Linuxtechi

How to Enforce Password Policies in Linux (Ubuntu / CentOS)

Wed, 12 Aug 2020 12:41:39 GMT

As much as Linux is considered a secure operating system, its security is just as good as the password strength of login users. Password policies exist to ensure that a strong password is set for users and as a Linux user, you should be mindful to enforce these policies to make it difficult for breaches to occur. You surely don’t want users configuring weak or guessable passwords which can be brute forced by hackers in a matter of seconds.

In this article, we touch base on how to enforce password policies in Linux, more specifically CentOS and Ubuntu. We will cover enforcing password policies such as password expiration period, password complexity and password length.

Enforce Password Policies in Ubuntu / Debian

There are 2 main ways that you can enforce password policies. Let’s take a look at each in detail.

1) Configure the maximum number of days that a password can be used

For start, you can configure a password policy that requires users to change their passwords after a certain number of days. Best practice dictates that a password should be changed periodically to keep malicious users off-kilter and make it harder for them to breach your system. This applies not just in Linux but in other systems such as Windows and macOS.

To achieve this In Debian/Ubuntu, you need to modify the /etc/login.defs file and be on the lookout for the PASS_MAX_DAYS attribute.

By default, this is set to 99,999 days as shown.

You can modify this to a reasonable duration, say, 30 days. Simply set the current value to 30 as shown and save the changes. Upon lapsing of the 30 days, you will be compelled to create another password.

2) Configure Password complexity with pam

Ensuring that password meets a certain degree of complexity is equally crucial and further thwarts any attempts by hackers to infiltrate your system using brute force.

As a general rule, a strong password should have a combination of Uppercase, lowercase, numeric and special characters and should be at least 12-15 characters long.

To enforce password complexity in Debian / Ubuntu systems, you need to install the libpam-pwquality package as shown:

$ sudo apt install libpam-pwquality

Once installed, head out to the /etc/pam.d/common-password file from where you are going to set the password policies. Be default, the file appears as shown:

Locate the line shown below

password   requisite   pam_pwquality.so retry=3

Add the following attributes to the line:

minlen=12 maxrepeat=3 ucredit=-1 lcredit=-1 dcredit=-1 ocredit=-1 difok=4 reject_username enforce_for_root

The entire line should appear as shown:

Let’s flesh out what these directives stand for:

retry=3: This option will prompt the user 3 times before exiting and returning an error.
minlen=12: This specifies that the password cannot be less than 12 characters.
maxrepeat=3: This allows implies that only a maximum of 3 repeated characters can be included in the password.
ucredit=-1: The option requires at least one uppercase character in the password.
lcredit=-1: The option requires at least one lowercase character in the password.
dcredit=-1: This implies that the password should have at last a numeric character.
ocredit=-1: The option requires at least one special character included in the password.
difok=3: This implies that only a maximum of 3 character changes in the new password should be present in the old password.
reject_username: The option rejects a password if it consists of the username either in its normal way or in reverse.
enforce_for_root: This ensures that the password policies are adhered to even if it’s the root user configuring the passwords.

Enforce Password Policies in CentOS / RHEL

For Debian and Ubuntu systems, we enforced the password policy by making changes to the /etc/pam.d/common-password configuration file.

For CentOS 7 and other derivatives, we are going to modify the /etc/pam.d/system-auth or /etc/security/pwquality.conf configuration file.

So, proceed and open the file:

$ sudo vim /etc/pam.d/system-auth

Locate the line shown below

password    requisite     pam_pwquality.so try_first_pass local_users_only retry=3 authtok_type=

Append the options in the line as shown.

minlen=12 lcredit=-1 ucredit=-1 dcredit=-1 ocredit=-1 enforce_for_root

You will end up having the line below:

Once done, save the password policies and exit the file.

Once again, when you try creating a user with a weak password that doesn’t adhere to the enforced policies, you will encounter the error shown in the terminal.

Conclusion

As you have seen, enforcing a password policy is quite easy and serves as a superb way of preventing users from setting up weak passwords which may easy to guess or prone to brute-force attacks. By enforcing these policies, you can rest assured that you have fortified your system’s security and made it more difficult for hackers to compromise your system.

How to Access Google Drive on Ubuntu 20.04 (Focal Fossa)

Mon, 10 Aug 2020 04:18:27 GMT

Google Drive is a cloud storage option that provides an excellent backup solution for all your files and folders. We cannot emphasize enough the importance of having backup copies of your files. Anything can happen at any time and when it does, you want to ensure that you are on the safe side and can log in to Google Drive and recover your lost documents.

That said, Having Google Drive sync capability on your Linux PC is of utmost importance. With Google Drive, you will get free 15GB to get you started and thereafter, you will pay according to the amount of space you need to secure your files. In this guide, you will learn different ways that you can use to access Google Drive on your Ubuntu 20.04 LTS Desktop (Focal Fossa).

