Publish SSH Server through TMG

Yet another casual but useful post.

Here's how I did it.

If you have a look at all the protocols available in Forefront Threat Management Gateway Toolbox, SSH is there, but it is outbound.

TMG forwards only inbound protocols. So, You will have to create a new protocol definition with nay name you like, port 22 and "inbound". And then create a non-web server protocol publishing rule.

It seems dumb but ate my 10 minutes.

That's it.

RTNETLINK answers: File exists

If you've come across error "RTNETLINK answers: File exists" when using dhclient to renew IP address, here's how I did it:

root@SERVER02 :dhclient eth0 -r  
root@SERVER02 :dhclient eth0  

The -r option releases current configuration for the interface, allowing dhclient to create new config file.

6 things you probably want to do after Solaris 10 installation

1. Set BASH as default shell for root:
This is first thing I really do! Because bash has multiple advantages for day to day use and scripting too, over other shells.
For this you can simply edit /etc/passwd file and change the shell from very first line.
By default it is /sbin/sh, you can change it to /bin/bash

2. Change the hostname from "unknown"

To change the hostname temporarily:

 hostname SERVER01  

To change the hostname so that it is persistent across reboots:

 echo SERVER01 > /etc/nodename  

However, the changed hostname is re-set when you run sys-unconfig command to reset the configuration of the system.

3. Disable GUI Login:

 /usr/dt/bin/dtconfig -d  

For more, see here about disabling and enabling GUI login in Solaris

4. Configure loghost:
You might get messages such as "loghost could not be resolved.". To be able to resolve loghost you must configure DNS Server or you can add entry in /etc/hosts such as "127.0.0.1  loghost".

5. Disable sendmail:
You can disable sendmail by issuing a simple command,

 svcadm disable sendmail  

Hmm... not everybody uses sendmail... 

6. Set PS1 variable (This is only for people using BASH):
It is solely user's choice to set this variable. Solaris has it as PS1='\s-\v\$ ' by default.
However, I set it as PS1="$LOGNAME@$HOSTNAME# " so that it will be displayed as:

 root@SERVER01# _  

For more information on PS1 environment variable check here and to make it look like Angelina Jolie :D check here.

Solving basics hell out of vsftpd

Configuring vsftpd isn't a very hard thing. If you haven't read the docs, then its crucial to go.

I had a fresh installation of vsftpd on CentOS 6.2

I tweaked hardly one or two params in /etc/vsftpd/vsftpd.conf such as "anonymous_enable=NO"

Then created a new user using:

 #useradd -m -d /home/user1 -s /bin/bash user1  

Then I tried to connect to the server using our brand new user1.
Here's what I got:
500 OOPS: cannot change directory :/home/user1

After a bit digging on Google and thanks to this link, I was able to do it when I ran following command:

 /usr/sbin/setsebool -P ftp_home_dir 1  

This command takes a while to run, but it worked for me after that.
The setsebool sets boolean variables in SELinux.

Enabling Remote root login Solaris 10.

It is neither recommended nor suggested to allow remote root logins for security reasons.

For Test servers, Non-production servers or other servers, you may want to allow remote root login via SSH.

Usually you get "Access denied" errors when accessing a Solaris server as root when logging on remotely.

You just have to edit two entries in two files.

First:

/etc/default/login

Comment the following line in /etc/default/login by putting a # sign before the line.

 CONSOLE=/dev/console  

This will enable remote root logins to the system.

Second:
/etc/ssh/sshd_config

Comment the following line in /etc/ssh/sshd_config by putting a # sign before the line.

 PermitRootLogin no  

Then add the following line just below the above line.

 PermitRootLogin yes  

This will enable remote SSH and SCP Logins to the system.