Difference between revisions of "OPS235 Lab 4 - CentOS7"

From CDOT Wiki
Jump to: navigation, search
 
(84 intermediate revisions by 2 users not shown)
Line 1: Line 1:
 
[[Category:OPS235]]
 
[[Category:OPS235]]
 +
{{Admon/caution|THIS IS AN OLD VERSION OF THE LAB|'''This is an archived version. Do not use this in your OPS235 course.'''}}
 +
=LAB PREPARATION=
  
=LAB PREPARATION=
+
==Purpose / Objectives of Lab 4==
 +
{| width="40%" align="right" cellpadding="10"
 +
|- valign="top"
 +
|
 +
[[Image:users.png|thumb|right|150px|System administrators are required to add, remove and modify user accounts.]]
 +
|
 +
[[Image:on-off.png|thumb|right|135px|In order to perform maintenance, system administrators need to know how to stop and start services for a Linux system.  ]]
 +
|}
  
==Purpose / Objectives of Lab 1==
 
  
 
There are many other tasks that a Linux system administrator must perform other than installing Linux and installing software.
 
There are many other tasks that a Linux system administrator must perform other than installing Linux and installing software.
Line 10: Line 18:
  
  
<u>Main objectives</u>:
+
<u>Main Objectives</u>:
 
<br>
 
<br>
:* Add a virtual hard disk and expand your vm's existing file system using LVM
+
:* Administer '''(add, remove, modify) users''' on a Linux system.
:* Administer (add, remove, modify) users on a Linux system.
+
:* Save time while adding new users using a template of '''start-up files'''.
:* Save time while adding new users using a template of start-up files.
+
:* Create and manage '''groups''' on a Linux system.
:* Create and manage groups on a Linux system.
+
:* '''Start and Stop services''' on a Linux system.
:* Start and Stop services on a Linux system.
+
:* Display the '''status of running services''' on a Linux system.
:* Display the status of running services on a Linux system.
+
 
  
  
Line 25: Line 33:
  
 
|- valign="top"
 
|- valign="top"
 
|width="10%" | [[Image:blank-cd.png|thumb|left|85px|<b>CentOS7</b><br>FULL DVD]]
 
  
 
|width="10%" | [[Image:harddrive.png|thumb|left|85px|<b>Removable Hard Disk Pack</b> (SATA)]]
 
|width="10%" | [[Image:harddrive.png|thumb|left|85px|<b>Removable Hard Disk Pack</b> (SATA)]]
Line 41: Line 47:
 
|- valign="top"
 
|- valign="top"
 
|width="10%" |<u>User Management:</u>
 
|width="10%" |<u>User Management:</u>
[http://linuxmanpages.com/man8/useradd.8.php useradd]<br>
+
[http://unixhelp.ed.ac.uk/CGI/man-cgi?useradd+8 useradd]<br>
[http://linuxmanpages.com/man8/userdel.8.php userdel]<br>
+
[http://unixhelp.ed.ac.uk/CGI/man-cgi?userdel+8 userdel]<br>
[http://linuxmanpages.com/man8/usermod.8.php usermod]<br>
+
[http://unixhelp.ed.ac.uk/CGI/man-cgi?usermod+8 usermod]<br>
[http://linuxmanpages.com/man8/groupadd.8.php groupadd]<br>
+
[http://unixhelp.ed.ac.uk/CGI/man-cgi?groupadd+8 groupadd]<br>
[http://linuxmanpages.com/man8/groupdel.8.php groupdel]
+
[http://unixhelp.ed.ac.uk/CGI/man-cgi?groupdel+8 groupdel]
 
|width="10%" |<u>Managing Services</u>
 
|width="10%" |<u>Managing Services</u>
[http://linuxmanpages.com/man8/useradd.8.php chkconfig]<br>
+
[http://unixhelp.ed.ac.uk/CGI/man-cgi?chkconfig+8 chkconfig]<br>
[http://linuxmanpages.com/man8/userdel.8.php service]<br>
+
[http://unixhelp.ed.ac.uk/CGI/man-cgi?service+8 service]<br>
[http://linuxmanpages.com/man8/userdel.8.php systemctl]<br>
+
[http://www.dsm.fordham.edu/cgi-bin/man-cgi.pl?topic=systemctl systemctl]<br>
 
|width="10%" |<u>Miscellaneous</u>
 
|width="10%" |<u>Miscellaneous</u>
[http://linuxmanpages.com/man8/useradd.8.php /etc/passwd]<br>
+
[http://man7.org/linux/man-pages/man5/passwd.5.html /etc/passwd]<br>
[http://linuxmanpages.com/man8/userdel.8.php /etc/group]<br>
+
[http://man7.org/linux/man-pages/man5/group.5.html /etc/group]<br>
[http://linuxmanpages.com/man8/userdel.8.php /etc/shadow]<br>
+
[http://man7.org/linux/man-pages/man5/shadow.5.html /etc/shadow]<br>
[http://linuxmanpages.com/man8/userdel.8.php /etc/skel]<br>
+
[http://archive.linuxfromscratch.org/blfs-museum/1.0/BLFS-1.0/postlfs/skel.html /etc/skel]<br>
 +
[http://zenit.senecac.on.ca/wiki/index.php/Init_vs_systemd init vs systemd]
 
|}
 
|}
  
  
 