Mount / Access Google Drive using the Online accounts feature

This is by far the easiest way of accessing Google Drive on your system. To start off, search for the ‘Online accounts’ option in the application menu as shown. Then click on the ‘Online Accounts’ option as shown.

This ushers you to the ‘Online Accounts’ section displaying various options that you can access and connect with. Since we are interested in accessing Google Drive, we will click on the ‘Google’ option as shown:

Next, you will be required to sign into your Google Account, Firstly, provide your Gmail email address.

Press the ‘ENTER’ button to proceed to the next step where you will be required to provide your password:

Then press the ‘ENTER’ button. If you have secured your Google Account with a 2-step verification method, you will be required to act accordingly to access your account.

Next, GNOME will request your permission to access your Google Account and gain access to your Gmail account, Google Drive among other things as shown.

Scroll down and click ‘Allow’

In the next step, you can choose to select the features that you’d want to sync between your PC and your Google account. In this case, I have opted to turn on all the settings.

At this point, your Google account will be attached or associated with this PC. To access your Google Drive directory, head out to the file manager as shown.

In the ‘Files’ window, scroll down and double-click on the Google Drive icon as shown below to mount the Google Drive folder and access your files and folders.

From there, you can copy and paste files to the mounted Google Drive folder and sync with your online Google Drive account. Just place a file on the mounted folder and head over to Google Drive and confirm if it exists.

Access Google Drive using Insyc

Insync is a cross-platform client that allows you to access and manage your Google Drive and OneDrive files and folders straight from your PC. It’s free for 14 days upon which you will be required to pay according to your preferred subscription.

To get started, head out to Insync downloads page

Select to download the Linux Debian package that corresponds to Ubuntu 20.04.

Once you have downloaded the Debian package, install Insync by executing the command shown:

$ sudo dpkg -i isync_3.2.4.40856-focal_amd64.deb

Upon successful installation, the following pop-up will be displayed on your screen. To launch the application, click on the ‘Start Insync’ button.

Alternatively, you can search for it using the application menu as shown:

Insync will present you with two options: either to add Google Drive or One Drive. In this case, select ‘Add Google Drive’ option as shown.

In the next 2 steps, you will be required to sign in to your Gmail account. First, provide your email address and hit ‘ENTER’ or click ‘Next’.

Next, provide the corresponding password to your Gmail account.

Thereafter, allow Insync to have access to your Google Account by clicking on the ‘Allow’ button.

If the credentials are all good, you will get the notification below on your web browser.

Exit the browser, and head back to Insync client. Click on the ‘Next’ button as shown.

By default, Insync will suggest the base folder for your Google Drive location on your PC. IF you are okay with the default selection, click on the ‘Next’ button. Otherwise, if you prefer to define your own path, click on the ‘change’ button.

The next selection gives you an option to start syncing your files immediately or to perform additional steps. For now, simply click ‘Not now’

And finally, the Google Drive folder will be attached or mounted to your PC and you will have access to all your files and folders as shown. You can either upload or download files and the changes will be synced on your online Google Drive account.

Final thoughts

As you have seen, mounting Google Drive on your PC is quite an easy and straight forward task and just takes a few steps to have Google Drive mounted on your system. As always, it’s recommended to upload or copy crucial files onto the Google Drive folder for backup purposes such that if your PC crashes, you can always log in to your Google account and retrieve your files.

How to Install and Configure Checkmk on CentOS 8 / RHEL 8

Wed, 05 Aug 2020 04:21:12 GMT

Developed in Python & C++ languages, Checkmk is an open-source monitoring server that is an improvement of Nagios operating system with enhanced plugins and monitoring capabilities. Checkmk uses agents to collect and ship remote systems’ metrics to the server. The agents are available for both Linux and Windows systems in 32 & 64-bit architectures.

Checkmk is used in monitoring applications, servers and even cloud infrastructure such as AWS and Azure. In this guide, we will walk you through how to install and configure Checkmk on CentOS 8 and later on, see how you can add both Linux and Windows hosts to checkmk server for monitoring.

We will install Checkmk using the OMD (Open Monitoring Distribution) bundle. This bundle ships with Nagios and all the necessary plugins required for monitoring various services.

Lab Setup details for Checkmk

This will be our set up

Checkmk Server – CentOS 8
Host 1 – CentOS 8
Host 2 – Windows Server 2019

Step 1) Update the system

To start off, it’s always advisable to update your package lists to start on a clean slate. Therefore, log in to the Checkmk server and run the off command below.

$ sudo dnf update -y

Once the update is completed successfully and reboot the system once.

Step 2) Install prerequisite packages

Once the update is complete, you need to install a couple of packages for the installation of Checkmk monitoring tool to go smoothly.

First, you need to install EPEL. This is short for Extra Packages for Enterprise Linux. This is a package repository that provides additional packages that are not present in the default AppStream repositories for CentOS 8. This will prove beneficial as some of the packages required by OMD are contained in EPEL.

To install the EPEL repository, execute the command:

$ sudo dnf install epel-release

Press ‘y’ on the keyboard and hit ENTER to proceed with the installation.

