Linuxfile Admin
Linuxfile Admin
Administration
James Lee
[email protected]
© 2017-2020 by Onsight
https://en.wikipedia.org/wiki/Tux
By [email protected] Larry Ewing and The GIMP, Attribution, https://commons.wikimedia.org/w/index.php?curid=80930
This course is for you
because…
• You are a Linux user with a basic understanding of the
Linux operating system and..
• SUID / SGID
student$ ls -l regex.txt
-rw-rw-r-- 1 student student 8 Oct 15 08:54 regex.txt
student$ chmod 600 regex.txt
student$ ls -l regex.txt
-rw------- 1 student student 8 Oct 15 08:54 regex.txt
chmod
The numeric value represents:
6 0 0
110 000 000
rw- --- ---
For 751:
7 5 1
111 101 001
rwx r-x --x
student$ chmod 751 regex.txt
student$ ls -l regex.txt
-rwxr-x--x 1 student student 8 Oct 15 08:54 regex.txt
chmod
Symbolic notation can also be used:
student$ ls -l regex.txt
-rwxr-x--x 1 student student 8 Oct 15 08:54 regex.txt
student$ chmod -x regex.txt
student$ ls -l regex.txt
-rw-r----- 1 student student 8 Oct 15 08:54 regex.txt
student$ chmod g+w regex.txt
student$ ls -l regex.txt
-rw-rw---- 1 student student 8 Oct 15 08:54 regex.txt
student$ chmod gu-r regex.txt
student$ ls -l regex.txt
--w--w---- 1 student student 8 Oct 15 08:54 regex.txt
chmod
student$ ls -l regex.txt
--w--w---- 1 student student 8 Oct 15 08:54 regex.txt
student$ chmod g+r,o+x regex.txt
student$ ls -l regex.txt
--w-rw---x 1 student student 8 Oct 15 08:54 regex.txt
student$ chmod u+r,g-w,o-x regex.txt
student$ ls -l regex.txt
-rw-r----- 1 student student 8 Oct 15 08:54 regex.txt
chown / chgrp
The chown command changes the owner - only root can do this:
root# ls -l regex.txt
-rw-r----- 1 student student 8 Oct 15 08:54 regex.txt
root# chown jdoe regex.txt
root# ls -l regex.txt
-rw-r----- 1 jdoe student 8 Oct 15 08:54 regex.txt
SUID Executables
SUID is necessary when normal users are executing
programs that require elevated privileges, such as the
passwd utility that modifies /etc/shadow:
$ ls -l /usr/bin/passwd
-rwsr-xr-x 1 root root 54256 May 16 19:37 /usr/bin/passwd
One can write into and delete files owned by others from a
directory that is writeable, even if the file is not readable or
writeable:
student$ ls -ld /tmp/mydirectory
drwxrwxrwx 2 jdoe jdoe 17 Oct 16 16:17 my directory
student$ ls -l /tmp/mydirectory
-rw------- 1 jdoe jdoe 17 Oct 16 16:19 myfile.txt
student$ cat /tmp/mydirectory/myfile.txt
cat: /tmp/mydirectory/myfile.txt: Permision denied
student$ rm /tmp/mydirectory/myfile.txt
rm: remove write-protected regular file '/tmp/mydirectory/myfile.txt'? y
student$ cat /tmp/mydirectory/myfile.txt
cat: /tmp/mydirectory/myfile.txt: No such file or directory
Writeable Directory
Solved with the “sticky bit” created with chmod +t. Notice
the “other” x changes to a t:
jdoe$ chmod +t /tmp/mydirectory
jdoe$ ls -ld /tmp/mydirctory
drwxrwxrwt 2 jdoe jdoe 4096 Oct 16 17:07 /tmp/mydirctory
jdoe$ touch /tmp/mydirectory/myfile.txt
jdoe$ chmod 600 /tmp/mydirectory/myfile.txt
jdoe$ su - student
Password:
student$ cat /tmp/mydirectory/myfile.txt
cat: /tmp/mydirectory/myfile.txt: Permission denied
student$ rm /tmp/mydirectory/myfile.txt
rm: remove write-protected regular empty file '/tmp/mydirectory/myfile.txt'? y
rm: cannot remove '/tmp/mydirectory/myfile.txt': Operation not permitted
• if more than one user is editing the same file, the last write
overwrites all other writes
In another shell:
$ ./flock.sh
Lockfile: /tmp/flock.sh
$
Exercise
1. Given the following permissions, write the numeric chmod
argument to create them:
rwxrw-r-- chmod _______
r-xr--r-- chmod _______
rw-rw-rw- chmod _______
rw-rw-r-- chmod _______
r---w---x chmod _______
r-------- chmod _______
r--r--r-- chmod _______
Exercise
2. Given the following permissions, write the symbolic chmod
argument to create them (cumulative, meaning from the recent
permissions to the desired permissions):
---------
rw-r--r-- chmod _______
rw-rw-r-- chmod _______
rw-rw-rw- chmod _______
r---w---x chmod _______
r-------- chmod _______
r--r--r-- chmod _______
rwxrw-r-- chmod _______
r-xr--r-- chmod _______
Exercise
3. Compile the program setuid.c. Run it as a non-SUID
program as another user. Then SUID it, run it again.
