PM

With iptables you can control network access or host access to http.

With httpd.conf, I think you can control user and network access too..

juscelino · 03-28-2009, 11:30 PM

Hello guys,

SECTION I: TROUBLESHOOTING AND SYSTEM MAINTENANCE
RHCE requirements: completion of compulsory items (50 points)
overall section score of 80 or higher
RHCT requirements: completion of compulsory items (50 points)

Compulsory Section I score: 50.0
Non-compulsory Section I score: 50.0
Overall Section I score: 100

SECTION II: INSTALLATION AND CONFIGURATION
RHCE requirements: score of 70 or higher on RHCT components (100 points)
score of 70 or higher on RHCE components (100 points)

RHCT requirement: score of 70 or higher on RHCT components (100 points)

RHCT components score: 92.6
RHCE components score: 96.7

RHCE Certification: PASS

JUST PASSED!! Felling very relief right now..

latinmusic74 · 03-28-2009, 11:49 PM

Congratulations juscelino. What materials did you use to study for the test?

custangro · 03-29-2009, 11:22 AM

Quote:

Originally Posted by juscelino

Hello guys,

SECTION I: TROUBLESHOOTING AND SYSTEM MAINTENANCE
RHCE requirements: completion of compulsory items (50 points)
overall section score of 80 or higher
RHCT requirements: completion of compulsory items (50 points)

Compulsory Section I score: 50.0
Non-compulsory Section I score: 50.0
Overall Section I score: 100

SECTION II: INSTALLATION AND CONFIGURATION
RHCE requirements: score of 70 or higher on RHCT components (100 points)
score of 70 or higher on RHCE components (100 points)

RHCT requirement: score of 70 or higher on RHCT components (100 points)

RHCT components score: 92.6
RHCE components score: 96.7

RHCE Certification: PASS

JUST PASSED!! Felling very relief right now..

Congrats!

-C

juscelino · 04-01-2009, 01:49 PM

Quote:

Originally Posted by latinmusic74

Congratulations juscelino. What materials did you use to study for the test?

I used jang's book, the RH300 material, and some websites, vmware with 4 vm's to practice always rebuilding and every day during 3 months trying to learn new info.

Quote:

Congrats!

-C

TKS!

rhel5 · 04-06-2009, 12:28 PM

I have a quick question regarding iptables

If I were to secure something like nfs, can I use the gui firewall and a custom iptables command?

For example, check the nfs service on the system-config-securitylevel. Also, I use the command iptables -A INPUT -s ! 192.168.0.1 -p udp --dport 2049 -j DROP along with the gui.

Speaking of nfs port, it uses udp on port 2049 right?

Thanks!

custangro · 04-06-2009, 03:14 PM

Quote:

Originally Posted by rhel5

I have a quick question regarding iptables

If I were to secure something like nfs, can I use the gui firewall and a custom iptables command?

For example, check the nfs service on the system-config-securitylevel. Also, I use the command iptables -A INPUT -s ! 192.168.0.1 -p udp --dport 2049 -j DROP along with the gui.

Speaking of nfs port, it uses udp on port 2049 right?

Thanks!

Nope.

NFS uses port map to assign the ports...so NFS uses different ports depending on what portmap does; which makes iptables difficult to configure.

Luckily you can "tell" portmap to use the same ports all the time. See /etc/sysconfig/nfs for more info. Also you have to open port 111 (tcp/udp) for portmap as well in the firewall.

-C

descarte · 04-07-2009, 05:09 AM

ooo. i blogged something about this the other day:

http://www.azhowto.com/2009/04/05/nf...rewall-issues/

rhel5 · 04-07-2009, 12:44 PM

Thanks custangro & descarte.

Hmm... I don't see a /etc/sysconfig/nfs file. I do see the /etc/sysconfig/iptables

custangro · 04-07-2009, 01:17 PM

Quote:

Originally Posted by rhel5

Thanks custangro & descarte.

Hmm... I don't see a /etc/sysconfig/nfs file. I do see the /etc/sysconfig/iptables

If it's not there you can create the file with the entries that descarte mentioned in the blog.

-C