If you wish to have your own Dropbox-like mirroring tool which continuously monitors for local
file changes and quickly replicates them to network storage, then you can use Lsyncd.
#Lsyncd

Network File System (NFS) is a distributed filesystem protocol that allows clients to access
remote files and directories as if they are available on the local system. This allows client
systems to leverage large centrally shared storage. Users can access the same data from
any system across the network. A typical setup for NFS includes a server that runs the NFS
daemon, nfsd, and lists (export) files and directories to be shared
#NFS

daemon : a process that run in backgroun (to provide networkbase functionality)

/bin/systemctl

initctl
systmctl

interface(phyiscal,VLAN,bridge)
ip link list
ip link list lo
//for down a link
ip link interfacename dow
//assigning an ip to an interface

ubunto

#ufw

sudo ufw status
sudo ufw allow ssh
sudo ufw allow 22
sudo ufw allow http/tcp
sudo ufw deny ftp
sudo ufw show added
sudo ufw enable
sudo ufw status verbose

You can also allow all ports in a range by specifying a port range:
$ sudo ufw allow 1050:5000/tcp
12. If you want to open all ports for a particular IP address, use the following command:
$ sudo ufw allow from 10.0.2.100
13. Alternatively, you can allow an entire subnet, as follows:
$ sudo ufw allow from 10.0.2.0/24
14. You can also allow or deny a specific port for a given IP address:
$ sudo ufw allow from 10.0.2.100 to any port 2222
$ sudo ufw deny from 10.0.2.100 to any port 5223
15. To specify a protocol in the preceding rule, use the following command:
$ sudo ufw deny from 10.0.2.100 proto tcp to any port 5223
16. Deleting rules:
$ sudo ufw delete allow ftp
17. Delete rules by specifying their numbers:
$ sudo ufw status numbered
$ sudo ufw delete 2
18. Add a new rule at a specific number:
$ sudo ufw insert 1 allow 5222/tcp
number 1
# Inserts a rule at
19. If you want to reject outgoing FTP connections, you can use the
following command:
$ sudo ufw reject out ftp
20. UFW also supports application profiles. To view all application profiles,
use the following command:
$ sudo ufw app list
21. Get more information about the app profile using the following command:
$ sudo ufw app info OpenSSH
22. Allow the application profile as follows:
$ sudo ufw allow OpenSSH
23. Set ufw logging levels [ off | low | medium | high | full ] with the help of the
following command:
$ sudo ufw logging medium

24. View firewall reports with the show parameter:
$ sudo ufw show added
$ sudo ufw show raw
# list of rules added
# show complete firewall
25. Reset ufw to its default state (all rules will be backed up by UFW):
$ sudo ufw reset


UFW also provides various configuration files that can be used:
f f /etc/default/ufw : This is the main configuration file.
f f /etc/ufw/sysctl.conf : These are the kernel network variables. Variables in this
file override variables in /etc/sysctl.conf .
f f
/var/lib/ufw/user[6].rules or /lib/ufw/user[6].rules are the rules
added via the ufw command.
f f /etc/ufw/before.init are the scripts to be run before the UFW initialization.
f f /etc/ufw/after.init are the scripts to be run after the UFW initialization
#ufw

1. lspci lists all pci devices. Combine it with grep to search for specific device.
2. Lsmod shows the status of modules in Linux kernels.
3. ip link lists all the available network devices with status and
configuration parameters.
4. ip addr shows the IP addresses assigned for each device.
5. ip route displays routing table entries.
6. tracepath / traceroute lists all the routers (path) between local and remote hosts.
7. iptables is an administration tool for packet filtering and NAT.
8. dig is a DNS lookup utility.
9. ethtool queries and controls network drivers and hardware settings.
10. route views or edits the IP routing table.
11. telnet was the interface for telnet protocol. Now it is a simple tool to quickly check
remote working ports.
12. Nmap is a powerful network mapping tool.
13. netstat displays network connections, routing tables, interface stats, and more.
14. ifdown and ifup start or stop the network interface. They are similar to ifconfig
down or ifconfig up .
#network debug

///etc/network/interfaces

#dhcp
auto eth0 #The eth0 line auto is used to automatically configure the eth0 interface at server startup.iface
eth0 inet dhcp
sudo /etc/init.d/networking restart

#static etc/network/interfaces
auto eth0
iface eth0 inet static
address 192.168.1.100
netmask 255.255.255.0
gateway 192.168.1.1
dns-nameservers 192.168.1.45 192.168.1.46
sudo /etc/init.d/networking restart

#enable
sudo ifup eth0

#disable
sudo ifdown eth0


#######################################################################
change your network parameters temporarily, you can use the ifconfig and route
commands as follows:

sudo ifconfig eth0 192.168.1.100 netmask 255.255.255.0

#Set the default gateway:
$ sudo route add default gw 192.168.1.1 eth0

#Edit /etc/resolv.conf to add temporary name servers (DNS):
nameserver 192.168.1.45
nameserver 192.168.1.46

When you no longer need this configuration, you can easily reset it with the
following command:
$ ip addr flush eth0

