1 Advanced Unix Administrative Tools

2 VMWare Image Setup We all need to check out the VMWare FC6 image that you’ll be using We all need to check out the VMWare FC6 image that you’ll be using Login as rootLogin as root Password should be “thoughtpolice”Password should be “thoughtpolice” Now create a non-root account for yourself:Now create a non-root account for yourself: adduser adduser Create a password:Create a password: Passwd Passwd

3 Administrative Tools Superuser root Superuser root Unrestricted accessUnrestricted access Become a superuserBecome a superuser Log in to root Log in to root Use su or su – Use su or su – Inherits the env from current shellInherits the env from current shell Only use superuser when it is neededOnly use superuser when it is needed Change root password periodicallyChange root password periodically Employment status change for SA Employment status change for SA Unauthorized access Unauthorized access

4 Administrative Tools Always lock your screenAlways lock your screen Use xlock or simply log off Use xlock or simply log off Controlling su accessControlling su access System V System V BSD – member’s of group 0 BSD – member’s of group 0 Linux – GNU su does not check membership of group 0 Linux – GNU su does not check membership of group 0 Run a command with su same timeRun a command with su same time su root –c “command” su root –c “command”

5 Administrative Tools Facility sudo Facility sudo Selective accessSelective access Allow some user to run specific commands as root without having to know the root passwordAllow some user to run specific commands as root without having to know the root password RUN sudo command RUN sudo command Type in user’s own passwordType in user’s own password Good for a configurable time, default 5 minutesGood for a configurable time, default 5 minutes Configuration file /etc/sudoersConfiguration file /etc/sudoers Users Users Commands Commands Format Format Users host=commands

6 Administrative Tools More about Facility sudo More about Facility sudo Select the commands for sudo with careSelect the commands for sudo with care No shell scripts No shell scripts No utility which provides shell escapes No utility which provides shell escapes Editor visudoEditor visudo Lock Lock Syntax checking Syntax checking

7 Quick Sudo Lab As a normal user type the following: As a normal user type the following: /bin/cat /etc/sudoers Now try the following: Now try the following: sudo /bin/cat /etc/sudoers Now add the following to /etc/sudoers Now add the following to /etc/sudoers ALL=/bin/cat /etc/sudoers ALL=/bin/cat /etc/sudoers Now try step 2 again… Now try step 2 again…

8 Administrative Tools Advantages of sudoAdvantages of sudo Command logging - accountabilities Command logging - accountabilities Operators can do chores Operators can do chores Hide the real root password Hide the real root password Revoke the privilege without changing the root password Revoke the privilege without changing the root password A list of users with privileged access is maintained A list of users with privileged access is maintained Less chance of root shell left unattended Less chance of root shell left unattended

9 Administrative Tools Disadvantages of sudoDisadvantages of sudo Breach in security of a personal account can equal a compromise of the root account Breach in security of a personal account can equal a compromise of the root account Logging can be subverted Logging can be subverted sudo csh sudo csh sudo su sudo su

10 Administrative Tools Communicating with Users Communicating with Users Command writeCommand write write username [tty] write username [tty] only talks on local systemonly talks on local system Ctrl–D ends the write session it Ctrl–D ends the write session it Replying with write will create a two-way communication Replying with write will create a two-way communication Command talk or ytalkCommand talk or ytalk Must have a daemon listening Must have a daemon listening Separate window for sender and receiver Separate window for sender and receiver To refuse write, talk and ytalk requestsTo refuse write, talk and ytalk requests Use the command mesg n or y Use the command mesg n or y Default is n Default is n Root account overrides the setting Root account overrides the setting

11 Administrative Tools More about Communicating with Users More about Communicating with Users Sending message to allSending message to all Command = wall Command = wall Very useful for system announcements Very useful for system announcements “System going down. Save your work and logoff” The message of the DayThe message of the Day /etc/motd /etc/motd /etc/issue /etc/issue /etc/issue.net /etc/issue.net

12 Administrative Tools Administration tools Administration tools Examples:Examples: Digital Unix: SETUP Digital Unix: SETUP HP-UX: SAM HP-UX: SAM Solaris: admintool Solaris: admintool GoodGood Quick start to system administration Quick start to system administration Mask the raw commandsMask the raw commands Easy: combine several steps Easy: combine several steps DownsideDownside The command prompt is ususally faster The command prompt is ususally faster Not all commands available through menu Not all commands available through menu Slow down the learning process Slow down the learning process

13 Administrative Tools HP-UX’s SAM HP-UX’s SAM Perform a variety of system management tasksPerform a variety of system management tasks System configuration System configuration Change a parameter Change a parameter File system management File system management … Detailed loggingDetailed logging

14 Administrative Tools Admin tools for Linux Admin tools for Linux LinuxconfLinuxconf WebminWebmin Yet Another System Tool (YaST)Yet Another System Tool (YaST)

15 Manuals Unix has two types Unix has two types Man pagesMan pages Individual commands Individual commands For format For format Routines Routines Supplemental documentsSupplemental documents Printed Printed online from Internet online from Internet DVD/CDROM DVD/CDROM RFCs (Request for Comments) for protocols, standards used on the Internet RFCs (Request for Comments) for protocols, standards used on the Internet

16 Organization of man pages Solaris/ HP-UX LinuxContents 11 User-level commands and applications 22 System calls and kernel error 33 Library calls 45 Standard file formats 57 Miscellaneous files and documents 66 Games and demonstrations 74 Device drivers and network protocols 1m8 System administration commands 99 Obscure kernel specs and interfaces

17 Manual Man pages are kept Man pages are kept Under /usr/man/man# or /usr/share/man/man#Under /usr/man/man# or /usr/share/man/man# Format (troff, SGML)Format (troff, SGML) Compressed (compress or gzip)Compressed (compress or gzip) read manual pages: man read manual pages: man $man title$man title Example: $man ls Example: $man ls $man section title$man section title Example: $man 4 tty Example: $man 4 tty Solaris Example: $man –s 4 tty Solaris Example: $man –s 4 tty

18 Manual More about reading manual pages: man More about reading manual pages: man MANPATHMANPATH /etc/man.config /etc/man.config Add new man pages besides the system ones. Add new man pages besides the system ones.MANPATH=/home/share/localman:/usr/share/man Keyword search in synopsisKeyword search in synopsis $man –k keyword $man –k keyword Example: $man –k mount

19 Creating an ISO Image Step One: Step One: Place your cd’s or dvd in your drivePlace your cd’s or dvd in your drive As root type the following to make image:As root type the following to make image: dd if=/dev/cdrom of=/home/ISO/fc4-dvd.iso The ISO image will be create in your current directoryThe ISO image will be create in your current directory

20 Mounting the ISO Image Step two Step two Make directory under the /mnt directory called isoMake directory under the /mnt directory called iso Then you can mount the ISO image with:Then you can mount the ISO image with: mount -o loop=/dev/loop1 -t iso9660 filename.iso /mnt/iso To simplify this add the following line to /etc/fstabTo simplify this add the following line to /etc/fstab /home/ISO/fc4-dvd.iso /mnt/iso iso9660 loop=/dev/loop1,noauto

21