4. Create a directory and set the sticky bit (as root) with the
numeric notation.
• A - no atime updates
• j - data journaling
student$ ls -l test.txt
-rwxrwx---+ 1 student student 0 Oct 6 08:54 test.txt
setfacl Command
Now the user jdoe can modify the file:
student$ su - jdoe
Password:
jdoe$ echo hi >> /tmp/test.txt
jdoe$ exit
setfacl Command
We can also apply ACLs to directories. Let's create a directory that
jdoe cannot write into:
student$ su - jdoe
Password:
jdoe$ touch /tmp/acl/test.txt
touch: cannot touch `/tmp/acl/test.txt': Permission denied
setfacl Command
Let's give jdoe read/write permission:
• if the carat (^) is the first character in the class, it matches any character except
what is in the class:
• [^abcde] - any character except "a", "b", "c", "d" and "e"
• * - 0 or more
• + - 1 or more
• ? - 0 or 1
• \{m\} - exactly m
• \{m,\} - m or more
grep Command
If no file argument is provided, then read from standard
input:
student$ ls -l | grep ^d
• who
• date
• ifconfig
• hard links
• symbolic links
We would see:
" ============================================================================
" Netrw Directory Listing (netrw v125)
" /home/student/inode.dir
" Sorted by name
" Sort sequence: [\/]$,\.h$,\.c$,\.cpp$,*,\.o$,\.obj$,\.info$,\.swp$,\.bak$,\~
" Quick Help: <F1>:help -:go up dir D:delete R:rename s:sort-by x:exec
" ============================================================================
../
a.dat
b.dat
c.dat
Links
Linux has two types of links:
• hard links
• advantages
• can save disk space - one copy of the file exists on the
disk
• if link to the file is edited, the file is modified for all links
Hard Links
A hard link is another entry in a directory with the same inode
as the file to which it links. Consider this file:
This shows that the inode number of this file is 4292984 and
the number of hard links to this file (the number just to the
left of the username) is 1. This means that this file's inode
number is only listed in one directory (the current directory).
Hard Links
Hard Links
Let's create a hard link to this file - we'll call it
linktoa.dat:
Notice that the inode numbers of these files are the same
(which means they are the same file physically on the disk).
Also notice the number to the left of the username is now 2
since there are now 2 links to the file.
Hard Links
Hard Links
Let's show the contents of linktoa.dat:
Now let's delete the original file a.dat and show that the
physical file still exists:
student$ rm a.dat
student$ ls -li linktoa.dat
4292984 -rw-rw-r-- 1 student student 23 Oct 6 16:02 linktoa.dat
student$ cat linktoa.dat
this is the file a.dat
Hard Links
Now the link count is down to 1. Once the link count
decreases to 0, the file is removed from disk.
