Bob’s interweb party house

Beyond RHCE, Red Hat offers “certificates of expertise” which, when stacked together, become advanced certifications.

The RHCSS, Red Hat Certified Security Specialist, requires three exams:

The RHCDS, Red Hat Certified Datacenter Specialist, requires three exams:

The RHCA, the ultimate commercial-facing certification in the Red Hat family (there are further certs available for trainers and those conducting examinations, but to me those fall into the “academic” classification). RHCA requires five exams: the three from the RHCDS cert, one from the RHCSS cert, and one additional:

For now, let’s focus on the RHCSS, and more granularly on the first exam of the trifecta required for the RHCSS, the Network Services exam. Since there is an overwhelming lack of curriculum, study guides, etc., online or in print, I present here the objectives from Red Hat’s own course description, as well as links to books that will most certainly aid in your studying, as well as being permanent references on the relevant topics.

RHS333: Red Hat Enterprise Security: Network Services

What you will learn:

RHS333 goes beyond the essential security coverage offered in the RHCE curriculum and delves deeper into the security features, capabilities, and risks associated with the most commonly deployed services. Among the topics covered in this four-day, hands-on course are the following:

1. The Threat Model and Protection Methods
* Internet threat model and the attacker’s plan
* System security and service availability
* An overview of protection mechanisms
2. Basic Service Security
* SELinux
* Host-based access control
* Firewalls using Netfilter and iptables
* TCP wrappers
* xinetd and service limits
3. Cryptography
* Overview of cryptographic techniques
* Management of SSL certificates
* Using GnuPG
4. Logging and NTP
* Time synchronization with NTP
* Logging: syslog and its weaknesses
* Protecting log servers
5. BIND and DNS Security
* BIND vulnerabilities
* DNS Security: attacks on DNS
* Access control lists
* Transaction signatures
* Restricting zone transfers and recursive queries
* DNS Topologies
* Bogus servers and blackholes
* Views
* Monitoring and logging
* Dynamic DNS security
6. Network Authentication: RPC, NIS, and Kerberos
* Vulnerabilities
* Network-managed users and account management
* RPC and NIS security issues
* Improving NIS security
* Using Kerberos authentication
* Debugging Kerberized Services
* Kerberos Cross-Realm Trust
* Kerberos Encryption
7. Network File System
* Overview of NFS versions 2, 3, and 4
* Security in NFS versions 2 and 3
* Improvements in security in NFS4
* Troubleshooting NFS4
* Client-side mount options
8. OpenSSH
* Vulnerabilities
* Server configuration and the SSH protocols
* Authentication and access control
* Client-side security
* Protecting private keys
* Port-forwarding and X11-forwarding issues
9. Electronic Mail with Sendmail
* Vulnerabilities
* Server topologies
* Email encryption
* Access control and STARTTLS
* Anti-spam mechanisms
10. Postfix
* Vulnerabilities
* Security and Postfix design
* Configuring SASL/TLS
11. FTP
* Vulnerabilities
* The FTP protocol and FTP servers
* Logging
* Anonymous FTP
* Access control
12. Apache security
* Vulnerabilities
* Access control
* Authentication: files, passwords, Kerberos
* Security implications of common configuration options
* CGI security
* Server side includes
* suEXEC
13. Intrusion Detection and Recovery
* Intrusion risks
* Security policy
* Detecting possible intrusions
* Monitoring network traffic and open ports
* Detecting modified files
* Investigating and verifying detected intrusions
* Recovering from, reporting, and documenting intrusions

Ready to take the plunge into VMware? Like the idea of server consolidation but don’t know where to start? Here’s a quick primer, that might save you some research time.

Hosts and Guests

A Host is the base operating system of the physical server. A Guest is an installed virtual machine server. Generally speaking, the Host operating system is independent of the Guest operating systems, and once you have a host system running, you can run just about any operating system inside of it as a Guest.

Choose Your Platform and Virtualization Software

I combined these two tasks because platform is often dependent on virtualization software. Xen uses Unix/Linux based Hosts, VMware uses Windows or Linux, Microsoft VM uses a Microsoft base. Parallels has products for Windows, Linux and even Mac, and seems to be growing, but it remains to be seen where their products will eventually converge focus. Parallels products include Parallels Desktop for Mac, Parallels Workstation, which seems to be comparable to VMware Workstation, and Parallels Virtuozzo, which was SWSoft’s virtualization product. SWSoft’s aggressive marketing led to fairly deep penetration in the large hosting provider markets, so Parallels may have a shot at serious competition in this arena.

