Here are the basics:
/etc/login.defs – Controls account creation requirements… Password aging, length, umask, encryption (and more) – however changes made to existing accounts (passwords, aging, etc) can be controlled by PAM

/etc/pam.d/system-auth – Controls password length, strength, etc

/etc/login.defs is fairly well commented and is part of the shadow password suite. Most admins will have no issues setting this to fit their needs. Here are some settings that you may want to alter:
PASS_MAX_DAYS 90
PASS_MIN_DAYS 1
PASS_MIN_LEN 8
PASS_WARN_AGE 7

Other settings like umask, encryption (md5), home directories and other options have defaults that will most likely meet your needs, however, look over them and configure as needed. The man page on login.defs is also very helpful(man 5 login.defs).

/etc/pam.d/system-auth controls some additional password information. Two really useful modules are pam_passwdqc and pam_tally

For pam_passwdqc, find the following in the file:

password requisite pam_cracklib.so try_first_pass retry=3

and replace with this line:

password requisite pam_passwdqc.so min=disabled,disabled,12,8,7 retry=3

The “min=” entry sets MINIMUM password length for different password classes separated by commas -N0,N1,N2,N3,N4
N0 – passwords with characters of only one type (i.e. only lowercase letters)
N1 – passwords with characters of two types
N2 – general passprases (consisting of several words – defined by passphrase=N option)
N3 and N4 – passwords consisting of characters from three and four character classes

So, the following:

min=disabled,disabled,24,10,8

Shows N0 and N1 not allowed and minimum requirements for the others

See the manpage for pam_passwdqc for more information on this subject.

For pam_tally, insert the following line to count failed login attempts and lock accounts:

auth required pam_tally.so onerr=fail deny=5 unlock_time=36000

This will lock the account after 5 unsuccessful attempts for 10 hours. Failed login information is stored in /var/log/faillog. Login failure counts can be reset by the faillog command.

For more information, see the man pages for pam_tall and faillog

Note:

1. Both options have password length, I’ve seen inconsistencies and weird issues when the two don’t match.
2. Mis-configured PAM can hose your system and your ability to fix it. make sure you backup your system-auth file before making ANY changes.
3. Runninng “authconfig” on a rhel system will overwrite your changes to the /etc/pam.d/system-auth file – so be careful with it or disable it.
4. PAM configuration has an endless number of options and you can explore the setup by viewing the different entries in your /etc/pam.d/* files.
5. Both pam_cracklib and pam_passwdqc help secure passwords – pam_passwdqc has more options and features including support for stronger enforcement. For a quick discussion on one vs two vs both… look here.

The output for a verify command will list its finding in a filesystem permissions like output. Here’s an example:

$ sudo rpm -V screen

S.?..... /usr/bin/screen

Below is the output key for quick analyses:

S file Size differs
M Mode differs (includes permissions and file type)
5 MD5 sum differs
D Device major/minor number mismatch
L readLink(2) path mismatch
U User ownership differs
G Group ownership differs
T mTime differs

So, for the above output, we see that the file size has changed from the information contained in the signed package.

The one benefit of this method of checking over tripwire is that when an RPM is updated, there is no configuration required to scan your system for the changed binaries. HOWEVER – If you are in need of a serious security/audit function for file integrity checking, use tripwire over rpm.

If you’re not sure which HMC’s have control of an LPAR, use this command to get the low down:

lsrsrc IBM.ManagementServer

$ lsrsrc IBM.ManagementServer

Resource Persistent Attributes for IBM.ManagementServer
resource 1:
Name = "10.0.5.111"
Hostname = "10.0.5.111"
ManagerType = "HMC"
LocalHostname = "10.0.1.150"
ClusterTM = "1234-567"
ClusterSNum = ""
ActivePeerDomain = ""
NodeNameList = {"mynode1"}

So here’s a command to find the serial number of frame your LPAR is sitting on:

lsattr -El sys0 -a systemid

$ lsattr -El sys0 -a systemid
systemid IBM,00000XXXXX Hardware system identifier False

To format this to the normal XX-XXXXX version, use something like this in a script:

SERIAL=$(lsattr -El sys0 -a systemid |cut -d"," -f2 | awk '{print $1}')
PREFIX=$(echo ${SERIAL} |cut -c3-4)
SUFFIX=$(echo ${SERIAL} |cut -c5-9)

S_NUMBER=$(echo ${PREFIX}-${SUFFIX})

Now you have the $S_NUMBER variable with the properly formatted Serial Number

$ sudo route del net default 10.0.1.254

While this cleared up the traffic and helped the server resume normal operations, it wasn’t persistent.

I couldn’t remember the command line that caused AIX’s ODM to remember the settings at reboot, so I used smit..

$ sudo smitty tcpip
$ sudo smitty route

Both options seemed to work, but weren’t persistent after a reboot. After some digging, I found out why….

The smitty tcpip command was wrong… period.
And the smitty route (specifying delete a route) won’t work unless you flush the routes first (duh!).

Here’s what I found for command line options to save myself some grief next time…

$ sudo route -f
$ sudo chdev -l inet0 -a route=0,10.0.1.254

Persistent and works without smit!

Also note that the following will work in place of “route -f”
route delete 0

There’s a decent discussion of it here which would have saved me some pain had I found this before I figured it out.

Enjoy!

(excitement!)

It’s fairly easy to encrypt “somefile”:

openssl enc -aes-256-cbc -salt -in somefile -out somefile.enc

Basically, with openssl, we’re asking it to:
encrypt a file – enc
use a good encryption method – aes-256-cbc
give us some salt (to enhance encryption)
specify the file we want to encrypt – in somefile
and specify what we want the encrypted version to be called… i used .enc, but you can have fun and use something like .tar… just to add confusion for no reason.

$ openssl enc -aes-256-cbc -salt -in somefile -out somefile.enc
enter aes-256-cbc encryption password:
Verifying - enter aes-256-cbc encryption password:
$
$ ls -l somefile*
-rw-r----- 1 me system 19 Oct 12 15:16 somefile
-rw-r----- 1 me system 48 Oct 12 15:17 somefile.enc
$

just make sure to remove the original file or you’ll be no better off than you were a minute ago

hardstatus string '%{= kg} %= %114`%115`%117`%118`%116`%106`%103`%105`%107`%Y-%m-%d %0c:%s'

First of all, if its a dmg file, it needs to be mounted.

sudo hdiutil attach ./some-package.dmg

Once attached, you’re ready to rock!

sudo installer -pkg /Volumes/some-package/here.pkg -target /

Yay!

First things first… ssh to the computer you want to view and turn on VNC… er.. Apple’s Desktop Sharing.

sudo /System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Resources/kickstart -activate -configure -access -on -clientopts -setvnclegacy -vnclegacy yes -clientopts -setvncpw -vncpw mypasswd -restart -agent -privs -all

Once this is done, any vncviewer will work. I prefer ChickenoftheVNC for mac… most anything on linux… and pass on windows.

Once done, we should button the system back up to keep it secure.

sudo /System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Resources/kickstart -deactivate -configure -access -off

DONE!~