Translations by Andreas Olsson

After successfully joining an Ubuntu machine to an Active Directory domain you can authenticate using any valid AD user. To login you will need to enter the user name as 'domain\username'. For example to ssh to a server joined to the domain enter:

Users enter a Uniform Resource Locator (URL) to point to a Web server by means of its Fully Qualified Domain Name (FQDN) and a path to the required resource. For example, to view the home page of the <ulink url="http://www.ubuntu.com">Ubuntu Web site</ulink> a user will enter only the FQDN. To request specific information about <ulink url="http://www.ubuntu.com/support/paid">paid support</ulink>, a user will enter the FQDN followed by a path.

The Squid proxy cache server is an excellent solution to a variety of proxy and caching server needs, and scales from the branch office to enterprise level networks while providing extensive, granular access control mechanisms and monitoring of critical parameters via the Simple Network Management Protocol (SNMP). When selecting a computer system for use as a dedicated Squid proxy, or caching servers, ensure your system is configured with a large amount of physical memory, as Squid maintains an in-memory cache for increased performance.

To set your Squid server to listen on TCP port 8888 instead of the default TCP port 3128, change the http_port directive as such:

To shutdown a virtual machine do:

While highly useful as a stand-alone system, Bazaar has good, optional integration with <ulink url="https://launchpad.net/">Launchpad</ulink>, the collaborative development system used by Canonical and the broader open source community to manage and extend Ubuntu itself. For information on how Bazaar can be used with Launchpad to collaborate on open source projects, see <ulink url="http://bazaar-vcs.org/LaunchpadIntegration/"> http://bazaar-vcs.org/LaunchpadIntegration</ulink>.

Based on server configuration, it prompts for password. Once you are authenticated, it checks out the code from Subversion repository. To synchronize the project repository with the local copy, you can run the <command>update</command> sub-command. The syntax of the command, entered at a terminal prompt, is as follows:

For more details about using each Subversion sub-command, you can refer to the manual. For example, to learn more about the co (checkout) command, please run the following command from a terminal prompt:

svn co svn+ssh://hostname/var/svn/repos/project

Subversion Home Page

User management is a critical part of maintaining a secure system. Ineffective user and privilege management often lead many systems into being compromised. Therefore, it is important that you understand how you can protect your server through simple and effective user account management techniques.

Instead, users are encouraged to make use of a tool by the name of <application>sudo</application> to carry out system administrative duties. <application>Sudo</application> allows an authorized user to temporarily elevate their privileges using their own password instead of having to know the password belonging to the root account. This simple yet effective methodology provides accountability for all user actions, and gives the administrator granular control over which actions a user can perform with said privileges.

sudo adduser username

sudo deluser username

Remember, any user added later on with the same UID/GID as the previous owner will now have access to this folder if you have not taken the necessary precautions.

You may want to change these UID/GID values to something more appropriate, such as the root account, and perhaps even relocate the folder to avoid future conflicts:

If your server will be home to multiple users, you should pay close attention to the user home directory permissions to ensure confidentiality. By default, user home directories in Ubuntu are created with world read/execute permissions. This means that all users can browse and access the contents of other users home directories. This may not be suitable for your environment.

The following output shows that the directory <filename class="directory">/home/username</filename> has world readable permissions:

You can remove the world readable permissions using the following syntax:

sudo chage -l username

sudo chage username

sudo chage -E 01/31/2008 -m 5 -M 90 -I 30 -W 14 username

Many applications use alternate authentication mechanisms that can be easily overlooked by even experienced system administrators. Therefore, it is important to understand and control how users authenticate and gain access to services and applications on your server.

Simply disabling/locking a user account will not prevent a user from logging into your server remotely if they have previously set up RSA public key authentication. They will still be able to gain shell access to the server, without the need for any password. Remember to check the users home directory for files that will allow for this type of authenticated SSH access. e.g. <filename>/home/username/.ssh/authorized_keys</filename>.

Be sure to check for any established SSH connections by the disabled user, as it is possible they may have existing inbound or outbound connections. Kill any that are found.

The default firewall configuration tool for Ubuntu is <application>ufw</application>. Developed to ease iptables firewall configuration, <application>ufw</application> provides a user friendly way to create an IPv4 or IPv6 host-based firewall.

It is also possible to allow access from specific hosts or networks to a port. The following example allows ssh access from host 192.168.0.2 to any ip address on this host:

The above command assumes that your private address space is 192.168.0.0/16 and that your Internet-facing device is ppp0. The syntax is broken down as follows:

<ulink url="http://www.fs-security.com/">Firestarter</ulink> is quite popular and easy to use.

If you prefer a command-line tool with plain-text configuration files:

<ulink url="http://www.linuxkungfu.org/">ipkungfu</ulink> should give you a working firewall "out of the box" with zero configuration, and will allow you to easily set up a more advanced firewall by editing simple, well-documented configuration files.

See the <ulink url="http://www.netfilter.org/documentation/HOWTO/packet-filtering-HOWTO.html">packet-filtering-HOWTO</ulink> for more information on using <application>iptables</application>.

<application>AppArmor</application> is a Linux Security Module implementation of name-based mandatory access controls. AppArmor confines individual programs to a set of listed files and posix 1003.1e draft capabilities.

<application>AppArmor</application> is installed and loaded by default. It uses <emphasis>profiles</emphasis> of an application to determine what files and permissions the application requires. Some packages will install their own profiles, and additional profiles can be found in the <application>apparmor-profiles</application> package.

<application>aa-complain</application> places a profile into <emphasis>complain</emphasis> mode.

The <filename>/etc/apparmor.d</filename> directory is where the AppArmor profiles are located. It can be used to manipulate the <emphasis>mode</emphasis> of all profiles.

<application>apparmor_parser</application> is used to load a profile into the kernel. It can also be used to reload a currently loaded profile using the <emphasis>-r</emphasis> option. To load a profile:

To reload a profile:

To <emphasis>re-enable</emphasis> a disabled profile remove the symbolic link to the profile in <filename>/etc/apparmor.d/disable/</filename>. Then load the profile using the <emphasis>-a</emphasis> option.

<application>AppArmor</application> profiles are simple text files located in <filename>/etc/apparmor.d/</filename>. The files are named after the full path to the executable they profile replacing the "/" with ".". For example <filename>/etc/apparmor.d/bin.ping</filename> is the AppArmor profile for the <filename>/bin/ping</filename> command.

<emphasis>#include &lt;tunables/global&gt;:</emphasis> include statements from other files. This allows statements pertaining to multiple applications to be placed in a common file.

<emphasis>/bin/ping flags=(complain):</emphasis> path to the profiled program, also setting the mode to <emphasis>complain</emphasis>.

<emphasis>capability net_raw,:</emphasis> allows the application access to the CAP_NET_RAW Posix.1e capability.

<emphasis>/bin/ping mixr,:</emphasis> allows the application read and execute access to the file.

After editing a profile file the profile must be reloaded. See <xref linkend="apparmor-usage"/> for details.

Reloading the program.

For details using AppArmor with other Ubuntu releases see the <ulink url="https://help.ubuntu.com/community/AppArmor"> AppArmor Community Wiki</ulink> page.

Before beginning, you should determine what the root of your LDAP directory will be. By default, your tree will be determined by your Fully Qualified Domain Name (FQDN). If your domain is example.com (which we will use in this example), your root node will be dc=example,dc=com.

For <application>Postfix</application> integration, we will associate the domain lists.example.com with the mailing lists. Please replace <emphasis>lists.example.com</emphasis> with the domain of your choosing.