I know that being RHCE-certified means I should be rocking Xen, but I haven’t gotten my feet wet in it yet. I have, however, heard good things about its virtualization methodology. Ask me again in a couple of weeks, or feel free to discuss your experiences in comments.

My primary focus has been VMware. There are things I really like about VMware. I’ve been happy with performance so far, even in just the Workstation version, but especially under ESX. There are plenty of comparisons out there between VMware, Microsoft Virtual Server and/or Xen, but they are largely unscientific and anecdotal, and some don’t even specify which version of VMware is being used. The consensus seems to be that Xen is faster than VMware (probably Workstation) which is faster than Microsoft Virtual Server.

For workstation-based Virtual Machine solutions, my preference is to house everything on a Unix or Linux base, with no graphical interface, reducing overhead. More specifically, my current preference is a CentOS base, and I’ll tell you why. Under Red Hat and Fedora-based systems, VMware generally needs to compile the VMMON for the working kernel. Because Fedora kernel updates are so frequent, this means that you will be running vmware-config.pl frequently to recompile vmmon, etc. CentOS is directly derivative of Red Hat Enterprise Linux (RHEL), and features far fewer kernel updates. There is a trade-off, of course, if you need to use things on the same PC which require newer kernel features. I have heard from a colleague that Debian’s approach may be a bit more sane in terms of its packaging these things (NVidia drivers have the same underlying problem of needing a recompile during kernel upgrades, and Debian may have conquered that as well) but again, I have not yet experienced it. I have a fundamental shortage of servers and time to do this type of research.

If you’ve read this far, you’ve read enough for today. I’ll continue this at a later date.

So you’re about to rebuild your WinXP system on another box, but you can’t find all those damned product activation keys. How annoying. You’ve got the software working already, you just need to activate the products on the other box. Enter RockXP, a tool that lets you quickly scan and recover all installed MS product activation keys on your Windows box. I ran it yesterday on one of my XP VMs, and recovered activation keys for XP, Office XP 2003 Pro, and Visio 2003 Pro, all within seconds. Good times. Thanks, Stephen, for cluing me in to that one.

Gotcha. No secrets here. Once you’ve worked that hard and endured that stress-ball of an examination, second only to Cisco’s CCIE Lab in terms of mental strain, you will NOT want to risk losing it by violating Red Hat’s confidentiality agreement. They can sue you, too, so you won’t event want to do it for money.

I sat for the exam yesterday. I arrived early, as it was in the center of traffic hell in Tysons Corner. I picked up a drink at the Blimpie (THEY HAVE A BLIMPIE IN THE BUILDING. HOW COOL IS THAT?) There were maybe ten of us total. I’m pretty sure everyone I spoke with had taken it once before. I had not. I have, however, sat for MANY other exams, so I wasn’t intimidated. It COULDN’T be as hard as CCIE, right? RIGHT??? No cell phones during the exam. Check. No students from Syria, Iran, or a few other hostile countries may sit for the exam. Something about encryption export regulations, he said. Maybe they don’t want any of them obtaining the cert, for which they will be actively recruiting shortly. That could be a good sign. “They” being high-dollar employers, hopefully.

First part, break-fix. Instant feedback. Nailed it 100%. Called home for congratulations. Catered lunch. Would it violate the CA to discuss the coffee and lunchmeat varieties available? Yummy.

Second part, install-config. I swear, I touched EVERY technology I could think of during this portion. I approached it by making circles next to each task, putting a dot when I thought they were done, filling them in when they had been tested as well as possible after reboot. I was surprised when I had been through all tasks and still had 35 minutes left. I used the time to double-check each task after another reboot, making checkmarks down the left side of my pages.

Training? Nil. I used Red Hat’s own exam/course objectives as a guideline, alternating between the Red Hat Deployment Guide and Jang’s study guide (updated for RHEL 5), spending the last two days cramming on the subjects in which I knew I was weak, and practicing break/fix scenarios in VMWare machines on my laptop. It’s easy to solve a problem when you know what caused it, BUT… if you DO it enough times, you will recognize the symptoms right away and find the solution immediately.

I called home again to report that I felt really positive about the experience, especially after nailing the first half. I was pretty positive that I had nailed the second half as well, but since some of it wasn’t described quite as clearly as I would have liked, and some of it was virtually untestable, I wondered how much that could potentially take off of my score.

I got home and immediately checked my email. First half: 100% as expected. Second half: RHCT portion, 93%. RHCE portion, 89%. WELL within the passing range. I didn’t just pass, I kicked its ass.

I wish I could tell you exactly what you need to know to pass that exam. All I can tell you, honestly, is do what I did, and be prepared to know EVERYTHING. It’s that kind of exam. They WILL test you on objectives in which you are weak. So don’t be weak.