4 Effective Methods to Disable SELinux Temporarily or Permanently

On some of the Linux distribution SELinux is enabled by default, which may cause some unwanted issues, if you don’t understand how SELinux works and the fundamental details on how to configure it. I strongly recommend that you understand SELinux and implement it on your environment. But, until you understand the implementation details of SELinux you may want to disable it to avoid some unnecessary issues.
 
To disable SELinux you can use any one of the 4 different methods mentioned in this article.

The SELinux will enforce security policies including the mandatory access controls defined by the US Department of Defence using the Linux Security Module (LSM) defined in the Linux Kernel. Every files and process in the system will be tagged with specific labels that will be used by the SELinux. You can use ls -Z and view those labels as shown below.

# ls -Z /etc/
-rw-r--r--  root root  system_u:object_r:etc_t:s0       a2ps.cfg
-rw-r--r--  root root  system_u:object_r:adjtime_t:s0   adjtime
-rw-r--r--  root root  system_u:object_r:etc_aliases_t:s0 aliases
drwxr-x---  root root  system_u:object_r:auditd_etc_t:s0 audit
drwxr-xr-x  root root  system_u:object_r:etc_runtime_t:s0 blkid
drwxr-xr-x  root root  system_u:object_r:bluetooth_conf_t:s0 bluetooth
drwx------  root root  system_u:object_r:system_cron_spool_t:s0 cron.d
-rw-rw-r--  root disk  system_u:object_r:amanda_dumpdates_t:s0 dumpdates

Method 1: Disable SELinux Temporarily

To disable SELinux temporarily you have to modify the /selinux/enforce file as shown below. Please note that this setting will be gone after the reboot of the system.

# cat /selinux/enforce
1

# echo 0 > /selinux/enforce

# cat /selinux/enforce
0

 
You can also use setenforce command as shown below to disable SELinux. Possible parameters to setenforce commands are: Enforcing , Permissive, 1 (enable) or 0 (disable).

# setenforce 0

Method 2: Disable SELinux Permanently

To disable the SELinux permanently, modify the /etc/selinux/config and set the SELINUX=disabled as shown below. One you make any changes to the /etc/selinux/config, reboot the server for the changes to be considered.

# cat /etc/selinux/config
SELINUX=disabled
SELINUXTYPE=targeted
SETLOCALDEFS=0

 
Following are the possible values for the SELINUX variable in the /etc/selinux/config file

• enforcing – The Security Policy is always Encoforced
• permissive - This just simulates the enforcing policy by only printing warning messages and not really enforcing the SELinux. This is good to first see how SELinux works and later figure out what policies should be enforced.
• disabled - Completely disable SELinux

 
Following are the possible values for SELINUXTYPE variable in the /etc/selinux/config file. This indicates the type of policies that can be used for the SELinux.

• targeted - This policy will protected only specific targeted network daemons.
• strict - This is for maximum SELinux protection.

Method 3: Disable SELinux from the Grub Boot Loader

If you can’t locate /etc/selinux/config file on your system, you can pass disable SELinux by passing it as parameter to the Grub Boot Loader as shown below.

# cat /boot/grub/grub.conf
default=0
timeout=5
splashimage=(hd0,0)/boot/grub/splash.xpm.gz
hiddenmenu
title Enterprise Linux Enterprise Linux Server (2.6.18-92.el5PAE)
root (hd0,0)
kernel /boot/vmlinuz-2.6.18-92.el5PAE ro root=LABEL=/ rhgb quiet selinux=0
initrd /boot/initrd-2.6.18-92.el5PAE.img
title Enterprise Linux Enterprise Linux Server (2.6.18-92.el5)
root (hd0,0)
kernel /boot/vmlinuz-2.6.18-92.el5 ro root=LABEL=/ rhgb quiet selinux=0
initrd /boot/initrd-2.6.18-92.el5.img

Method 4: Disable Only a Specific Service in SELinux – HTTP/Apache

If you are not interested in disability the whole SELinux, you can also disable SELinux only for a specific service. For example, do disable SELinux for HTTP/Apache service, modify thehttpd_disable_trans variable in the /etc/selinux/targeted/booleans file.
 
