Welcome to Linux Kibbels

Squid Proxy CacheServer Installation and Configuration

2012-02-07T21:53:00.000-08:00

Squid is a proxy caching server. If you are Linux sysadmin, you can use squid to control internet access at your work environment.
This beginners guide will give a jump-start on how to setup squid on Linux to restrict internet access in an network.

Install Squid
You should install the following three squid related packages on your system.
squid
squid-common
squid-langpack
On Debian and Ubuntu, use aptitude to install squid as shown below. On CentOS, use yum to install the squid package.
$ yum install squid
Check Configuration and Startup scripts
Apart from installing the squid related packages, it also creates the /etc/squid/squid.conf and /etc/init.d/squid startup script.
By default Squid runs on 3128 port. You can verify this from the squid.conf file. You can also set the visible_hostname parameter in your squid.conf, which will be used in error_log. If you don’t define, squid gets the hostname value using gethostname() function.
# vim /etc/squid/squid.conf
visible_hostname ubuntuserver
httpd_port 3128
Note: The http port number (3128) specified in the squid.conf should be entered in the proxy setting section in the client browser. If squid is built with SSL, you can use https_port option inside squid.conf to define https squid.
Start Squid and View Logs
Start the Squid proxy caching server as shown below.
# service squid start
squid start/running, process 11743
Squid maintains three log files (access.log, cache.log and store.log) under /var/log/squid directory.
From the /var/log/squid/access.log, you can view who accessed which website at what time. Following is the format of the squid access.log record.
time elapsed remotehost code/status bytes method URL rfc931 peerstatus/peerhost
To disable logging in squid, update the squid.conf with the following information.
# to disable access.log
cache_access_log /dev/null

# to disable store.log
cache_store_log none

# to disable cache.log
cache_log /dev/null
Squid Usage 1: Restrict Access to Specific Websites
This is how you can restrict folks from browsing certain website when they are connected to your network using your proxy server.
Create a file called restricted_sites and list all sites that you would want to restrict the access.
# vim /etc/squid/restricted_sites
www.youtube.com
mail.yahoo.com
www.hotmail.com
www.gmail.com
Modify the squid.conf to add the following.
# vim /etc/squid/squid.conf
acl RestrictedSites dstdomain "/etc/squid/restricted_sites"
http_access deny RestrictedSites

Squid Usage 2: Allow Access to Websites Only During Specific Time
Some organization might want to allow employees to surf or download from the internet only during specific timeperiods.
The squid.conf configuration shown below will allow internet access for employees only between 9:00AM and 18:00 during weekdays.
# vim /etc/squid/squid.conf
acl official_hours time M T W H F 09:00-18:00
http_access deny all
http_access allow official_hours
Squid Usage 3 : Restrict Access to Particular Network
Instead of restricting specific sites, you can also provide access only to certain network and block everything else. The example below, allows access only to the 192.168.10.* internal network.
# vim /etc/squid/squid.conf
acl branch_offices src 192.168.10.0/24
http_access deny all
http_access allow branch_offices

Squid Usage 4 : Use Regular Expression to Match URLs
You can also use regular expression to allow or deny websites.
First create a blocked_sites files with a list of keywords.
# cat /etc/squid/blocked_sites
soccer
movie
www.example.com
Modify the squid.conf to block any sites that has any of these keywords in their url.
# vim /etc/squid/squid.conf
acl blocked_sites url_regex -i "/etc/squid/blocked_sites"
http_access deny blocked_sites
http_access allow all
In the above example, -i option is used for ignoring case for matching. So, while accessing the websites, squid will try to match the url with any of the pattern mentioned in the above blocked_sites file and denies the access when it matches.
SARG – Squid Analysis Report Generator
Download and install SARG to generate squid usage reports.
Use the sarg-reports command to generate reports as shown below.
# to generate the report for today
sarg-report today

# on daily basis
sarg-report daily

# on weekly basis
sarg-report weekly

# on monthly basis
sarg-report monthly

Add the sarg-report to the crontab.
The reports generated by sarg are stored under /var/www/squid-reports. These are html reports can you can view from a browser.

$ ls /var/www/squid-reports
Daily index.hyml

$ ls /var/www/squid-reports/Daily
2010Sept1-2010Sept2 images index.html

Vi & Vim Commands

2012-02-06T03:11:00.001-08:00

Command mode ESC

                dd       delete
                u        undelete
                y        yank (copy to buffer)
                p/P      p before cursor/P after cursor

                Ctl-g    show current line number
                shft-G   end of file
              n shft-G   move to line n

               /stuff/   search
                  n   repeat in same direction
                  N   repeat in opposite direction
                  /return repeat seach forward
                  ?return repeat seach backward

               "dyy Yank current line to buffer d
               "a7yy Yank next 7 lines to buffer a
                    or
               :1,7ya a Yank [ya] lines 1,7 to buffer a
               :1,7ya b Yank [ya] lines 1,7 to buffer b

               :5 pu b   Put [pu] buffer b after line 5

               "dP   Put the content of buffer d before cursor
               "ap   Put the contents of buffer a after cursor

               :1,4 w! file2 Write lines 1,4 to file2
               :1,3

               :set nu     Display line numbers
               :set nonum Turns off display

               :set ic     Ignore Case

               :e Edit a file in a new buffer

               :g//p   Print matching regular expression

            vim
               :split
               :split
               :sp
               :split new

                   ctl-w   To move between windows
                   ctl-w+
                   ctl-w- To change size
                   ctl+wv Split windows vertically
                   ctl-wq Close window

               :only       To view only 1 window

            vim dictionary - put the following command in ~/.vimrc

                   set dictionary+=/usr/share/dict/words
                   set thesaurus+=/usr/share/dict/words

               Now, after you type a word and to
               go back in the listing

                   butter

           Scripting - you can script vi commands using ex. For example
               suppose you want to replace all occurrences of "one" with "two", then
               exit the file if there are changes. You would put the following in a file call script

               Contents of script

                   %s/one/two/g|x

               If you want to run this on all files with the patten "example*"

                   for i in $(ls example*); do ex - $i

Diffrence between Hardlink & Softlink

2012-02-06T03:09:00.000-08:00

Hard link: Hard link refers to "The specific location of physical data".
Hard Link is a mirror copy of the original file.
Hard links share the same inode.
Any changes made to the original or Hard linked file will reflect the other.
Even if you delete any one of the files, nothing will happen to the other hard links.
But soft link which points to deleted hard link become a dangling soft link.
You can't link a directory even within the same file system.
Hard links can't cross file systems.
Soft link( also called symbolic link): Soft link refers to "A symbolic path indicating the abstract location of another file".
Soft Link is a symbolic link to the original file.(more like windows shortcuts)
Soft Links will have a different Inode value.
Any changes made to the soft link will reflect the original file and its hard links.
A soft link points to the original file. If you delete the original file, the soft link fails. It would become dangling symbolic link.
If you delete the soft link, nothing will happen.
You can link a directory using soft link on same file system and also on other file system.
Soft links can cross file systems

IPTables on Redaht / Cent O/s

2012-02-06T03:06:00.000-08:00

Since kernel version 2.4, there is a built in system for package filtering known as Netfilter. To use Netfilter, during kernel compiling CONFIG_NETFILTER must be included. Also ip_forward must be enabled:
echo 1 > /proc/sys/net/ipv4/ip_forward
Package filtering works on Internet layer of TCP/IP protocol. Filtering rules can be defined based on a transport layer header(port number) and connection layer (source IP address). During filtering, package content is not being checked.
Netfilter filtering chains work in kernel mode. In user mode works special tool called – iptables, which requires root user privilegies and it's used to configure:
- filter chains,
- NAT tables,
- mangle tables.
Netfilter uses three filters, INPUT, OUTPUT, FORWARD, realised in form of chains. Each chain contains a set of rules that filters packages. If some package sattisfies a rule, an action gets to be applied, like accepting or rejecting package.
Iptables commands:
-A (Add rule to the end of chain).
-D (Delete rule from chain).
-R (Replace rule in chain).
-I (Add numeric rule in chain).
-L (List rules).
-F (Delete all rules from chain).
Deleting the chains:
# iptables -F INPUT
# iptables -F OUTPUT
# iptables -F FORWARD
Here are some basic examples of iptables usage.
1. Blocking IP with iptables:
# iptables -A INPUT -s xxx.xxx.xxx.xxx -j DROP
# iptables -A OUTPUT -d xxx.xxx.xxx.xxx -j DROP
* instead xxx.xxx.xxx.xxx www.abc.com can be added.
2. Opening ports:
First thing you need to do is check if ports are already opened. It's done using nmap, free program, and it's distributed in most distros.
# nmap -sT xxx.xxx.xxx.xxx
PORT STATE SERVICE
22/tcp open ssh
80/tcp open http
443/tcp open https
Nmap run completed -- 1 IP address scanned in 0.941 seconds.
As we see, on this list port 25 is not opened. Let's open port 25 for SMTP traffic.
# iptables -A INPUT -p tcp --dport 25 -j ACCEPT
3. Enabling other hosts to ping:
# iptables -A INPUT -p icmp -s xxx.xxx.xxx.xxx/xx –icmp-type echo-request -j ACCEPT
# iptables -A INPUT -p icmp -d xxx.xxx.xxx.xxx/xx –icmp-type echo-reply -j ACCEPT
4. Restricting access by time of the day:
# iptables -A INPUT -p tcp -s 0/0 --sport 513:65535 -d xxx.xxx.xxx.xxx --dport 22 -m state
--state NEW,ESTABLISHED -m time --timestart 09:00 --timestop 18:00
--days Mon,Tue,Wed,Thu,Fri -j ACCEPT

5. Keeping logs about rejected packages:

# iptables -A OUTPUT -j LOG
# iptables -A OUTPUT -j DROP
# iptables -A INPUT -j LOG
# iptables -A INPUT -j DROP
# iptables -A FORWARD -j LOG
# iptables -A FORWARD -j DROP

Top Command Line Utility

2012-02-06T02:36:00.001-08:00

When you need to see the running processes on your Linux in real time, you have top as your tool for that.
top also displays other info besides the running processes, like free memory both physical and swap
Usage
top [options]
Options
-d ss.tt
Delay -- Specifies the seconds and tenths of seconds of delay between the updates of the info showed on the screen, being the default 3 seconds
-i
Starts top with the last remembered 'i' state reversed. When this toggle is Off, tasks that are idled or zombied will not be displayed.
-n n
Specifies the maximum number of iterations, or frames, top should produce before ending.
-p n
Monitor only processes with specified process IDs. This option can be given up to 20 times, or you can provide a comma delimited list with up to 20 pids. Co-mingling both approaches is permitted. This is a command-line option only. And should you wish to return to normal operation, it is not necessary to quit and and restart top -- just issue the '=' interactive command.
-s
- Secure - Runs top in secure mode, restricting the commands you can use while top is running even for root
-S (Sum)
Starts top with the last remembered 'S' state reversed. When 'Cumulative mode' is On, each process is listed with the cpu time that it and its dead children have used. See the 'S' interactive command for additional information regarding this mode.
Description of the fields
a: PID -- Process Id
The task's unique process ID, which periodically wraps, though never restarting at zero.
b: PPID -- Parent Process Pid
The process ID of a task's parent.
c: RUSER -- Real User Name
The real user name of the task's owner.
d: UID -- User Id
The effective user ID of the task's owner.
e: USER -- User Name
The effective user name of the task's owner.
f: GROUP -- Group Name
The effective group name of the task's owner.
g: TTY -- Controlling Tty
The name of the controlling terminal. This is usually the device (serial port, pty, etc.) from which the process was started, and which it uses for input or output. However, a task need not be associated with a terminal, in which case you'll see '?' displayed.
h: PR -- Priority
The priority of the task.
i: NI -- Nice value
The nice value of the task. A negative nice value means higher priority, whereas a positive nice value means lower priority. Zero in this field simply means priority will not be adjusted in determining a task's dispatchability./dd>
j: P -- Last used CPU (SMP)
A number representing the last used processor. In a true SMP environment this will likely change frequently since the kernel intentionally uses weak affinity. Also, the very act of running top may break this weak affinity and cause more processes to change CPUs more often (because of the extra demand for cpu time).
k: %CPU -- CPU usage
The task's share of the elapsed CPU time since the last screen update, expressed as a percentage of total CPU time. In a true SMP environment, if 'Irix mode' is Off, top will operate in 'Solaris mode' where a task's cpu usage will be divided by the total number of CPUs. You toggle 'Irix/Solaris' modes with the 'I' interactive command.
l: TIME -- CPU Time
Total CPU time the task has used since it started. When 'Cumulative mode' is On, each process is listed with the cpu time that it and its dead children has used. You toggle 'Cumulative mode' with 'S', which is a command-line option and an interactive command. See the 'S' interactive command for additional information regarding this mode.
m: TIME+ -- CPU Time, hundredths
The same as 'TIME', but reflecting more granularity through hundredths of a second.
n: %MEM -- Memory usage (RES)
A task's currently used share of available physical memory.
o: VIRT -- Virtual Image (kb)
The total amount of virtual memory used by the task. It includes all code, data and shared libraries plus pages that have been swapped out.
VIRT = SWAP + RES.
p: SWAP -- Swapped size (kb)
The swapped out portion of a task's total virtual memory image.
q: RES -- Resident size (kb)
The non-swapped physical memory a task has used.
RES = CODE + DATA.
r: CODE -- Code size (kb)
The amount of physical memory devoted to executable code, also known as the 'text resident set' size or TRS.
s: DATA -- Data+Stack size (kb)
The amount of physical memory devoted to other than executable code, also known as the 'data resident set' size or DRS.
t: SHR -- Shared Mem size (kb)
The amount of shared memory used by a task. It simply reflects memory that could be potentially shared with other processes.
u: nFLT -- Page Fault count
The number of major page faults that have occurred for a task. A page fault occurs when a process attempts to read from or write to a virtual page that is not currently present in its address space. A major page fault is when disk access is involved in making that page available.
v: nDRT -- Dirty Pages count
The number of pages that have been modified since they were last written to disk. Dirty pages must be written to disk before the corresponding physical memory location can be used for some other virtual page.
w: S -- Process Status
The status of the task which can be one of:
'D' = uninterruptible sleep
'R' = running
'S' = sleeping
'T' = traced or stopped
'Z' = zombie
Tasks shown as running should be more properly thought of as 'ready to run' -- their task_struct is simply represented on the Linux run-queue. Even without a true SMP machine, you may see numerous tasks in this state depending on top's delay interval and nice value.
x: Command -- Command line or Program name
Display the command line used to start a task or the name of the associated program. You toggle between command line and name with 'c', which is both a command-line option and an interactive command.
When you've chosen to display command lines, processes without a command line (like kernel threads) will be shown with only the program name in parentheses, as in this example:
( mdrecoveryd )
Either form of display is subject to potential truncation if it's too long to fit in this field's current width. That width depends upon other fields selected, their order and the current screen width.
Note: The 'Command' field/column is unique, in that it is not fixed-width. When displayed, this column will be allocated all remaining screen width (up to the maximum 512 characters) to provide for the potential growth of program names into command lines.
y: WCHAN -- Sleeping in Function
Depending on the availability of the kernel link map ('System.map'), this field will show the name or the address of the kernel function in which the task is currently sleeping. Running tasks will display a dash ('-') in this column.
Note: By displaying this field, top's own working set will be
increased by over 700Kb. Your only means of reducing that overhead
will be to stop and restart top.
z: Flags -- Task Flags
This column represents the task's current scheduling flags which are expressed in hexadecimal notation and with zeros suppressed. These flags are officially documented in . Less formal documentation can also be found on the 'Fields select' and 'Order fields' screens.
Interactive commands
While top is running you may issue some options that will interact immediately with top these options are:
h
Help, displays a summary of command that will modify the behavior of top
k
Kills a process, you will be able to kill only your own processes, unless you are running top as root
n
Once this command is entered top will ask you how many lines you want on your screen, if you enter 0 top will display as much as it can
q
Exits top
r
Change the priority of a process, as well as with k you will only be able to act on your own processes unless you are root
W
Writes the current configuration to your personal configuration file, which is $HOME/.toprc

Linux Directory Structure

2012-02-06T02:31:00.001-08:00

/bin - This directory contains most of your non-privileged system commands such as ls, mkdir, rm, etc.

/boot - Contains the systems boot image, bootloader, and the kernel

/dev - Symbolic links to system devices such as optical and removable drives

/etc - Contains all system configuration files and most configurations for installed packages

/home - Contains a directory for each user and contains profile information

/lib - Contains dynamic libraries and modules for the Linux system and installed packages

/media - Contains mount points for optical drives and removable media

/mnt - Used as a location for mounted drives and shares

/opt - Contains user installed packages and custom software not handled by the system or package manager

/proc - An interface between the kernel and the system, useful for diagnostics and system information

/root - The root superuser's home directory

/sbin - Contains privileged commands that are usually run as superuser (root/sudo)

/sys - An interface between the kernel and the system, used for modifying system settings

/tmp - A location for temporary files such as sessions on a web server

/usr - Contains most installed packages that are not part of the system, user installed programs

/usr/bin - Contains commands related to user installed packages in /usr

/usr/sbin - Contains privileged commands related to user installed packages in /usr

/var - Contains files that change often or accessed frequently

/var/log - Contains all system logs and most logs generated by installed packages

Linux LVM

2012-01-27T03:36:00.001-08:00

1. create LVM partition:

fdisk /dev/[disk]

change partition type from LINUX to LVM

2. initialization LVM partition:

pvcreate /dev/[disk_partiton1] /dev/[disk_partition2]

check commands:

pvs
pvdisplay

3. create LVM group:

vgcreate [group_name] /dev/[disk_partition1] /dev/[disk_partition2]

check commands:

vgs
vgdisplay

4. create logical volumes which is attached to group:

lvcreate -L[size]M -n [vol_name] [group_name]

check commands:

lvs
lvdisplay

5. format volumes:

mkfs.ext3 [LV_name_from_lvdisplay]

EXTEND
change size volume:

lvextend -L +[size]M [LV_name_from_lvdisplay]

change size partition:

resize2fs [LV_name_from_lvdisplay]

REDUCE

fsck -f [LV_name_from_lvdisplay]

change size partition:

resize2fs [LV_name_from_lvdisplay] [size]G

change size volume:
lvreduce -L -[size]G [LV_name_from_lvdisplay]

IP TABLES

2011-11-17T04:02:00.000-08:00

Grouping of rules (Creating your own chain)
-------------------------------------------
# iptables –N WEB

# iptables –N SSH

# iptables –N FTP

# iptables –t filter –I INPUT --goto FTP |
|
# iptables –t filter –I INPUT --goto WEB |-- Putting references of User Defile chain in
| origional chains (Eg: INPUT, OUTPUT, FORWARD)
# iptables –t filter –I INPUT --goto SSH |

# iptables -t filter -I FTP -s 192.168.0.21 -p tcp --dport 21 -j REJECT

# iptables -t filter -I WEB -s 192.168.0.16 -p tcp --dport 80 -j REJECT

# iptables -t filter -I WEB -s 192.168.0.4 -p tcp --dport 80 -j DROP

# iptables -t filter -I SSH -s 192.168.0.28 -p tcp --dport 22 -j REJECT

Deleting User Defined Chains
----------------------------
To delete user define chain first we need to remove the references the
we need to clear all rules of custom chain.