Soft Links
A soft link (aka symbolic link) is entirely new file with its own
inode, however it is a special type of file. Its "content" is the
name of the file to which it is linked. It is created with
ln -s:
• when a soft link is linked to it, the soft link has a different
inode number (here 4292967), so it is an entirely new file on
disk
It is possible to delete the file that the soft link is linked to,
and the soft link will still exist, although it now links to a non-
existent file:
student$ rm /tmp/newfile.txt
student$ ls -li mysoftlink
4292967 lrwxrwxrwx 1 student student 16 Oct 6 18:03 mysoftlink -> /tmp/newfile.txt
jdoe$ cat mysoftlink
cat: mysoftlink: No such file or directory
Inode Pointer Structure
• stat
• readlink
stat
The stat command displays a file’s system status:
student$ stat regex.txt
File: 'regex.txt'
Size: 8 Blocks: 8 IO Block: 4096 regular file
Device: 802h/2050d Inode: 436131 Links: 1
Access: (0640/-rw-r-----) Uid: ( 1000/student) Gid: ( 1000/student)
Access: 2017-11-05 15:58:01.192000000 -0500
Modify: 2017-10-15 08:54:25.893694474 -0400
Change: 2017-11-05 13:44:30.628000000 -0500
Birth: -
student$ stat -t regex.txt
regex.txt 8 8 81a0 1000 1000 802 436131 1 0 0 1509915481 1508072065
1509907470 0 4096
stat
The -f option shows status of a file system:
student$ stat -f /dev/sda1
File: "/dev/sda1"
ID: 0 Namelen: 255 Type: tmpfs
Block size: 4096 Fundamental block size: 4096
Blocks: Total: 249974 Free: 249974 Available: 249974
Inodes: Total: 249974 Free: 249516
student$ stat /dev/sda1
File: '/dev/sda1'
Size: 0 Blocks: 0 IO Block: 4096 block special file
Device: 6h/6d Inode: 11567 Links: 1 Device type: 8,1
Access: (0660/brw-rw----) Uid: ( 0/ root) Gid: ( 6/ disk)
Access: 2017-11-06 07:24:05.148000000 -0500
Modify: 2017-11-06 07:24:05.148000000 -0500
Change: 2017-11-06 07:24:05.148000000 -0500
Birth: -
stat
The --format constructs a format string (for all options,
see man stat):
student$ stat --format=%g regex.txt
1000
student$ stat --format=%G regex.txt
student
student$ stat --format=%i regex.txt
436131
student$ stat --format="%g %G %i" regex.txt
1000 student 436131
readlink
The readlink command shows the file a symbolic link
links to:
student$ ls -l /etc/rc2.d/S02cron
lrwxrwxrwx 1 root root 14 Sep 28 15:38 /etc/rc2.d/S02cron -> ../init.d/cron
student$ readlink /etc/rc2.d/S02cron
../init.d/cron
Exercise
1. Create a hard link to regex.txt. Show the inode for
regex.txt and the link. Show the contents of the link.
Edit the link, then show the contents of regex.txt. Show
information about the link and regex.txt using stat.
Remove the link.
• zip / unzip
• gzip / gunzip
• tar
zip / unzip
A common compression utility on Linux is zip. It will
compress using an algorithm compatible with PKZIP used in
the Windows world.
To compress a file:
• file details:
student$ file /tmp/mystuff.tar
/tmp/mystuff.tar: POSIX tar archive (GNU)
student$ ls -l /tmp/mystuff.tar
-rw-rw-r-- 1 student student 61440 Oct 1 16:56 /tmp/mystuff.tar
tar Options
• here are some common options:
• c - createfile
• x - extractfile
• f - filename
• v - verbose
• z - zip (compress)
• r - append
• t - list contents
tar Append
Here is an example of appending a file to our tarfile /tmp/mystuff.tar, and then listing its
contents:
student$ tar rvf /tmp/mystuff.tar /etc/passwd
tar: Removing leading `/' from member names
/etc/passwd
student$ tar tf /tmp/mystuff.tar
class/
class/quote.txt
class/sed.out
class/wallquote.txt
class/hello.pl
class/records.data
class/largefile.txt
Desktop/
Documents/
Downloads/
examples.desktop
...
etc/passwd
tar Extract
• we can then extract the tar file
student$ mkdir /tmp/tartest
student$ cd /tmp/tartest
student$ tar xvf /tmp/mystuff.tar
class/
class/quote.txt
class/sed.out
class/wallquote.txt
class/hello.pl
class/records.data
class/largefile.txt
...