Next, ensure that you install xinetd and OpenSSL packages. Therefore, run the command:

$ sudo dnf install xinetd openssl -y

Also, ensure that Python 3 is installed (It comes preinstalled by default on CentOS 8). In case it is not installed on your CentOS 8 / RHEL 8 system then run following command to install it,

$ sudo dnf install python3 -y

Run following command to verify the python version

[linuxtechi@checkmk ~]$ python3 -V
Python 3.6.8
[linuxtechi@checkmk ~]$

Don not forget to install ‘graphiz-gd’ package from PowerTools repository, run the following dnf command

$ sudo dnf --enablerepo=PowerTools install graphviz-gd -y

Step 3) Set SELinux and firewall rules for checkmk

SELinux is a kernel security module that enhances the security of your CentOS 8 and RHEL 8 system. Set the following selinux rule to allow web server to access network interfaces,

$ sudo setsebool -P httpd_can_network_connect 1

Now allow http service or its port in firewall, run

$ sudo firewall-cmd --zone=public --add-service=http --permanent
$ sudo firewall-cmd --reload

Note: You can skip this only if Selinux and firewalld is disabled on your system.

Step 4) Installing Checkmk monitoring tool

With all the prerequisites out of the way, it’s time now to install Checkmk First, download the RPM package from the Official site.

$ wget https://checkmk.com/support/1.6.0p14/check-mk-raw-1.6.0p14-el8-38.x86_64.rpm

Once downloaded install Checkmk rpm package with –nogpgcheck option to avoid signing of the package which might result in errors later on during the installation process.

$ sudo dnf install --nogpgcheck check-mk-raw-1.6.0p14-el8-38.x86_64.rpm -y

The next thing you need to do is to create an OMD instance. We are going to create one for testing purpose (sandbox).

Note: You can replace the OMD instance name that suits to your setup.

$ sudo omd create sandbox

You should get the output shown below:

What the command does is that it creates a new omd instance together with a user and a group called ‘sandbox’ alongside the user’s home directory which is created in the ‘/omd/sites/sandbox’ path.

To start the instance, switch to either the omd user or the root user and run the command:

$ omd start

To access the Check_MK front end interface, open your web browser and browser the URL shown:

http://server-IP/sandbox

Click the ‘Login’ button to access the dashboard which is shown below.

Step 5) Add a remote Linux host to Checkmk for monitoring

Having successfully installed and set up Checkmk, We are going to demonstrate how you can monitor various hosts. First, we are going to add a Linux host, in this case, a CentOS 8 system, which requires you to install the Checkmk agent.

There are 2 ways to go about this. You can download the Checkmk agent from the server by browsing shown.

http://server-ip/sandbox/check_mk/agents

Append the agent’s name to the URL and download using the wget command as shown

$ wget http://server-ip/sandbox/check_mk/agents/check-mk-agent-1.6.0p14-1.noarch.rpm

Replace the server-ip that suits to your setup, in my case it would be ’35.222.59.10’

The other way is to directly download the agent from the official site.

$ wget https://checkmk.com/support/1.6.0p14/check-mk-raw-1.6.0p14-el8-38.x86_64.rpm

Once you have downloaded the agent, install it using the rpm command as shown:

$ rpm -ivh check-mk-agent-1.6.0p14-1.noarch.rpm

Then install xinetd daemon.

$ sudo dnf install xinetd -y

The Checkmk agent listens on port 6556, and so we need to open the port on the firewall so that it can ship the Linux host’s metrics to the Checkmk server.

To open the port and effect the changes on the firewall, run the command:

$ sudo firewall-cmd --permanent --add-port=6556/tcp
$ sudo firewall-cmd --reload

Now head over to the Checkmk dashboard and navigate to ‘WATO Configuration’ –> ‘Hosts’ –> ‘Create New Host’

In the next page, fill out the details of the host such as the hostname, IP address, and remember to check off the checkmk agent checkbox.

Then click on ‘Save and Finish’

Shortly after, a list of the host’s services will be populated as shown

Let’s now have a look at how you can add a Windows host system.

Step 6) Add a remote Windows host to checkmk for monitoring

Adding a Windows host is very similar to adding a Linux host. To get started, browse the following URL

http://server-ip/sandbox/check_mk/agents/windows/

To download the Windows agent, click on either check_mk_agent.msi or check_mk_agent-64.exe package.

Once downloaded, run the installer as shown using the install Wizard.

Once done, head over to the services Window and confirm that the agent is running as shown.

Equally important, ensure that you have allowed the checkmk service across Windows Firewall as shown.

Finally, head over to the Checkmk server and add the Windows host system the same way we added the Linux host. When you are done, the host’s services will be populated as shown,

Awesome! We have managed to install the Checkmk monitoring server and successfully managed to add the Linux and Windows host systems for monitoring. We hope this guide was beneficial. The ball is now in your court. Give it a try and let us know how it went.