LINUX - Delete user account and its home directory

[Tested On]

CentOS Linux release 7.4.1708 (Core)

First please verify user home directory 

# cat /etc/passwd | grep {user}

testuser:x:1001:1002::/home/testuser:/bin/bash

--- /home/testuser - is the user home directory

To delete the user and everything in its home directory, issue the command below

# userdel --remove test

LINUX - Test ping ipv6 address

[Tested On]
Red Hat Enterprise Linux Server release 7.4 (Maipo)

--- Obtain your ipv6 address and network device information

# ifconfig

--- Test ping using ping6

# ping6 {ipv6-address}%{network-device}

SMTP - Testing SMTP communication using telnet client

[Tested On]
Red Hat Enterprise Linux Server release 7.4 (Maipo)

Note: For Windows Server, please make sure telnet client is installed.

# telnet
open {mail-server} 25
EHLO {mail-server}
MAIL FROM:{sender}
RCPT TO:{recipient}
DATA
Subject: Test from SMTP Mail Relay
This is a test message
. (this is a dot)
QUIT

--- expected output ---
open {mail-server} 25
EHLO {mail-server}
-- output --

250-mail-server Hello mail-server [IP], pleased to meet you

250-ETRN

250-AUTH LOGIN CRAM-MD5 PLAIN

250-8BITMIME

250-ENHANCEDSTATUSCODES

250 SIZE
-- output --
MAIL FROM:{sender}
-- output --
250 2.1.0 Sender OK
-- output --
RCPT TO:{recipient}
-- output --
250 2.1.5 Recipient OK
-- output --
DATA
-- output --

Start mail input; end with <CLRF>.<CLRF>

-- output --

Subject: Test from SMTP Mail Relay

This is a test message
.

250 2.6.0 Ok, message saved

QUIT

221 2.0.0 See ya in cyberspace

Connection closed by foreign host.

--- expected output ---

LINUX - Restrict sftp user to home directory

In some cases, you are required to restrict sftp users ( using FileZilla or Winscp ) to their respective home directories. This is how you do it.

# useradd cent
# passwd cent
-- set passsword

# groupadd sftp_users
# usermod -G sftp_users cent

# vi /etc/ssh/sshd_config
-- line 147: comment out the line below
#Subsystem sftp /usr/libexec/openssh/sftp-server

-- add the following just after the above line
Subsystem sftp internal-sftp

-- add follows to the end
Match Group sftp_users
  X11Forwarding no
  AllowTcpForwarding no
  ChrootDirectory /home
  ForceCommand internal-sftp

-- Save the file

# systemctl restart sshd

Try to access using your favourite windows sftp client or using sftp command line :

# sftp cent@localhost

SSH - Configuring SSH with auto login (without a password)

[Tested On]

CentOS Linux release 7.4.1708 (Core)

Setup ssh operations between 2 or more linux machines without the need to enter password. 

* Note that the following steps should be executed for each separate user account. In this case, I am using the root account.

On machine-1
# ssh-keygen -t rsa
Condition: Enter file in which to save the key (/root/.ssh/id_rsa): press <ENTER>
Condition: Enter passphrase (empty for no passphrase): press <ENTER>
Condition: Enter same passphrase again: press <ENTER>

# ssh-copy-id -i ~/.ssh/id_rsa.pub root@machine-2
Condition: Are you sure you want to continue connecting (yes/no)? type yes <ENTER>
Condition: root@machine-2's password: type {root password} <ENTER>

# chmod 0600 ~/.ssh/authorized_keys

On machine-2
# ssh-keygen -t rsa
Condition: Enter file in which to save the key (/root/.ssh/id_rsa): press <ENTER>
Condition: Enter passphrase (empty for no passphrase): press <ENTER>
Condition: Enter same passphrase again: press <ENTER>

# ssh-copy-id -i ~/.ssh/id_rsa.pub root@machine-1
Condition: Are you sure you want to continue connecting (yes/no)? type yes <ENTER>
Condition: root@machine-1's password: type {root password} <ENTER>

# chmod 0600 ~/.ssh/authorized_keys

After completing the setup, you will now be able to ssh between machine 1 and 2 without a prompt for password.

SSL - Obtain information about your SSL configuration

# openssl s_client -connect localhost:443

SSH - Remove SSH weak ciphers

CBC and Arcfour based ciphers are considered no longer secure. Please follow the steps to remove them from the ssh server

# vi /etc/ssh/shh_config
Replace #Ciphers line with: Ciphers aes128-ctr,aes192-ctr,aes256-ctr
Replace #MACs line with: MACs hmac-sha1,umac-64@openssh.com,hmac-ripemd160
- Save the file

Note there will no longer be a # in front of Cyphers and MACs.

# vi /etc/ssh/shhd_config
Look for the line "# Ciphers and keying" and "#RekeyLimit default none"
Below "#RekeyLimit default none" add:
Ciphers aes128-ctr,aes192-ctr,aes256-ctr
MACs hmac-sha1,umac-64@openssh.com,hmac-ripemd160
- Save the file

Restart sshd service
# systemctl restart sshd


To Test Weak Ciphers is no longer allowed :
# ssh -vv -oCiphers=aes128-cbc,3des-cbc,blowfish-cbc,aes256-arcfour,arcfour256,arcfour128 {target machine-ip}


To Check Current Allowed Ciphers on your localhost 
# sshd -T | grep "\(ciphers\|macs\)"