Set the httpd_disable_trans variable to 1 as shown below.

# grep httpd /etc/selinux/targeted/booleans
httpd_builtin_scripting=1
httpd_disable_trans=1
httpd_enable_cgi=1
httpd_enable_homedirs=1
httpd_ssi_exec=1
httpd_tty_comm=0
httpd_unified=1

 
Set SELinux boolean value using setsebool command as shown below. Make sure to restart the HTTP service after this change.

# setsebool httpd_disable_trans 1
# service httpd restart

Editcap Guide: 11 Examples To Handle Network Packet Dumps Effectively

Editcap utility is used to select or remove specific packets from dump file and translate them into a given format. Editcap does not perform packet captures like ethereal. Instead, it operates on the captured packets and writes some of the required packets into another file. We can pass various options to editcap to get our preferred packets.

In this article, let us review 11 practical examples on how-to use editcap to handle the packet dumps effectively.

Primary Purpose of editcap

Following are the main reason to use editcap command.

• Divide a dump file into multiple files.
• Select only the required packets.
• Translate the capture file from one format to another.
• Ability to read from a compressed dump file.
• Make the job easier for network analyzer tool by loading only selective packets, instead of loading whole dump.
• All feature results in less time consumption when processing or analyzing packets.

Let us assume the scenario where you have to analyze only some specific packet types in a huge dump file. In this situation, we cant use the network packet analyzer (wireshark or ethereal) to load the huge dump file in a single shoh, as it will be a CPU intensive process and the system may hang. Editicap utility makes the job easier by giving only relevant packets, so it could be loaded by network analyzer tool in quick time.
editcap is available in the wireshark package. Make sure wireshark/ethereal package is installed to use the editcap.

 11 Practical Examples Of edicap Usage

Example 1: Discard set of packets from the beginning of input_dump file

The output_dump file will contain all packets except the first 10 packets.

# editcap -v input_dump output_dump 1-10

Example 2: Discard set of packets from the middle of input_dump file

The output_dump file will contain all packets except packets from 200 to 210.

# editcap -v input_dump output_dump 200-210

Example 3: Select multiple range of packets (from beginning and middle)

The output_dump file will contain first 10 packets and packets from 100 and 200.

# editcap -r  -v input_dump output_dump 1-10  100-200

Example 4: Change the encapsulation type of the capture file using option -T

By default the encapsulation type of the dump file is ether. The example below, translates the capture file into ieee-802-11-bsd format

# editcap -v -T  ieee-802-11-radiotap input_dump output_dump

Example 5: Process the compressed input_dump files

editcap automatically detects the compressed capture file formats. Currently it supports for the gzip format. In the example below, it takes packets from the compressed input file and writes the first 10 packets and the packets in-between 100 and 200 into the output_dump file.

# editcap -r -v input_dump.gz output_dump 1-10 100-200

Example 6: Extract packets between a specific timeperiod using option -A and -B

This example create the output_dump, which contains the packets that are captured between the time mentioned in option A and the time mentioned in option B.

# editcap -v -A "2009-02-11 11:26:30" -B "2009-02-11 11:27:00"  input_dump output_dump

Example 7: Change packet’s timestamp (reduce or advance) using option -t

To advances the timestamp of packets to one hour.

# editcap -t 3600 input_dump output_dump

To reduces the timestamp of packets to 30 minutes,

# editcap -t -1800 input_dump output_dump

Example 8: Remove duplicate packets from the output_dump file using option -d

The example below looks back the previous frames to find the duplication. Finally it gives the dump which does not contain duplication.

# editcap -v -d input_dump output_dump

Example 9: Truncate the packets to the specific length using option -s

Produces the ouptut_dump file with packets length limited to 100. This can be very helpful under lot of situations. For example, you can use this method if you want to get only the IP layer of all the packets and does not require other layer.

# editcap -s 100 -v -A "2009-02-11 11:26:30" -B "2009-02-11 11:27:00"  input_dump.gz output_dump

Example 10: Divide input_dump file into multiple files using option -c

Divide the single dump into multiple file and each contains specified number of packets.