# iptables -X FTP ----- it will give you error "too many links"
# iptables -t filter -D FTP 1 ------ Removing rules of FTP chain
# iptables -t filter -D INPUT 2 --- Removing FTP CHAIN link from INPUT chain.

Now Delete
# iptables -X FTP

NAT (Network Address Translatin)
----------------------------------
Q. Why we use NAT ?
A. To Hide Your Intranet from Internet.
To Share internet Connection.

NATing are of two types :--
1. Source Network Address Translatin (SNAT)
2. Destinatin Network Address Translatin (DNAT)

Steps for NATing
At first we need to enable "Packet Forwarding"

# vim /etc/sysctl.conf
net.ipv4.ip_forward=1
:wq!
# sysctl -p

Senario 1
-------
My ip is 192.168.0.22, whenever 192.168.0.16 is trying to ssh to my ip i will forward that to 192.168.0.4.
#iptables -t nat -I PREROUTING -s 192.168.0.4 -p tcp --dport 22 -j DNAT --to-dest 192.168.0.4:22

#iptables -t nat -I POSTROUTING -j MASQUERAGE

#iptables -t nat -I PREROUTING -p tcp --dport 80 -j DNAT --to-dest 192.168.0.4:80
#iptables -t nat -I PREROUTING -p tcp --dport 8080 -j DNAT --to-dest 192.168.0.16:80

FTP Server

2011-11-16T04:30:00.001-08:00

The File Transfer Protocol (FTP) is used as one of the most common means of copying files between servers over the Internet. Most web based download sites use the built in FTP capabilities of web browsers and therefore most server oriented operating systems usually include an FTP server application as part of the software suite.

Type: SystemV-managed service

Package: vsftpd

Daemon: /usr/sbin/vsftpd

Script: /etc/init.d/vsftpd

Ports: 21 (ftp), 20 (ftp-data)

Configuration: /etc/vsftpd/vsftpd.conf /etc/vsftpd.ftpusers /etc/pam.d/vsftpd

Log: /var/log/xferlog

Related: tcp_wrappers, ip_conntrack_ftp, ip_nat_ftp

Types of ftp

Active FTP

The sequence of events for active FTP is:

Your client connects to the FTP server by establishing an FTP control connection to port 21 of the server. Your commands such as 'ls' and 'get' are sent over this connection.
Whenever the client requests data over the control connection, the server initiates data transfer connections back to the client. The source port of these data transfer connections is always port 20 on the server, and the destination port is a high port (greater than 1024) on the client.
Thus the ls listing that you asked for comes back over the port 20 to high port connection, not the port 21 control connection.

FTP active mode therefore transfers data in a counter intuitive way to the TCP standard, as it selects port 20 as it's source port (not a random high port that's greater than 1024) and connects back to the client on a random high port that has been pre-negotiated on the port 21 control connection.
Active FTP may fail in cases where the client is protected from the Internet via many to one NAT (masquerading). This is because the firewall will not know which of the many servers behind it should receive the return connection.

Passive FTP

Passive FTP works differently:

Your client connects to the FTP server by establishing an FTP control connection to port 21 of the server. Your commands such as ls and get are sent over that connection.
Whenever the client requests data over the control connection, the client initiates the data transfer connections to the server. The source port of these data transfer connections is always a high port on the client with a destination port of a high port on the server.

Passive FTP should be viewed as the server never making an active attempt to connect to the client for FTP data transfers. Because client always initiates the required connections, passive FTP works better for clients protected by a firewall.
As Windows defaults to active FTP, and Linux defaults to passive, you'll probably have to accommodate both forms when deciding upon a security policy for your FTP server.

Regular FTP

By default, the VSFTPD package allows regular Linux users to copy files to and from their home directories with an FTP client using their Linux usernames and passwords as their login credentials.
VSFTPD also has the option of allowing this type of access to only a group of Linux users, enabling you to restrict the addition of new files to your system to authorized personnel.
The disadvantage of regular FTP is that it isn't suitable for general download distribution of software as everyone either has to get a unique Linux user account or has to use a shared username and password. Anonymous FTP allows you to avoid this difficulty.

Anonymous FTP

Anonymous FTP is the choice of Web sites that need to exchange files with numerous unknown remote users. Common uses include downloading software updates and MP3s and uploading diagnostic information for a technical support engineers' attention. Unlike regular FTP where you login with a preconfigured Linux username and password, anonymous FTP requires only a username of anonymous and your email address for the password. Once logged in to a VSFTPD server, you automatically have access to only the default anonymous FTP directory (/var/ftp in the case of VSFTPD) and all its subdirectories.
Starting vsftpd:

[root@bigboy tmp]# /etc/init.d/vsftpd start

[root@bigboy tmp]# /etc/init.d/vsftpd stop

[root@bigboy tmp]# /etc/init.d/vsftpd restart

Configuration files:

/etc/vsftpd.conf

# Example config file /etc/vsftpd/vsftpd.conf

# The default compiled in settings are fairly paranoid. This sample file

# loosens things up a bit, to make the ftp daemon more usable.

# Please see vsftpd.conf.5 for all compiled in defaults.

# READ THIS: This example file is NOT an exhaustive list of vsftpd options.

# Please read the vsftpd.conf.5 manual page to get a full idea of vsftpd's

# capabilities.

# Allow anonymous FTP? (Beware - allowed by default if you comment this out).

anonymous_enable=YES

# Uncomment this to allow local users to log in.

local_enable=YES

# Uncomment this to enable any form of FTP write command.

write_enable=YES

# Default umask for local users is 077. You may wish to change this to 022,

# if your users expect that (022 is used by most other ftpd's)

local_umask=022

# Uncomment this to allow the anonymous FTP user to upload files. This only

# has an effect if the above global write enable is activated. Also, you will

# obviously need to create a directory writable by the FTP user.

#anon_upload_enable=YES

# Uncomment this if you want the anonymous FTP user to be able to create

# new directories.

#anon_mkdir_write_enable=YES

# Activate directory messages - messages given to remote users when they

# go into a certain directory.

dirmessage_enable=YES

# Activate logging of uploads/downloads.

xferlog_enable=YES

# Make sure PORT transfer connections originate from port 20 (ftp-data).

connect_from_port_20=YES

# If you want, you can arrange for uploaded anonymous files to be owned by

# a different user. Note! Using "root" for uploaded files is not

# recommended!

#chown_uploads=YES

#chown_username=whoever

# You may override where the log file goes if you like. The default is shown

# below.

#xferlog_file=/var/log/vsftpd.log

# If you want, you can have your log file in standard ftpd xferlog format

xferlog_std_format=YES

# You may change the default value for timing out an idle session.

#idle_session_timeout=600

# You may change the default value for timing out a data connection.

#data_connection_timeout=120

# It is recommended that you define on your system a unique user which the

# ftp server can use as a totally isolated and unprivileged user.

#nopriv_user=ftpsecure

# Enable this and the server will recognise asynchronous ABOR requests. Not

# recommended for security (the code is non-trivial). Not enabling it,

# however, may confuse older FTP clients.

async_abor_enable=YES

# By default the server will pretend to allow ASCII mode but in fact ignore

# the request. Turn on the below options to have the server actually do ASCII

# mangling on files when in ASCII mode.

# Beware that on some FTP servers, ASCII support allows a denial of service

# attack (DoS) via the command "SIZE /big/file" in ASCII mode. vsftpd

# predicted this attack and has always been safe, reporting the size of the

# raw file.

# ASCII mangling is a horrible feature of the protocol.

#ascii_upload_enable=YES

#ascii_download_enable=YES

# You may fully customise the login banner string:

#ftpd_banner=Welcome to blah FTP service.

# You may specify a file of disallowed anonymous e-mail addresses. Apparently

# useful for combatting certain DoS attacks.

#deny_email_enable=YES

# (default follows)

#banned_email_file=/etc/vsftpd/banned_emails

# You may specify an explicit list of local users to chroot() to their home

# directory. If chroot_local_user is YES, then this list becomes a list of

# users to NOT chroot().

#chroot_list_enable=YES

# (default follows)

#chroot_list_file=/etc/vsftpd/chroot_list

# You may activate the "-R" option to the builtin ls. This is disabled by

# default to avoid remote users being able to cause excessive I/O on large

# sites. However, some broken FTP clients such as "ncftp" and "mirror" assume

# the presence of the "-R" option, so there is a strong case for enabling it.

ls_recurse_enable=YES

# When "listen" directive is enabled, vsftpd runs in standalone mode and

# listens on IPv4 sockets. This directive cannot be used in conjunction

# with the listen_ipv6 directive.

#listen=YES

# This directive enables listening on IPv6 sockets. To listen on IPv4 and IPv6

# sockets, you must run two copies of vsftpd whith two configuration files.

# Make sure, that one of the listen options is commented !!

listen_ipv6=YES

pam_service_name=vsftpd

userlist_enable=YES

tcp_wrappers=YES

anon_root=/var/ftp/pub/REDHAT1

/etc/vsftpd.ftpusers

For added security, you may restrict FTP access to certain users by adding them to the list of users in the /etc/vsftpd.ftpusers file. The VSFTPD package creates this file with a number of entries for privileged users that normally shouldn't have FTP access. As FTP doesn't encrypt passwords, thereby increasing the risk of data or passwords being compromised, it is a good idea to let these entries remain and add new entries for additional security.

Conclusion

FTP is a very useful software application that can have enormous benefit to a Web site or to collaborative computing in which files need to be shared between business partners. Although insecure, it is universally accessible, because FTP clients are a part of all operating systems and Web browsers.

DHCP

2011-11-16T04:25:00.001-08:00

What is DHCP

Dynamic Host Configuration Protocol (DHCP) is a network protocol that enables a DHCP server to automatically assign an IP address to an individual computer's TCP/IP stack software. DHCP assigns a number dynamically from a defined range of numbers (i.e., a scope) configured for a given network.
Client computers configured to use DHCP for IP assignment do not need to have a statically assigned IP address. In addition, they generally do not need to have addresses configured for DNS servers or WINS servers, as these are also set by the DHCP server.
DHCP assigns a TCP/IP address when a system is started. Typically, it works like this:

A user turns on a computer with a DHCP client.
The client computer sends a broadcast request (called a DISCOVER or DHCPDISCOVER), looking for a DHCP server to answer.
The router directs the DISCOVER packet to the correct DHCP server.
The server receives the DISCOVER packet. Based on availability and usage policies set on the server, the server determines an appropriate address (if any) to give to the client. The server then temporarily reserves that address for the client and sends back to the client an OFFER (or DHCPOFFER) packet, with that address information. The server also configures the client's DNS servers, WINS servers, NTP servers, and sometimes other services as well.
The client sends a REQUEST (or DHCPREQUEST) packet, letting the server know that it intends to use the address.
The server sends an ACK (or DHCPACK) packet, confirming that the client has a been given a lease on the address for a server-specified period of time.

Why use DHCP

Every device on a TCP/IP-based network must have a unique unicast IP address to access the network and its resources. Without DHCP, IP addresses must be configured manually for new computers or computers that are moved from one subnet to another, and manually reclaimed for computers that are removed from the network.
DHCP enables this entire process to be automated and managed centrally. The DHCP server maintains a pool of IP addresses and leases an address to any DHCP-enabled client when it starts up on the network. Because the IP addresses are dynamic (leased) rather than static (permanently assigned), addresses no longer in use are automatically returned to the pool for reallocation.
The network administrator establishes DHCP servers that maintain TCP/IP configuration information and provide address configuration to DHCP-enabled clients in the form of a lease offer. The DHCP server stores the configuration information in a database, which includes:

- Valid TCP/IP configuration parameters for all clients on the network.

- Valid IP addresses, maintained in a pool for assignment to clients, as well as excluded addresses.

- Reserved IP addresses associated with particular DHCP clients. This allows consistent assignment of a single IP address to a single DHCP client.

- The lease duration, or the length of time for which the IP address can be used before a lease renewal is required.

A DHCP-enabled client, upon accepting a lease offer, receives:

- A valid IP address for the subnet to which it is connecting.

- Requested DHCP options, which are additional parameters that a DHCP server is configured to assign to clients. Some examples of DHCP options are Router (default gateway), DNS Servers, and DNS Domain Name. For a full list of DHCP options, see “DHCP Tools and Settings .

Packages:

Server – dhcpd

Client - dhcpcd or pump

Ports:

Server - UDP 67 (bootps)

Client - UDP 68 (bootpc)

Configuration files:

- /etc/dhcpd.conf

allow bootp;

allow booting;

ddns-update-style interim;

ignore client-updates;

subnet 192.168.0.0 netmask 255.255.255.0 {

# --- default gateway

option routers 192.168.0.253;

option subnet-mask 255.255.255.0;

option nis-domain "opensource.com";

option domain-name "opensource.com";

option domain-name-servers 192.168.0.253;

option time-offset -18000; # Eastern Standard Time

# option ntp-servers 192.168.1.1;

option netbios-name-servers 192.168.0.253;

# --- Selects point-to-point node (default is hybrid). Don't change this unless

# -- you understand Netbios very well

# option netbios-node-type 2;

range dynamic-bootp 192.168.0.1 192.168.0.254;

default-lease-time 3600;

max-lease-time 4800;

# we want the nameserver to appear at a fixed address

host ns {

next-server server.opensource.com;

hardware ethernet 00:1E:90:79:6A:31;

fixed-address 192.168.0.253;

}

host station1.opensource.com {

hardware ethernet 00:1E:90:7A:86:3C;

fixed-address 192.168.0.1;

option host-name "station1.opensource.com";

filename "pxelinux.0";

}

host station2.opensource.com {

hardware ethernet 00:1E:90:7A:81:B4;

fixed-address 192.168.0.2;

option host-name "station2.opensource.com";

filename "pxelinux.0";

}

host station6.opensource.com {

hardware ethernet 00:1E:90:79:66:DE;

fixed-address 192.168.0.6;

option host-name "station6.opensource.com";

filename "pxelinux.0";

}

host station4.opensource.com {

hardware ethernet 00:1E:90:77:5B:3D;

fixed-address 192.168.0.4;

}

When DHCP starts, it reads the file /etc/dhcpd.conf. It uses the commands here to configure your network. The standard DHCP RPM package doesn't automatically install a /etc/dhcpd.conf file, but you can find a sample copy of dhcpd.conf in the following directory which you can always use as a guide.

/usr/share/doc/dhcp-<version-number>/dhcpd.conf.sample

You have to copy the sample dhcpd.conf file to the /etc directory and then you'll have to edit it.

Cp /usr/share/doc/dhcp-3.0pl1/dhcpd.conf.sample /etc/dhcpd.conf

Stores information about leased IP addresses. It must exist in order for dhcp to start! If it

doesn't exist, type

touch /var/lib/dhcp/dhcpd.leases

Power Tools

2011-11-16T03:46:00.001-08:00

Few of tools which are very important for day to day use.

- Head

- Tail

- Grep

- cut

- wc

- sort

- diff

- sdiff

- aspell

- tr

- sed

- awk

Head

- output the first part of files.Head without a number prints ten lines by default.

Syntax: head [OPTION]... [FILE]...

examples:

1. First ten lines of a file.

head -n 10 file1.txt

cat file1.txt|head -n 10

2. First ten characters of a file.

head -c 10 file1.txt

cat file1.txt|head -c 10

Tail

- output the last part of files.Tail without a number prints ten lines by default.

Syntax: tail [OPTION]... [FILE]...

examples:

1. First ten lines of a file.

tail -n 10 file1.txt

cat file1.txt|tail -n 10

2. First ten character of a file.

tail -c 10 file1.txt

cat file1.txt|tail -c 10

3.For a output appended data as the file grows.

tail -f file1.txt

Grep

- print lines matching a pattern.

Syntax:

grep [OPTIONS] PATTERN [FILE...]

grep [OPTIONS] [-e PATTERN | -f FILE] [FILE...]

examples:

1. To get a word from a file.

cat file1.txt|grep "ost"

grep "ost" file1.txt

2. To get a word irrespective of case.

cat file1.txt|grep -i "ost"

grep "ost" file1.txt

3.To select only those lines containing matches that form whole words.

cat file1.txt|grep -w "ost"

grep -w "ost" file1.txt

4.Print a count of matching lines for each input file.

cat file1.txt|grep -c "ost"

grep -c "ost" file1.txt

Few more options to work on:

- -A, --after-context=NUM print NUM lines of trailing context.

- -B, --before-context=NUM print NUM lines of leading context.

- -C, --context=NUM print NUM lines of output context.

- -x, --line-regexp force PATTERN to match only whole lines.

- -V, --version print version information and exit

Cut

- cut - remove sections from each line of files

Syntax: cut [OPTION]... [FILE]...

examples:

1. To get first 10 characters of a line.

cut -c1-10 file1.txt

cat file1.txt|cut -c1-10

2. Suppose the fields are seperated by delimiter.

To take the first field in the /etc/passwd file

cat /etc/passwd|cut -f 1 -d :

This will extract the first field with delimiter as ":"

- wc - print the number of bytes, words, and lines in files.

Syntax: wc [OPTION]... [FILE]...

examples:

1. To get the byte count

wc -c file1.txt

2. To print the character count.

wc -m file1.txt

3. To print the newline counts.

wc -l file1.txt

4. To print the length of the longest line.

wc -L file1.txt

Sort

- sort - sort lines of text files.

1. To sort according to dictionary order.

sort -d file1.txt

2. To sort ignoring the case.

sort -f file1.txt

3. To sort according to months.

sort -M file1.txt

4. To sort numerically.

sort -n file1.txt

5. To reverse sort.

sort -r file1.txt

aspell

- aspell - For spell check

1. To interactivly check the spellings.

aspell check file1.txt

aspell check < file2.txt

- tr - Used for changing the the case or translating.

tr '[A-Z]' '[a-z]' < file1.txt

This will change all the characters in the file "file1.txt" to capital letters.

sed

-sed - stream editior.