Videos/
etc/passwd
student$ ls -F
class/ Desktop/ Documents/ Downloads/ etc/ examples.desktop
Music/ Pictures/ Public/ Templates/ Videos/
tar Compression
• compression is done with the z option
• hardware failure
• power failure
• theft
• security breach
Backup Strategies
• Backup to another location:
• backup service
Backup Strategies
• Backup regularly:
• backup service
Backup Script
Here is a shell script to back up a list of files or all the files that changed
in the last day:
#! /bin/bash
# backup.sh
# be sure to create ~/.backup_files_list, a list of
# files to back up weekly
# to back up the specified users list of files
# root# ./backup.sh
# an incremental backup
# root# ./backup.sh incr
DIR=/data/backups
DATE=`date +'%Y%m%d'`
USERS=‘student jdoe’
Backup Script
Here is a shell script to back up a list of files or all the files that changed in the last day:
cd /
mkdir $DIR/$DATE || exit
for USER in `echo $USERS`
do
if [ "$1" == "incr" ]
then
echo "Incremental backup of $USER"
FILE_LIST="/tmp/$DATE.$USER.incr_files"
find /home/$USER -type f -mtime -1 | cut -c2- > $FILE_LIST
echo $DIR/$DATE/incr_$USER.tar
tar cf $DIR/$DATE/incr_$USER.tar -W -T $FILE_LIST
rm $FILE_LIST
else
echo "Backing up into $DIR/$DATE the content of $USER "
tar cf $DIR/$DATE/$USER.tar -W -T \
/home/$USER/.backup_files_list
fi
done
Backup Script
Cron jobs can be set up to run this script:
# 11:45pm Monday-Saturday
30 45 * * 1,2,3,4,5,6 /usr/local/bin/backup.sh incr
Exercise
1. Zip up the class directory (using zip). Unzip it in /tmp
(using unzip) and verify that all the files were transferred.
• disk partitioning
• swap space
• quotas
• LVM
• RAID
Filesystem Types
Filesystem Types
• ext{2,3,4}
• JFS
• ReiserFS
• Btrfs
• xfs
ext{2,3,4}
ext - the extended file system, was the first filesystem specifically
created for the Linux kernel
• max partition size: 4TB, max file size: 2GB-2TB (depending on kernel)
• with Large File Support (LFS) - max partition size: 2TB-32TB; max file
size: 2GB-2TB
ext{2,3,4}
ext3 - the third extended file system
• improves reliability
• ext2 can be changed to ext3 by adding journaling with (be sure to modify
/etc/fstab):
tune2fs -j /dev/sdaN
ext{2,3,4}
ext4 - the fourth extended file system
• features include
• uses extents - a single extent can map up to 128 MiB of contiguous space with
a 4 KiB block size
• backward compatible with ext2 and ext3 - can mount ext2 or ext3 as ext4
• fast and reliable with good performance under different kinds of loads
• uses a B+ Tree
• extents
• kernel 2.4.18
• online resizing
• copy-on-write (shadowing)
• auto-defrag
• online growth/shrinking
• RAID {0,1,10}
xfs
• eXtents File System (xfs) - development begun by Silicon
Graphics in 1993
• journaling
• striped allocation
student$ df
Filesystem 1K-blocks Used Available Use% Mounted on
udev 999896 0 999896 0% /dev
tmpfs 204596 21920 182676 11% /run
/dev/sda1 9481444 4949280 4027488 56% /
...
student$ df -i
Filesystem Inodes IUsed IFree IUse% Mounted on
udev 249974 448 249526 1% /dev
tmpfs 255743 655 255088 1% /run
/dev/sda1 610800 261998 348802 43% /
...