# editcap -v -c 1000 input_dump output

 
If the input_dump contains 5000 packets, editcap will generate the following 5 different output files.

output-00000
output-00001
output-00002
output-00003
output-00004

Example 11: Remove certain bytes from the bottom of all packets using option -C

This example removes 10 bytes from every packets and writes into the output file. You can confirm this, by viewing the output file in wireshark, the frame layer of every packet will show “50 bytes bytes on wire, 40 bytes captured” (here the actual size of a packet is 50 bytes).

# editcap -C 10 input_dump output

Linux NBD Tutorial: Network Block Device Jumpstart Guide

Network block devices are used to access remote storage device that does not physically reside in the local machine. Using Network Block Device, we can access and use the remote storage devices in following three ways on the local machine:

1. SWAP
2. File System
3. RAW

NBD presents a remote resource as local resource to the client. Also, NBD driver makes a remote resource look like a local device in Linux, allowing a cheap and safe real-time mirror to be constructed.
You can also use remote machine storage area as local machine swap area using NBD.

To setup the NBD based file system, we need a nbd-server (on remote machine, where we like to access/create the content) and nbd-client (on local machine, where we like to access the remote storage device locally).

I. NBD Server Side Configuration Steps

1. Install nbd-server

If you working on Debian flavor, get the nbd-server through apt-get.

# apt-get install nbd-server

2. Create a file content

Create a file using dd as shown below.

# dd if=/dev/zero of=/mnt/dhini bs=1024 count=36000

Use mke2fs to make the /mnt/dhini as a filesystem.

# mke2fs /mnt/dhini

When you try to make /mnt/dhini as ext2 file system, you may get a warning message as show below. Press y to continue.

/mnt/dhini is not a block special device.
Proceed anyway? (y,n) y

3. Start the NBD Server Daemon

Syntax: nbd-server  port-number   filename/filesystem

# nbd-server 1043 /mnt/dhini

You can also run the nbd-server on multiple ports as shown below.

# nbd-server 1043 1077 1076 /mnt/dhini

You can also specify the timeout to make the server to run N idle seconds

II. NBD Client Side Configuration Steps

Perform the following steps in the client machine, where you like to access the remote storage device.

1. Install nbd-client

If you working on debian flavor, get the nbd-client through apt-get.

# apt-get install nbd-client

2. Using nbd-client create a filesystem on client machine

Syntax: nbd-client  server-ip  server-port#  filename/filesystem

# nbd-client 192.168.1.11 1043 /mnt/dhini

Starting NBD client process: Connecting...Negotiation: ..size = 36000KB
bs=1024, sz=36000
connected /mnt/dhini
Activating...
fsck 1.39-WIP (31-Dec-2005)
/mnt/dhini: Superblock last write time is in the future.  FIXED.
/mnt/dhini has gone 49710 days without being checked, check forced.
/mnt/dhini: |===============================| 56.0%
/mnt/dhini: |===============================| 100.0%

Once it gets to 100%, you will get the block device on your local macine on the same path.

$ls -lh /mnt/dhini
brw-r--r-- 1 root root 43, 0 2009-02-05 17:31 /mnt/dhini

If you face any issues during the NBD configuration process, you may also configure the nbd-server and nbd-client through dpkg-reconfigure.

III. Mount the File System on Client-side

# mkdir /rem_space
# mount /mnt/dhini /rem_space

Once mounted, you may get the directory with “lost+found”. You can start accessing the files and directories properly from this point.

IV. Get Client Changes on Server-side

Mount the nbd filesystem locally

# mount  -o loop /mnt/dhini /client_changes

If you are not using “-o loop” option, you may get the following error:

mount: /mnt/dhini is not a block device (maybe try `-o loop'?)

When you list the /client_changes, You will get all the client created files and directories properly.

V. Access Remote Storage as Local Swap Memory Area

Configuration On Server side:

1. Create a file

# dd if=/dev/zero of=/mnt/dhini bs=1024 count=16000

2. Instead of create a file in ext2 filesystem create it as swap file, using mkswap

# mkswap /mnt/dhini

3. Run the server daemon

# nbd-server 1043 /mnt/dhini

Configuration On Client side:

1. Get the filesystem as swap area

# nbd-client 192.168.1.11 1043 -swap  /mnt/dhini

2. Cross check using “cat /proc/swaps “. This will list the swap areas

$ cat /proc/swaps
Filename    Type       Size      Used    Priority
/dev/hda4   partition  650624     57732  -1
/mnt/dhini  partition  15992    0        -4

Overview Of PoE – Power Over Ethernet Concepts and Devices List

1. What is PoE – Power Over Ethernet?

Power over Ethernet (PoE) does exactly what it says — it carries power over ethernet cables. So, an ethernet cables caries both data and current together to operate devices like wi-fi access points. This is very helpful to install wi-fi access points in ceilings, where it is hard to find power outlets. Only smaller devices can be powered using the PoE, as it carries limited power over the ethernet.

Fig 1: A Typical PoE Setup (Image From: PowerOverEthernet.com)

2. How does PoE works?

Following are the terminologies used in the PoE network:

• PD – Powered Devices: PDs are end devices that can accept the power transmitted over Ethernet Cat-5 cable.
• PSE – Power Source Equipment: PSEs add power to the ethernet cable.
• Midspan device: These are power injectors that stands between the standard ethernet switch and the end device.
• Endspan devices (PoE Switches): These are Ethernet Switches that includes the circuit to inject power to the ethernet cable.

Cat5 ethernet cable has 4 twisted pairs. Out of 4 pairs:

• 2 pairs are used for data transfer,
• 2 pairs are spare and not used.

There are two approaches to transfer power over ethernet.

Approach 1 uses data pairs:

The same 2 pairs used for data transfer, is used to carry power. The PSE injects power to the 2 data pairs (pin 1,2 and pin 3,6) via the center tap of the transformers without affecting the data transfer.

Fig 2: PoE Approach 1 uses data pairs to send power (Image From: PowerOverEthernet.com)

Approach 2 uses the spare pairs:

The 2 spare pairs that are not used, is used to carry power. It applies +ve voltage to pins 4 and 5 of ethernet cable. It applies -ve voltage to pins 7 and 8.

Fig 3: PoE Approach 2 uses spare pairs to send power (Image From: PowerOverEthernet.com)

3. What are the Benefits of PoE?

• Portability: Install end-devices where it is hard to get power.  For example, you can install a wireless access point in the ceiling, where you cannot find power outlet.
• Cost Savings: For a large scale deployment of wireless access point, you don’t need to install power outlet for the access points, which can be a huge cost saving.
• Simplicity: You need to run only ethernet cable to the end devices, which eliminates the cable clutter.
• Safer: No AC power is involved, as you don’t need to install A/C power outlet for the end-devices.
• Easy Maintenance: You can restart the end-device remotely. No need to press the power button to reset the equipment.  You can easily move the end-devices wherever you can lay a LAN cable.

4. Sample List of Equipments that uses PoE.

PoE Adapters:

• D-Link Power over Ethernet (PoE) Adapter – DWL-P50
• D-Link Power Over Ethernet Adapter – DWL-P200
• Linksys Power Over Ethernet Adapter Kit

PoE Wireless Access Point:

• D-Link PoE Wireless Access Point – DWL-2200AP
• D-Link PoE Outdoor Wireless Access Point – DWL-7700AP

PoE Switch:

• Netgear 24 Port Switch with 2 Gigabit Ports and 12 Port POE – FS726TP ProSafe

PoE Network Surveillance Camera:

• Airlink Power over Ethernet Network Camera – SkyIPCam310
• Panasonic 21x Optical Zoom Pan/Tilt Network Camera – BB-HCM580A
• Mobotix Outdoor, Wide Angle Lens, Motion Detection Camera D22M-IT

PoE VoIP Phone:

• Polycom IP Phone with Integrated PoE – IP550

PowerOverEthernet.com site maintains a Huge List of all PoE products, including a PoE Analog Clocks and PoE Gas Detector.

Additional PoE References

• PoE White Paper from PowerOverEthernet.com
• PoE on Wikipedia