1. change words in a file.

sed 's/ost/OST/g' file1.txt

sed '1,10s/ost/OST/g' file1.txt

sed '/ost/,/OST/s/class/tutor/g' file1.txt

awk

- awk - editor

1.Print the first field of the file.

cat file|awk '{print $1}'

2.Print the first fields of a passwd file.

cat /etc/passwd|awk -F: '{print $1}'

Apache (Web Server)

2011-11-16T01:44:00.001-08:00

APACHE (WEB SERVER)
-------------------
Package Required  :httpd*
Script            :/etc/init.d/httpd
Daemon            :httpd
Port    :80 
Configurationfile :/etc/httpd/conf/httpd.conf
Sys V Service
Related Things    : web based authentication
---------------------------------------------
yum install httpd* -y
service httpd restart (/etc/init.d/httpd)
chkconfig --list | grep -i httpd
chkconfig httpd on
vim /etc/httpd/conf/httpd.conf
copy last 7line and pest it at last
uncomment 7line and make changes to the file as need
<VirtualHost 192.168.0.73:80>
    ServerAdmin root@server73.example.com
    DocumentRoot /var/www/html
    ServerName server73.example.com
    ErrorLog logs/server73.example.com-error_log
    CustomLog logs/server73.example.com-access_log common
</VirtualHost>

:wq!
service httpd restart
elinks --dump server73.example.com
-----------------------------------------------------------------------
name based virtual
-----------------

mkdir /var/www/virtual
mkdir /var/www/virtual/
vim /var/www/virtual/index.html
this is name based virtual hosting
:wq!
vim /etc/httpd/conf/httpd.conf
copy 7line pest it at last line

<VirtualHost 192.168.0.73:80>
    ServerAdmin root@server73.example.com
    DocumentRoot /var/www/virtual/
    ServerName www73.example.com    
</VirtualHost>

uncomment the line and give your ipaddress (or you can keep *:80)
NameVirtualHost 192.168.0.73:80
:wq!
sevice httpd restart
elinks --dump www73.example.com

---------------------------------------------------------------


User based hosting
------------------
useradd student
su - student
mkdir public_html
vim public_html/index.html
THIS IS STUDENT WEB PAGE
:wq!
chmod 711 /home/sudent
restorecon -R /home/student/public_html/
setsebool -P httpd_enable_homedirs=1

vim /etc/httpd/conf/httpd.conf

Comment this line
#UserDir disabled (line no : 366)
Uncommet this line
UserDir Public_html (line no: 373)

service httpd restart

Bash Scripting

2011-11-16T01:42:00.001-08:00

BASH SCRIPTING AND TOOLS
------------------------
First you need to find out where is your bash interpreter located. Enter the following into your command line:

which bash

Create a file with name hello.sh
vim hello.sh
-----------------------------
#!/bin/bash
# declare STRING variable
STRING="Hello World"
#print variable on a screen
echo $STRING
-----------------------------
Every bash shell script starts with shebang:"#!" which is not read as a comment. First line is also a place where you put your interpreter which is in this case: /bin/bash.

Navigate to a directory where your hello.sh is located and make the file executable:

$ chmod +rx hello_world.sh 

Now you are ready to execute your first bash script:

./hello.sh 
or
source hello.sh

Simple Backup bash shell script
----------------------------------------------
#!/bin/bash
tar -czf myhome_directory.tar.gz /home/student
--------------------------------------------------

NOw creating backup script with variable
Your backup script and variables:
--------------------------------------------
#!/bin/bash
 OF=myhome_directory_$(date +%Y%m%d).tar.gz
 tar -czf $OF /home/student 
--------------------------------------------

Global vs. Local variables
----------------------------------------------------
#!/bin/bash
#Define bash global variable
#This variable is global and can be used anywhere in this bash script
VAR="global variable"
function bash {
#Define bash local variable
#This variable is local to bash function only
local VAR="local variable"
echo $VAR
}
echo $VAR
bash
# Note the bash global variable did not change
# "local" is bash reserved word
echo $VAR
-------------------------------------------------

To get the value of a variable 
A=10
echo $A
or
echo ${A}

If you want to assign the value of any command output to a variable use:
FILES="$(ls)"
or
FILES=`ls`

If you want to execute any command and assign that value to a variable you can follow this syntax:
<variable>=$(command -option args)

Create a script which will copy all dir with its content to a new dir /dir-backup
-----------------------------------------------
#!/bin/bash
DIR=$(ls -l | grep ^d | cut -d' ' -f10)
mkdir -p /dir-backup
cp -pvrf $DIR /dir-backup
----------------------------------------------

Reading input from user
-----------------------
We can use "read" to take input 
syntax:
read NAME ###--this command will read input from keybord and store the value in NAME variable
If you want to print something before reading input you can use this:
read -p "enter your name" NAME
If you want to take input in hidden manner use this command
read -s -p "enter your name but while entering it will be hidden" NAME 

Syntax of "for loop"
--------------------
for variable in value1 value2 value3 value4
 do 
    command ### loop body
 done
--------------------   

"for loop is very useful to automate:
-------------------------------------
processing multiple files
processing command-line arguments
processing the output of a command
adding multiple users

Q:-How can you zip all *.txt file in your current dir?
vim gip-txt.sh
-------------------------------
for files in $(ls *.txt)
do 
  gzip $files
done 
--------------------------------

Q:-How can you check that a command is successfully executed or not?
A:- By checking Exit Status. Exit status is stored in "$?"
 to chech exit status echo $?
 If the value is 0(zero) means no error.
 A non-zero exit code is usually an error code.
Chech the Exit status 
 ls ; echo $?
 ls c:\windows ; echo $?
See that true returns 0 (success) and false returns 1 (failure).
 true ; echo $?
 false ; echo $?
Anothere very useful command "test". "test" can test so many things :--
* test arguments:
 -d directory
 -e file exists
 -f regular file
 -r readable file
 -w writable
 -x executable
 -s non-empty file
 -n non-empty string
 -z empty string
 -a and
 -o or
 ! not
* STRING comparison:  ==,  !=,  < ,  > , <= , >=
* NUMERIC equality : -eq, -ne, -lt, -gt, -le, -ge
* Square Brackets "[]" insteed of test command you can also use square brackets.

Q:-How can you you check that current user is root or not?
A:- You can check by two way -- you can check username or you can check the uid.
 test "$USER"==root -o $(id -u) -eq 0
 same thing using []
 [ "$USER"==root -o $(id -u) -eq 0 ]

Q:- Test that current user is standard user not a system user.
A:- test $(id -u) -gt 500

Q:- Check that "data" is a file or directory ?
A:- test -d data ; echo $?
 test -f data ; echo $?

Conditional Execution
---------------------
if/else syntax
--------------
if conditional_command 
then 
 list 
else
 list
fi
-------------
if conditional_command
then 
   command 
 elif conditional_command
    then 
    command 
else 
   command 
------------------------------------------

Q:How can we pass data to a shell scrit?
A:There are 2 ways:
1.Through command line (positional parameter)
2.Via standard input(keyboard)

Positional parameters as variable:
$#   : total number of arguments to a shell script
$1   : 1st argument passed
$2   : 2nd argument passed
$0   : name of the executable
"$@" : preserve the word boundaries
EXAMPLE:

#!/bin/bash
echo you exceuted $0 with $# arguments:
for arg in "$@"
do 
 echo $arg
done

This means
Command you executed is : 
[root@localhost ~]# ./name.sh ram rita sita
you exceuted ./name.sh with 3 arguments:
ram
rita
sita

User Administration

2011-11-16T01:31:00.001-08:00

TARGETS

è Configuration of users and groups.

è Modification of file permissions and ownerships, usage of special permissions like SUID, SGID, Stick bits.

è Setting ACCESS CONTROLS to files/directories.

è Configuration of network users with NIS and LDAP.

Adding New User Accounts:

Description

When invoked without the -D option, the useradd command creates a new user account using the values specified on the command line and the default values from the system. Depending on command line options, the useradd command will update system files and may also create the new user’s home directory and copy initial files. The version provided with Red Hat Linux will create a group for each user added to the system by default.

The basic command used to add a new user account is

Syntax: useradd username

EX: useradd student

The above command will add a new account to the machine as will as set up that user’s home directory; create a private group for user.

--To change the password of user account is

Syntax: passwd username

The user account details are stores in a file /etc/passwd

EX: [visitor@server ~]$ cat /etc/passwd

root:x:0:0:root:/root:/bin/bash

visitor:x:500:500::/home/visitor:/bin/bash

named:x:25:25:Named:/var/named:/sbin/nologin

apache:x:48:48:Apache:/var/www:/sbin/nologin

squid:x:23:23::/var/spool/squid:/sbin/nologin

[visitor@server ~]$

root:x:0:0:root:/root:/bin/bash

In this 1^st column represents …………………………………………...Username

In this 2^nd column represents …………………………..........Encrypted password

In this 3^rd column represents ……………………………………………..User ID

In this 4^th column represents ……………………………………………Group ID

In this 5^th column represents ……………………………………..Home directory

In this 6^th column represents ………………………………………...Login Shell

To create a NEW group

Syntax: groupadd groupname

EX: groupadd record

To add an user to the group

Syntax: usermod -G groupname username

EX: usermod -G record student

The group information is stored in he file called /etc/group

EX: [visitor@server ~]$ cat /etc/group

Record:x:1070:student

[visitor@server ~]$

In this 1^st column represents………………………………………….Groupname

In this 2^nd column represents………………………………Encrypted password

In this 3^rd column represents……………………………………………Group ID

In this 4^th column represents………………………………….Users in that group

To change the group of a particular file

Syntax: chgrp groupname filename

EX: chgrp record file1

Modification/ deleting user accounts

Description

The usermod command modifies the system account files to reflect the changes that are specified on the command line.

--To create a user without password is

Syntax: passwd -d username

--To change the home directory of an user

Syntax: usermod username -d new_homedir

EX: usermod student -d /opt/student

--To change the user group id

Syntax: usermod -gid groupID username

EX: usermod -gid 200 student

--To change the login name of a user

Syntax: usermod -l username newlogin_name

EX: usermod -l student test

--To restrict a user should fail to login to terminal

Syntax: usermod -s /bin/nologin username

EX: usermod -s /bin/nologin student

--To lock an user account

Syntax: usermod -L username

EX: usermod -L student

--To unlock an user account

Syntax: usermod -U username

EX: usermod -U student

--To add a comment to an user account is

Syntax: usermod -c comment username

EX: usermod -c “Student of OST” student

--To disable an user account an a particular date

Syntax: usermod -e YYYY-MM-DD username

EX: usermod -e 2008-10-30 student

--To create a group with duplicate (non-unique)GID

Syntax: groupadd -o groupname

Password aging policies:

Description

The chage command changes the number of days between password changes and the date of the last password change. This information is used by the system to determine when a user must change his/her password.

>>By default passwords do not expire

>>The chage command is used to setup password aging

--To set the expire date of an user account

Syntax: chage -E yyyy-mm-dd username

EX: chage -E 2010-10-30 student

*Note: passing the number -1 as the expire date will remove an account expiration date.

--To set the n.of days when password change

Syntax: chage -d yyyy-mm-dd username

Ex: chage -d 2010-10-30 student

--To set the n.of days inactivity after a password has expired before the account is locked

Syntax: chage -I INACTIVE username

Ex: chage -I 30 students

*Note: passing the number -1 as the inactive will remove an account as inactivity

--To show an account aging information

Syntax: chage -l username

EX: chage -l student

--To set the minimum days between password changes

Syntax: chage -m max_daysusername

--To set the maximum days between password changes

Syntax: chage -M max_daysusername

--To set the number of days of warning before a password change is required

Syntax: chage -w WARNDAYS username

EX: chage -w 10 student

Note: The chage program requires a shadow password file to be available.

Switching accounts

The su command is used to switch to another account from the terminal. This is mostly offenly used by the system administrator to temporarily become the root user without logging out of the non-privileged account.

The password of the account being switched to must be supplied unless the super user issued the su command.

Without the ‘-’ option the original user’s environment is maintained. Using the ‘-’

Option causes the new shell to be login shell which, among the other things, unsets the original user’s environment variables in the new shell.

--To switching to another

Syntax: su - username

EX: su - student

--To switch as a root user

Syntax: s u -

--To pass a single COMMAND to the shell

Syntax: su -user -c command

EX: su -user -c ls

Description

In general most system administration tasks are best performed using sudo. sudo is safer than an su to root.

The purpose of sudo is to delegrate root privileges to non-root users. It has many advantages over the su including not having to manage a shared password and logging of who actually execute commands, when and from where.

sudo allows a permitted user to execute a command as the superuser or another user, as specified in the sudoers file. The real and effective uid and gid are set to match those of the target user as specified in the passwd file and the group vector is initialized based on the group file (unless the -P option was specified). If the invoking user is root or if the target user is the same as the invoking user, no password is required. Otherwise, sudo requires that users authenticate themselves with a password by default

Note: in the default configuration this is the user’s password, not the root password.

Once a user has been authenticated, a timestamp is updated and the user may then use sudo without a password for a short period of time (5 minutes unless overridden in sudoers).

sudo determines who is an authorized user by consulting the file /etc/sudoers. By giving sudo the -v flag a user can update the time stamp without running a command. The password prompt itself will also time out if the users password is not entered within 5 minutes (unless overridden via sudoers).

If a user who is not listed in the sudoers file tries to run a command via sudo, mail is sent to the proper authorities, as defined at configure time or in the sudoers file (defaults to root). Note that the mail will not be sent if an unauthorized user tries to run sudo with the –l or -v flags. This allows users to determine for themselves whether or not they are allowed to use sudo.

Network Users

Information about users and group accounts are stored in local file like /etc/passwd on each work station or server. However it may be easier to keep account information synchronized among many computers by storing it centrally in a remote network server.

There are two basic types of information must always be provided foe each user account

--Account information

--Authentication

Account information

Name service information must be provided to the standard C library, glibc. This information maps the account’s username to a UID number, primary group, GECOS field information (such as user’s real name), home directory, and default shell. This is controlled by a system called NSS (name service switch).

Authentication

A mechanism must be provided which can determine if a password provided to authenticate login or other access to a particular account is the correct password for that account. This is configured for programs through the PAM(pluggable authentication modules).

Authentication Configuration

The mechanism used to manage user information can be changed with system-config-authentication. By default, this provides a graphical tool to configure network authentication.

The authconfig command can be called authconfig-tui for graphical or text based utility.

This information provides two tabs.

--User information (which changes NIS settings)

-- Authentication (which changes PAM settings)

For User information five data sources are supported:

--NIS gets information from database maps stored on a NIS server.

--LDAP allows account information to be stored as entries in a LDAP directory server.

--Hesiod stores user information as a special resource in a DNS name server.

--Winbind uses winbindd to automatically map accounts stored in a Microsoft windows domain controller to Linux users by storing SID to UID/GID mappings in a database.

For Authentication, six data sources are supported:

--NSS will provided an encrypted password with the other NSS user information

--Kerberos authenticates users by requesting a ticket for the user from the kerberos server.

--LDAP authentication maps the username provided to LDAP directory entry and tries to bind to the directory using that entry.

--Smartcard authentication allows a smartcard to be used to login.

--SMB and Winbind use different approaches to authenticate using a Microsoft Windows domain controller

NIS Configuration

One popular service used to centrally manage system and account information is NIS (network information system).

NIS service typically used to synchronize account information. They can be share the content of the /etc/passwd,/etc/shadow ,/etc/group ,and /etc/gpasswd

by converting them into NIS maps.

The way to set up a client to use an existing NIS server is to do following steps

--Install port map ,and ypbind packages

[visitor@server ~]$vim /etc/auto-master

# append below line in the to the file

/rhome /etc/auto.misc --timeout=60

[visitor@server ~]$vim /etc/auto.misc

nisuser1 -rw, soft, intr 192.168.0.253:/rhome/nisuser1

[visitor@server ~]$mkdir /rhome

[visitor@server ~]$service autofs restart

[visitor@server ~]$authconfig-tui

Under user information, enable NIS and the domain name command is run to set it.

In NIS settings

EX: Domain name : OPENSOURCE

Server : 192.168.0.253

And click OK button

Now go to any terminal try to login as nisuser1

EX: login: nisuser1

Password:

[visitor@localhost~]#ls /rhome

nisuser1

[visitor@localhost ~]#

LDAP Configuration

LDAP is a protocol used to talk to a distributed directory service based on X.500, which can be used to store system and account information. Client programs can use the LDAP protocol to get information from directory servers running slapd, the standalone LDAP service. The openLDAP packages in the distribution provide a slapd server implementation as well as client tools and development libraries which can be used to work with LDAP services.

One use of an LDAP directory service is to synchronize account information between multiple networked systems.

The way to set up a client to use an existing LDAP server is to do following steps

--Install nss_ldap , openldap packages

[visitor@localhost ~]#vim /etc/openldap/ldap.conf

HOST 192.168.0.3

BASE ‘dc=soft, dc=com’

[visitor@server ~]#authconfig-tui

Under user information, enable LDAP and the domain name command is run to set it.

In LDAP settings

Server: 192.168.0.3

Dc=soft, dc=com

Click on OK button

[visitor@server ~]#mkdir /home/ldapuser

[visitor@server ~]#chmod 700 /home/ldapuser

[visitor@server ~]#cp /etc/skel/.* /home/ldapuser

[visitor@server ~]#chown -R ldapuser:users /home/ldapuser

Go to any terminal try to login as ldapuser

EX: login: ldapuser

Password:

SUID and SGID Executables

Normally processes started by a user run under the user and group security context of that user. When a user starts a process, it run with the permissions of that user. If you run vi, and try to edit a file which you do not have permission to read and write, the operation fails. However, if the SUID or SGID bit is set on an executable, it runs with the permissions of its owner.

EX: [visitor@localhost~]# ll /etc/shadow

-r-------- 1 root root 1061 Jul 14 01:29 /etc/shadow

The file is owned by the root, who has exclusive read access. Users may still change their passwords with the passwd command, because the passwd command has its SUID bit set, and is owned by root:

[visitor@localhost~]# ll /usr/bin/passwd

-rwsr-xr-x 1 root root 22960 Jul 17 2006 /usr/bin/passwd

SUID and SGID bits are set using the chmod command

SUID:

[visitor@localhost~]#chmod u+s filename

SGID:

[visitor@localhost~]#chmod g+s filename

For security reasons, SUID and SGID permissions are not honored when set on non-compiled programs such as shell scripts.