root# partprobe
root# df -i
Filesystem Inodes IUsed IFree IUse% Mounted on
/dev/sda1 610800 262004 348796 43% /
/dev/sda3 65536 12 65524 1% /mnt/newpartition
root# reboot
• Configuring quotas
• Managing quotas
Quotas
• limit resources for a user or a group (eg. amount of disk
space or number of files)
• /home
• /tmp
For RHEL:
root# yum install quota
Turning On Quotas
• step one: mount a partition with quota options
(usrquota and grpquota):
root# umount /mnt/newpartition
root# mount /dev/sda3 /mnt/newpartition -o usrquota,grpquota
root# mount | grep newpartition
/dev/sda3 on /mnt/newpartition type ext4 (usrquota,grpquota)
• or:
root# mount -o remount usrquota,grpquota /dev/sda3
Turning On Quotas
• step two:
2. Set up quotas for blocks (10 soft, 40 hard) and inodes (10 soft,
40 hard).
3. Copy enough data for the user to exceed one of the soft limits.
4. Copy enough data for the user to exceed one of the hard
limits.
5. Create a new user, give that new user the same quotas.
• / partition as LVM
• / partition as LVM
• Debian
root# apt install lvm2 system-config-lvm
• RHEL
root# yum install lvm2 system-config-lvm
Graphical Tools
• system-config-lvm
Graphical Tools
Working with LVMs
To create an LVM:
# make 20 extents
root# lvcreate -l 20 -n data vgrp0
root# mkfs.ext4 /dev/vgrp0/data
root# mkdir /mnt/data
root# mount /dev/vgrp0/data /mnt/data
# add to /etc/fstab
/dev/vgrp0/data /mnt/data ext4 defaults 0 2
Resizing Logical Volumes
Logical volumes can be resized without needing to reboot.
They can be expanded without having to unmount (if the
size is to be reduced, then it must be unmounted). The
lvextend will increase the size of the volume, and
lvreduce will decrease its size.
• physical volumes
root# pvdisplay /dev/sda6
• volume groups
root# vgdisplay vgrp0
• logical volumes
root# lvdisplay /dev/vgrp0/web
RAID
Software RAID
• RAID (Redundant Array of Inexpensive Disks) came about
because (as the story goes) an organization with little
money and a lot of old hard drives needed some storage
space. So the idea to combine the inexpensive disks into
a single disk was born. These days, they are better known
as Redundant Array of Independent Disks.
• cheapest solution
• create partitions
• update the initial RAM file system so the array will be available during
the early boot process
root# update-initramfs -u
/dev/md0:
Version : 1.2
Creation Time : Fri Sep 29 17:24:11 2017
Raid Level : raid1
Array Size : 511680 (499.77 MiB 523.96 MB)
Used Dev Size : 511680 (499.77 MiB 523.96 MB)
Raid Devices : 2
Total Devices : 2
Persistence : Superblock is persistent
RAID Info
Update Time : Fri Sep 29 17:47:20 2017
State : clean
Active Devices : 2
Working Devices : 2
Failed Devices : 0
Spare Devices : 0
Name : ubuntu2:0 (local to host ubuntu2)
UUID : 9077a64b:ee2fcfc0:08fc26bd:5e9f1bd8
Events : 21
Number Major Minor RaidDevice State
0 8 5 0 active sync /dev/sda10
1 8 6 1 active sync /dev/sda11
Removing a RAID
• To remove a RAID:
• 1 volume group
• RAID 0
• stride 32
• mount it at /mnt/RAID
• add it to /etc/fstab
# fdisk -l /dev/sda
...
/dev/sda12 40278016 44472319 4194304 2G fd Linux raid autodetect
/dev/sda13 44474368 48668671 4194304 2G fd Linux raid autodetect
/dev/sda14 48670720 52865023 4194304 2G fd Linux raid autodetect
/dev/sda15 52867072 57061375 4194304 2G fd Linux raid autodetect
4. Create a VG:
# mkfs.ext4 /dev/lvmonraid/lv1
# mkfs.ext4 /dev/lvmonraid/lv2
7. Mount them:
# mkdir /mnt/lv1
# mkdir /mnt/lv2
# mount /dev/lvmonraid/lv1 /mnt/lv1
# mount /dev/lvmonraid/lv2 /mnt/lv2
LVM on RAID
The result: