Red Hat Linux Interview Series 34

[Chetan_Tiwary_]

Q.) Your app needs to listen on port 8443, but SELinux and firewall block it. How do you allow it securely?

Q.) Enhance SSH security by disabling root login, enforcing 2FA, and idle session cleanup.

Q.) How will you backup your docker container and its data volume - image , volume and metadata ?

Bonus Q.) Write a BASH script to automate that backup solution.

Level L3 and above

I'll be posting a series of Linux-related questions covering various skill levels. Feel free to share your insights and expertise. Your contributions will benefit learners at all stages, from those in current roles to those preparing for Linux interviews.

[Trevor]

Q.) Your app needs to listen on port 8443, but SELinux and firewall block it. How do you allow it securely?

Answer:

Regarding SELinux, to allow the app listen on port 8443, we need to add that port
to the SELinux policy.  To do so, we use the following command:

#  semange  port  -a  -t  <service-type>  -p  <protocol>   8443

  Note:  The items within angle brackets (i.e. <    >)  are shown generically
because the question does not specify this information.  Some examples of
service types are ssh_port_t, ftp_port_t, nfs_port_t, smbd_port_t, etc.  
My RHEL 9 system shows me 321 possible service types.  Some examples
of protocols are tcp, udp, dccp, sctp, ipv4, or ipv6.

The above command will configure SELinux to allow <service-type> to use port 8443.

Whatever the actual name of the service is, it will require restarting for the semanage command to take effect:   #   systemctl  restart  <name-of-service>

We're not done because we have to configure our firewall to accommodate this port.  
This doesn't require any heavy lifting - here's our command:

#   firewall-cmd  --zone=public   --add-port   8443/<protocol>   --permanent
Note:  <protocol> is the same keyword used for the semanage command

Execute the following command to verify that the port/<protocol> has been added
to the firewall (firewalld), to allow communication with port 8443:

#  firewall-cmd  --list-all

The End

[martindxc]

The ssh setup: final sshd_config should result in PermitRootLogin no.
2FA: quick look at man page of sshd shows no direct support of it. I assume one has to rely on external (to ssh) PAM modules. 

[Chetan_Tiwary_]

@martindxc Yes , google authenticator is one easily available plugin and you very rightly mentioned PAM. Once these two are configured, you will have to then configure the ssh config to allow 2FA.