SGID Directories

When a file is created in a directory, it belongs to the primary group of the user that created the file.

For a directory the default permissions are 755

For a file the default permissions are 644

However, if the setgid bit is set for the directory, new files that are created in this directory have their group ownership set to the same group ownership as the directory. This provide a mechanism to allow one level of access to users, who are members of the same group that owns the directory while allowing a different level of access to non-member users of files in the directory.

The permission to be set with chmod

[visitor@localhost~]#chmod g+s directory

This sets the SGID bit without affecting current permissions

[visitor@localhost~]#chmod 2770 directory

The above syntax sets the SGID bit and gives read, write, and execute permission to the owner of the directory and members of the group whose ownership is on that directory.

The Sticky Bit

Normally users with write permissions to a directory can delete any file in that directory regardless of that file’s permissions or ownership. Setting the sticky bit prevents users from deleting each others files, even though they have full access to the directory.

To set the sticky bit on a directory

[visitor@localhost~]#chmod o+t directory

ACCESS CONTROL LISTS (ACLs)

Description

This manual page describes POSIX Access Control Lists, which are used to define more fine-grained discretionary access rights for files and directories.

ACL Types

Every object can be thought of as having associated with it an ACL that governs the discretionary access to that object; this ACL is referred to as an access ACL. In addition, a directory may have an associated ACL that governs the initial access ACL for objects created within that directory; this ACL is referred to as a default ACL.

ACL Entries

An ACL consists of a set of ACL entries. An ACL entry specifies the access permissions on the associated object for an individual user or a group of users as a combination of read, write and search/execute permissions.

An ACL entry contains an entry tag type, an optional entry tag qualifier, and a set of permissions. We use the term qualifier to denote the entry tag qualifier of an ACL entry.

The qualifier denotes the identifier of a user or a group, for entries with tag types of ACL_USER or ACL_GROUP, respectively. Entries with tag types other than ACL_USER or ACL_GROUP have no defined qualifiers.

The ext3 file system includes support for access control lists which allow finer grained control of the system permissions than are possible with the standard three access categories that are normally provided.

In order to enable ACLs on a file system, the file system must be mounted with the acl mount option. File system created during installation include the acl flag in their default mount option.

This utility sets Access Control Lists (ACLs) of files and directories. On the command line, a sequence of commands is followed by a sequence of files (which in turn can be followed by another sequence of commands, ...).

Permissions

The file owner and processes capable of CAP_FOWNER are granted the right to modify ACLs of a file. This is analogous to the permissions required for accessing the file mode. (On current Linux systems, root is the only user with the CAP_FOWNER capability.)

To remount the /home/ directory with the acl option

[visitor@localhost~]#mount -o remount,acl /home/

The basic ACL options are:

--To view the ACL’s for a file

EX: [visitor@localhost ~]# getfacl /home/

# file : home

# owner : root

# group : root

User :: rwx

Group :: r-x

Other :: r-x

[visitor@localhost ~]#

ACLs can be modified using the setfacl command

--To granting an additional user read access

Syntax: setfacl -m u:lisa:r file

--To revoking write access from all groups and all named users (using the effective rights mask)

Syntax: setfacl –m m::rx file

--To removing a named group entry from a fileâs ACL

Syntax: setfacl -x g:staff file

--To copying the ACL of one file to another

Syntax: getfacl file1 | setfacl --set-file=- file2

--To copying the access ACL into the Default ACL

Syntax: getfacl --access dir | setfacl -d -M - dir

Correspondence Between ACL entries and file permission bits

The permissions defined by ACLs are a superset of the permissions specified by the file permission bits. The permissions defined for the file owner correspond to the permissions of the ACL_USER_OBJ entry. The permissions defined for the file group correspond to the permissions of the ACL_GROUP_OBJ entry, if the ACL has no ACL_MASK entry. If the ACL has an ACL_MASK entry, then the permissions defined for the file group correspond to the permissions of the ACL_MASK entry. The permissions defined for the other class correspond to the permissions of the ACL_OTHER_OBJ entry.

Modification of the file permission bits results in the modification of the permissions in the associated ACL entries. Modification of the permissions in the ACL entries results in the modification of the file permission bits.

Kernel Modules

2011-11-16T01:27:00.001-08:00

TARGETS

è Understanding the purpose and organization of the kernel.

è Understand how to load and configure kernel modules.

è Configuration of kernel.

Linux Kernel

The kernel is the core part of the Linux operating system. It is kernel responsibility to control the hardware, enforce security and allocation resources such as CPU and memory. Kernel code is divided into core functionally such as scheduling and memory management and kernel modules for device drives, file-systems.

Kernel duties are:

· System initialization

It detects the hardware resources and boot up the system.

· Process scheduling

This takes care of when processes should run and for tow long.

· Memory management

This allocates memory on behalf of running processes.

· Security

This constantly verifies file system permissions, SELinux contexts and firewall rules.

· Provides buffers and caches to speed up hardware access.

· Implements standard network protocols and file system formats.

Kernel Images and Variants

The main idea behind providing a variety of kernel version is that the more features are built in, the more overhead it will bring. The standard kernel is installed by default. It supports multiple processes known as Symmetric Multiprocessing (SMP). The memory limit per process is 3GB.

The kernel is always installed on /boot/vmlinuz-*.

The architectures supported are:

x86, x86_64, IA64/Itanium, PowerPC64, s390x.

The kernel versions available for x86

· Regular

One or more processes can be installed, but 4GB of RAM or less

· PAE

Multiple processors can be installed up to 64GB of RAM.

· XEN

Needed for virtualization .Xen kernel contains the Xen enabled kernel for the host and the guest operating system as well as the hyper visor. Xen is a virtual machine that can securely run multiple operating systems in their own sand boxed domains.

Kernel modules

A kernel module is an optional portion of kernel code that may be loaded after the kernel initialization .Only a few modules that are essential to all systems, are included directly into the kernel. Dynamic modules that are needed at boot time are loaded by grub into the initial RAM disk (initrd). Other modules may be loaded as needed later and are found in the /lib/modules/ directory. Kernel modules can implement drivers, file systems, firewall, and more.

Kernel modules are used for several reasons. They are:

· Reduce memory foot print i.e. memory is not used for drivers that are not required.

· Flexibility

Modules may be added to the system, after it has been installed. These modules are often called third-party modules.

ü Maximizing update

A module may be uploaded and reloaded as many times as wanted with no reboot.

Kernel module utilities

Modules may be loaded or unloaded using the mod probe utility.

--To load a module:

Syntax: #modprobe usb_storage

--To load dependencies automatically and to figure out, where the module is located on the file system is insmod.

EX: [root@server ~]# lsmod

Module Size Used by

i915 21569 2

drm 65493 3 i915

nfsd 198769 17

exportfs 9665 1 nfsd

lockd 58569 2 nfsd

[root@server ~]#

--To remove a currently loaded module

Syntax: #modprobe –r devicename

EX: #modprobe -r usb_storage

--To display information of a module,

Syntax: #modinfo device name

EX.1: [root@server ~]# modinfo video

filename: /lib/modules/2.6.18-8.el5/kernel/drivers/acpi/video.ko

license: GPL

description: ACPI Video Driver

author: Bruno Ducrot

srcversion: 5D5108C3A16D85EE29E6AE6

depends:

vermagic: 2.6.18-8.el5 SMP mod_unload 686 REGPARM 4KSTACKS gcc-4.1

[root@server ~]#

Management the initrd image

The initial RAM disk (initrd) provides the system with a series of modules that are not provided by the kernel image but which are still critical to boot the system correctly. These modules are usually associated with storage devices and file systems, but may support other features and hardware peripherals.

The initrd file is located under /boot/initrd-$ (uname –r).img. Although the file name is typically uses the format above, the name may be modified as long as the grub configuration file, /boot/grub/grub/conf refers to the right file name.

Sometimes extra modules are needed to be added due to:

Ø New hardware added to the system.

Ø New features needed to be added such as USB devices.

Ø Modules need to load automatically at boot time.

To rebuild the initrd file, the mkinitrd command is provided.

--To rebuild initrd file with an extra module:

Syntax: mkinitrd --with=modulename /boot/initrd-$(uname –r).img $(uname –r)

Where $ (uname –r) is replaced with the current kernel version.

Accessing a device through /dev

Device nodes provide access points for device drivers and map standard file permission onto that access.

The two types of device nodes are:

o Block devices.

This handles data storage. Block devices use kernel buffered IO.

o Character devices.

This handles data streams. These are do not use buffers.

Reading from a serial port can be accomplished by using the command

#cat /dev/ttyS0

Writing a word to the same serial port is:

#echo “message” > /dev/ttyS0

In general device files are located under /dev.

--To display the attributes of a device file, the command is:

#ls –l /dev/ttyS0

crw - rw – r - - - 1 root uucp 4, 64 Jul 21 16:24 /dev/ttyS0

Here ‘c’ represents the file type (here c is character file).