#######################################################################
DHCP is most commonly used to provide IP configuration settings, such as IP address, net
mask, default gateway, and DNS servers. However, it can also be set to configure the time
server and hostname on the client.
DHCP can be configured to use the following configuration methods:
1. Manual allocation: Here, the configuration settings are tied with the MAC address of
the client's network card. The same settings are supplied each time the client makes
a request with the same network card.
2. Dynamic allocation: This method specifies a range of IP addresses to be assigned
to the clients. The server can dynamically assign IP configuration to the client on
first come, first served basis. These settings are allocated for a specified time period
called lease; after this period, the client needs to renegotiate with the server to
keep using the same address. If the client leaves the network for a specified time,
the configuration gets expired and returns to pool where it can be assigned to other
clients. Lease time is a configurable option and it can be set to infinite.
###########################################################################################
Hiding behind the proxy with squid
n this recipe, we will install and configure the squid proxy and caching server.
proxy is generally combined with two different terms: one is forward proxy and the other is
reverse proxy.(Access control list)
Sarg – tool to analyze squid logs
Squid guard is another useful plugin for squid server. It is generally used to block a list of
websites so that these sites are inaccessible from the internal network.

When we say proxy, it generally refers to forward proxy. A forward proxy acts as a gateway
between a client's browser and the Internet, requesting the content on behalf of the client.
This protects intranet clients by exposing the proxy as the only requester.A proxy can also be
used as a filtering agent, imposing organizational policies. As all Internet requests go through
the proxy server, the proxy can cache the response and return cached content when a similar
request is found, thus saving bandwidth and time.

A reverse proxy is the exact opposite of a forward proxy. It protects internal servers from
the outside world. A reverse proxy accepts requests from external clients and routes them
to servers behind the proxy.External clients can see a single entity serving requests, but
internally, it can be multiple servers working behind the proxy and sharing the load. More
details about reverse proxies are covered in Chapter 3, Working with Web Servers.

#################################################################################################
Network Time Protocol (NTP) is a TCP/IP protocol for synchronizing time over a network.
1. First, synchronize the server's time with any Internet time server using the
ntpdate command:
$ ntpdate -s ntp.ubuntu.com
2. To install ntpd, enter the following command in the terminal:
$ sudo apt-get install ntp
Sometimes, the NTP daemon refuses to work if the time difference between local time and
central time is too big. To avoid this problem, we have synchronized the local time and central
time before installing ntpd. As ntpd and ntpdate both use the same UDP port, 123, the
ntpdate command will not work when the ntpd service is in use.


A central DHCP server can be configured to provide NTP settings to all DHCP clients. For this
to work, your clients should also be configured to query NTP details from DHCP. A DHCP client
configuration on Ubuntu already contains the query for network time servers.
#####################################################################################################
Install HAProxy:
Load balancing can be implemented at OSI Layer 4,
that is, at TCP or UDP protocol levels, or at Layer 7, that is, application level with HTTP, SMTP,
and DNS protocols.
#########################################################################################################3
IP defines the
rules for IP addressing and routing packets over network and provides an identity IP address
to each host on the network.

New Linux kernel provides a tool called sysctl that can be used to
modify kernel parameters at runtime without recompiling the entire kernel. We can use
sysctl to modify and TCP/IP parameters to match our needs.




If you successfully receive a response, then you have a working network connection.
If this does not work, then you can check the problem with the mtr command. This
command will display each router between your server and the destination server:
$ mtr -r -c 1 8.8.8.8

###########################################################################################################
VPN enables two or more systems to communicate privately and securely over the public
network or Internet. The network traffic is routed through the Internet, but is encrypted. You
can use VPN to set up a secure connection between two datacenters or to access office
resources from the leisure of your home.
The VPN service is also used to protect your online activities,
access location restricted contents,
and bypass restrictions imposed by your ISP.


VPN services are implemented with a number of different protocols, such as Point-to-Point
Tunneling Protocol (PPTP), Layer two tunneling protocol (L2TP), IPSec, and SSL.

OpenVPN is an open source SSL VPN solution and provides a wide range of configurations.
OpenVPN can be configured to use either TCP or UDP protocols. In this recipe, we will
set up OpenVPN with its default UDP port 1194.

When the OpenVPN service is started on the OpenVPN host, it creates a new virtual network interface,
a tun device named tun0 . On the client side, OpenVPN provides the client with tools that
configure the client with a similar setup by creating a tap device on the client's system.

Note that OpenVPN provides a web-based admin interface
to manage VPN clients. This is a commercial offering
that provides an easy-to-use admin interface to manage
OpenVPN settings and client certificates.
####################################################################################################################
It is said that the best way to improve server security is to reduce the attack surface.

One part of the attack surface is the number of open ports that are waiting for connection
to be established. It is always a good idea to block all unrequired ports.
Any traffic coming to these ports can be filtered, that is, allowed or blocked with the help of a
filtering system.
The Linux kernel provides a built-in packet filtering mechanism called netfilter, which is used
to filter the traffic coming in or going out of the system.