--To display a block device such as USB disk

#ls –l /dev/sda1

brw – r - - - - - 1 root disk 8, 1 Jul 4 16:20 dev/sda1

Some of block device names are

ü /dev/had, /dev/hdc –IDE hard disk, CDROM

ü /dev/sda, /dev/sdb –SCSI, SATA, or USB Storage

ü /dev/md0, /dev/md1 – Software RAID

Some of character device names are

ü /dev/tty[0-6] –virtual consoles

ü /dev/null, /dev/zero –software devices

ü /dev/random, /dev/urandom –random numbers

These sudo terminals are dynamically created by a special virtual file system, devpts, under the /dev/pts directory.

Managing /dev with udev

Linux distributions used to ship with thousands of files under the /dev directory. A newer, better, and more efficient system was then added to replace static files under /dev. This system is called udev. It consists in a series of utilities and configuration files which provide rules that apply whenever a device is connected to the system and detected by the kernel.

Udev makes is possible to create or remove files on the fly, when the corresponding devices is plugged or disconnected. It is also lets system administrator and rules in order to modify the default names and permissions used under /dev. Rules are located under /dev/udev/rules.d/.

Addition of files under /dev

Adding a device special file under /dev/ can be done in 2 ways. They are:

u Using mknod command

EX: #mknod /dev/usbdevice b 8 0

u By adding a new rule to udev

· The udev method involves adding a file under /dev/udev/rules.d/. This file should contain one or more statements that comply with the udev syntax. A statement such as the following would replace the default /dev/sda file with /dev/usbkey. A symbolic link called /dev/usbstorage would be created. All these files would get automatically created when the device plugged in, and removed when disconnected.

· Alternatively a file can be quickly created under /dev using mknod command

EX: mknod /dev/usbdevice b 8 0

Kernel Configuration with /proc

/proc is a virtual system that can provides detailed information about the kernel, hardware and running process. This is used to find the process information. memory resources, hardware devices, kernel memory, etc. These files are not stored under hard disk. Any modifications on these files can be modified after rebooting. These files can be used to modify network and memory sub systems or modify kernel features.

Some examples on /proc:

Read only files under /proc

These files are only for read purpose, we can’t change the info. In these files.

u /proc/cupinfo …………………………………………..contains CPU information

u /proc/partitions …………………………....................contains partition information

u /proc/meminfo …………………………………..…...contains memory information

Read-Write entries under /proc/sys/:

u /proc/sys/kernel/hostname ……………..…....contains information about host name

u /proc/sys/net/ipv4/ip_forward.......contains information about the packet forwarding

u /proc/sys/vm/drop_catches

u /proc/sys/vm/swappiness….....indicates how aggressively memory will be swapped

out to the swap device

kernel parameters provide a mechanism to adjust the functioning of the Linux kernel. We can view and set these kernel parameters.

--To get the list of all parameters and their values

Syntax: #sysctl –a

--To set a parameter, like net.ipv4.tcp_syscookies

Syntax: #sysctl –w net.ipv4.tcp_syncookies=1

To make this setting permanently add this parameter to the file /etc/sysctl.conf

Once this done new configuration file could be synchronized with the kernel by.

#sysctl –p

Hardware devices can be monitored in a number of different ways. The /proc file system has historically been the man method, with files such as /proc/devices, /proc/interrupts, /proc/iomem and /proc/ioports.

To make the /proc entries more reliable, utilities such as lspci and lsusb are also provided.

RPM Package Management

2011-11-16T01:21:00.001-08:00

TARGETS

è Installation , Upgration and remove RPM (red hat packet management)

è Installation , Upgration and remove YUM

è Management of RPM & YUM packets

RPM PACKAGE MANAGEMENT

The main RPM components are

Local database, rpm and related executables, rpm frontends such as yum, package files.

Local database:-

The local RPM database is maintained in /var/lib/rpm. The database stores information about installed packages such file attributes and package prerequisites.

RPM and related executables:-

Software to be installed using rpm is distributed through rpm package files. In general the basic syntax for rpm packages are

softwarepackage.rpm

rpm is a backend for other programs such as yum or system-config-packages.

THE PRIMARY FUNCTIONS IN RPM’s:-

Install, upgrade, remove, query, verify.

Install:

For installing new rpm into your system use the below command:

Syntax: rpm -ivh package_name.rpm

EX: rpm –ivh zip-2.3-8.i386.rpm

Upgrade:

For updating an existing rpm into your system use the below command:

Syntax: rpm -Uvh package_name.rpm

EX: rpm -Uvh zip-2.3-8.i386.rpm

Remove:

For removing an existing rpm into your system use the below command:

Syntax: rpm -e package_name

EX: rpm -ivh package_name

Verify:

Used to check the package is installed or not.

Syntax: rpm -q package_name

EX: rpm –q zip-2.3-8.i386.rpm

Query:

Used to check the all installed packages.

Syntax: rpm -qa

EX: rpm –qa

RPM VERIFICATION

Verification of an installed packages compares like file size, permission , owner , group , MD5 checksum, and modification time against the RPM database

The basic RPM verification options are

--To verify the installed zip rpm against the RPM database

Syntax: rpm -V packagename

EX: rpm -V zip

--To verify all installed RPMS against the RPM database

Syntax: rpm -Va

--To verify the installed zip package against zip package file

Syntax: rpm -Vp package_name.rpm

EX: rpm -Vp zip-2.3-8.i386.rpm

YUM (YELLOW DOG UPDATE, MODIFIED)

To solve the problem of dependency resolution and package location ,we have YUM. The yum application can call upon several repositories for dependency resolution, fetch the RPMs, and install the needed packages. The main disadvantage of rpm command is it requires the dependencies to be resolved manual it cannot call upon repositories automatically.

The Primary Functions in YUM’s:-

Install, update, and remove.

Install:

For installing new rpm into your system use the below command:

Syntax: yum install packagename

EX: yum install media player

Update:

For updating an existing rpm into your system use the below command:

Syntax: yum update packagename

EX: yum update media player

Remove:

For removing an existing rpm into your system use the below command

Syntax: yum remove packagename

EX: yum remove media player

The primary function for searching yum packages/files :

Search, list, info, what provides.

--To search a installed package

Syntax: yum search packagename

EX: yum search firefox

--To know the all installed packages

Syntax: yum list

--To search the package database for a package & displays the info. about it

Syntax: yum info firefox

YUM Installation on Server Side

Step by Step Procedure for Server Side:

1. cp all rpms to /var/ftp/pub/rpm

2. Install rpm -ivh createrepo-0.4.4-2.fc6.noarch.rpm

3. Execute repository creating command:

#createrepo /var/ftp/pub/rpm/

Takes Some times for creating repository

YUM Installation on Client Side

1. vim /etc/yum.repos.d/open.repo (Any Name with .repo for your reference only)

name=opensourcerepo # Any Friendly name can be given

baseurl=ftp://123.236.153.248/pub/rpm # Set the Server ipaddress with your repository path

gpgcheck=1 # Key Verification Enabled

enabled=1 # yum Enabled for this client

gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release

Examples on YUM:

1. To know whether the package is installed properly or not

#[root@ns1 ~]# yum list openldap

Loading "installonlyn" plugin

Loading "rhnplugin" plugin

RHN support will be disabled.

Setting up repositories

Reading repository metadata in from local files

Installed Packages

openldap.i386 2.3.27-5 installed

2. To remove any installed package

#[root@ns1 ~]# yum remove openssh

Loading "installonlyn" plugin

Loading "rhnplugin" plugin

This system is not registered with RHN.

RHN support will be disabled.

Setting up Remove Process

Resolving Dependencies

--> Populating transaction set with selected packages. Please wait.

--> Package openssh.i386 0:4.3p2-16.el5 set to be erased

--> Running transaction check

Setting up repositories

Reading repository metadata in from local files

--> Processing Dependency: openssh = 4.3p2-16.el5 for package: openssh-server

--> Processing Dependency: openssh = 4.3p2-16.el5 for package: openssh-askpass

--> Processing Dependency: openssh = 4.3p2-16.el5 for package: openssh-clients

--> Restarting Dependency Resolution with new changes.

--> Populating transaction set with selected packages. Please wait.

--> Package openssh-clients.i386 0:4.3p2-16.el5 set to be erased

--> Package openssh-server.i386 0:4.3p2-16.el5 set to be erased

--> Package openssh-askpass.i386 0:4.3p2-16.el5 set to be erased

-->Running transaction check

Dependencies Resolved

===============================================================

Package Arch Version Repository Size

===============================================================

Removing:

openssh i386 4.3p2-16.el5 installed 714 k

Removing for dependencies:

openssh-askpass i386 4.3p2-16.el5 installed 9.8 k

openssh-clients i386 4.3p2-16.el5 installed 811 k

openssh-server i386 4.3p2-16.el5 installed 447 k

Transaction Summary

===============================================================

Install 0 Package(s)

Update 0 Package(s)

Remove 4 Package(s)

Is this ok [y/N]: y # Click "y" to remove

Downloading Packages:

Running Transaction Test

Finished Transaction Test

Transaction Test Succeeded

Running Transaction

Removing : openssh-clients ######################### [1/4]

Removing : openssh ######################### [2/4]

Removing : openssh-server ######################### [3/4]

Removing : openssh-askpass ######################### [4/4]

Removed: openssh.i386 0:4.3p2-16.el5

Dependency Removed: openssh-askpass.i386 0:4.3p2-16.el5 openssh-clients.i386 0:4.3p2-16.el5 openssh-server.i386 0:4.3p2-16.el5

Complete!