All modern Linux firewall systems use
netfilter under the hood. Iptables is a well-known and popular user interface to set up and
manage filtering rules for netfilter.
It is a complete firewall solution that is highly configurable
and highly flexible. However, iptables need effort on the user's part to master the firewall
setup. Various frontend tools have been developed to simplify the configuration of iptables.
UFW is among the most popular frontend solutions to manage iptables.

################################################
So you have installed minimal setup of Ubuntu, you have setup SSH with public key
authentication and disabled password authentication, and you have also allowed only single
non-root user to access the server. You also configured a firewall, spending an entire night
understanding the rules, and blocked everything except a few required ports. Now does this
mean that your server is secured and you are free to take a nice sound sleep? Nope.

Servers are exposed to the public network, and the SSH daemon itself, which is probably the
only service open, and can be vulnerable to attacks. If you monitor the application logs and
access logs, you can find repeated systematic login attempts that represent brute force attacks.

Fail2ban is a service that can help you monitor logs in real time and modify iptables rules to
block suspected IP addresses. It is an intrusion-prevention framework written in Python. It can
be set to monitor logs for SSH daemon and web servers. In this recipe, we will discuss how to
install and configure fail2ban.
##################################################################################################

Follow these steps to discuss Ubuntu security best practices:
1. Install updates from the Ubuntu repository. You can install all the available updates or
just select security updates, depending on your choice and requirement:
$ sudo apt-get update
$ sudo apt-get upgrade
2. Change the root password; set a strong and complex root password and note it down
somewhere. You are not going to use it every day:
$ sudo passwd
3. Add a new user account and set a strong password for it. You can skip this step if the
server has already set up a non-root account, like Ubuntu:
$ sudo adduser john
$ sudo passwd john
4. Add a new user to the Sudoers group:
$ sudo adduser john sudo
5. Enable the public key authentication over SSH and import your public key to
new user's authorized_keys file.
6. Restrict SSH logins:
1. Change the default SSH port:

port 2222
2. Disable root login over SSH:

PermitRootLogin no

3. Disable password authentication:

PasswordAuthentication no
4. Restrict users and allow IP address:

AllowUsers john@(your-ip) john@(other-ip)
7. Install fail2ban to protect against brute force attacks and set a new SSH port
in the fail2ban configuration:
$ sudo apt-get install fail2ban
8. Optionally, install UFW and allow your desired ports:
$ sudo ufw allow from <your-IP> to any port 22 proto tcp
$ sudo ufw allow 80/tcp
$ sudo ufw enable
9. Maintain periodic snapshots (full-disk backups) of your server. Many cloud
service providers offer basic snapshot tools.
10. Keep an eye on application and system logs. You may like to set up log-monitoring
scripts that will e-mail any unidentified log entry.

$ sudo useradd -s <SHELL> -m -d <HomeDir> -g <Group> UserName
Where:
f f -s specifies default login shell for the user
f f -d sets the home directory for the user
f f -m creates a home directory if one does not already exist
f f -g specifies the default group name for the user


sudo adduser bob


You can set or change the user password with the following command:
$sudo passwd bob


username:passwd:uid:gid:full name:home_dir:shell



4. Now log in with user2 :
user1@ubuntu:~$ su user2



$ sudo usermod --expiredate 1 john # disable the user account john
$ sudo usermod --expiredate "" john # re-enable user account john
$ sudo usermod -e YYYY-MM-DD john # specify expiry date


$chown newuser filename
To change the owner as well as the group of file, use the following command:
$chown newuser:newgroup filename
You can skip changing owner and change only the group with the following command:
$chown :newgroup filename



$sudo adduser john
2. Make john a member of sudo group with the following command:
$sudo adduser username sudo
#usermanagement

Nginx can be considered the next generation of web servers. Its development started to solve
the C10k problem, that is, handling ten thousand connections at a time. Apache, being a
process-driven model, has some limitations when handling multiple concurrent connections.
Nginx took advantage of the event-driven approach with asynchronous, non-blocking
connection handling algorithms. A new connection request is handled by a worker process
and placed in an event loop where they are continuously checked for events. The events are
processed asynchronously. This approach enables Nginx to run with a much lower memory
footprint and lower CPU use. It also eliminates the overload of starting a new process for a
new connection. A single worker process started by Nginx can handle thousands of concurrent
connections.

If your business does have single points of failure, like many services on one host, backup and
recovery become critical.

Interfaces are generally in two major states—up and down. Interfaces that are up are active and can
be used to receive network traffic. Interfaces that are down are not connected to the network.
#networkInterface

What kinds of interfaces can you configure? Modern computer hosts nowadays can easily have more
than one network card (or network interface) and sometimes have many hundreds of IP addresses.
#networking

An
interface can have many aliases, or you can bond or team two or more interfaces together to appear as one
interface.
#networkInterface

Linux gives you the ability to have multiple IP addresses on a single interface. The interface uses the
same Mac address for all IP addresses.
#networkInterface

A bonded, or teamed, interface consists of two or more network
interfaces appearing as a single interface. This can be used to provide greater fault tolerance or increased
bandwidth for the interface.