= INVESTIGATION 1: User/Group Management =
 
= INVESTIGATION 1: User/Group Management =
 +
 +
User account management is a very important operation that a Linux sysadmin does on a consistent basis. The sysadmin not only needs to add or remove user accounts by issuing commands, but may need to automate user account creations a large number (batch) of potential employees. There are many features with the Linux command to create new users including: specification of a home directory, type of shell used, name, password and time-limit (referred to as "aging") for a new user account. Remove user accounts also have options such as removing the user account but keeping the home directory for reference or evidence of "wrong-doing"
 +
 +
In your ULI101 course, you learned to change permissions for directories and files relating to user, same group members and other group members. In this course, since you are the sysadmin with root privileges, you can create or remove groups as well as change the ownership of directories and files! We will now learn to perform key user account management operations in this section.
  
 
== Part 1: The /etc/passwd file ==
 
== Part 1: The /etc/passwd file ==
Line 64: Line 75:
 
# Look at the <b><code><span style="color:#3366CC;font-size:1.2em;">/etc/passwd</span></code></b> file.
 
# Look at the <b><code><span style="color:#3366CC;font-size:1.2em;">/etc/passwd</span></code></b> file.
 
# Make note of the contents of that file.
 
# Make note of the contents of that file.
# Read about the file: http://linux.die.net/man/5/passwd  
+
# Read about the file: http://man7.org/linux/man-pages/man5/passwd.5.html
 
# Make sure you know what information each field contains.
 
# Make sure you know what information each field contains.
 
# Why do you think there are so many users?
 
# Why do you think there are so many users?
Line 76: Line 87:
  
  
#Perform this part in your centos1 VM.
+
#Perform this part in your '''centos1''' VM.
 
# Read the man page for the <b><code><span style="color:#3366CC;font-size:1.2em;">useradd</span></code></b> command.
 
# Read the man page for the <b><code><span style="color:#3366CC;font-size:1.2em;">useradd</span></code></b> command.
# Create a new user account for each of your pod mates, using their learn account name as a user name. Give each user a password.
+
# Create three fictitious users (make-up their userids and full names. Give each of these newly-created users a password.
 
# Grep the <b><code><span style="color:#3366CC;font-size:1.2em;">/etc/passwd</span></code></b> file for each of the new users.
 
# Grep the <b><code><span style="color:#3366CC;font-size:1.2em;">/etc/passwd</span></code></b> file for each of the new users.
#* What is the home directory of each user?
+
#* What is the '''home''' directory of each user?
#* What group is each user in?
+
#* What '''group''' is each user in?
#* What else do you know about each user?
+
#* What other information can you provide regarding these users?
#* Where are the passwords stored?
+
#* Where are the '''passwords''' stored?
# Look at the man page for /etc/shadow using the command man 5 shadow
+
# Look at the man page for '''/etc/shadow''' using the command: <b><code><span style="color:#3366CC;font-size:1.2em;">man 5 shadow</span></code></b>
 
#* Grep the <b><code><span style="color:#3366CC;font-size:1.2em;">/etc/shadow</span></code></b> file for each of the new users.
 
#* Grep the <b><code><span style="color:#3366CC;font-size:1.2em;">/etc/shadow</span></code></b> file for each of the new users.
 
#* Make note of this information.  
 
#* Make note of this information.  
Line 91: Line 102:
 
#* What files are there? Be sure to include hidden files.
 
#* What files are there? Be sure to include hidden files.
 
#* What do you think these files are used for?
 
#* What do you think these files are used for?
#* How does the operating system determine which files are created in a new home account? The answer can be found here: http://www.linuxhowtos.org/Tips%20and%20Tricks/using_skel.htm
+
#* How does the operating system determine which files are created in a new home account? The answer can be found here:<br>http://www.linuxhowtos.org/Tips%20and%20Tricks/using_skel.htm
 
#* Look at the files (including hidden files) in the template directory referred to in the article. Compare them to what is in a home directory for a new user. What do you notice?
 
#* Look at the files (including hidden files) in the template directory referred to in the article. Compare them to what is in a home directory for a new user. What do you notice?
 
#* Create a new file in this directory with the following command: <b><code><span style="color:#3366CC;font-size:1.2em;">touch foo</span></code></b>
 
#* Create a new file in this directory with the following command: <b><code><span style="color:#3366CC;font-size:1.2em;">touch foo</span></code></b>
Line 97: Line 108:
 
#* Look at the contents of foobar's home directory. What do you notice?
 
#* Look at the contents of foobar's home directory. What do you notice?
 
# Be sure to record your observations in your lab notes.
 
# Be sure to record your observations in your lab notes.
 
+
#Issue the man pages for the '''useradd''' command. Explain the purpose of using the '''-e''' option for the ''useradd'' command. Try to think what would be the purpose for a Linux sysadmin to use this option when creating new users.
#Perform this part in your centos3 VM.
 
# Add your matrix account user to '''centos3'''.
 
  
 
'''Answer the Part 2 observations / questions in your lab log book.'''
 
'''Answer the Part 2 observations / questions in your lab log book.'''
Line 105: Line 114:
 
== Part 3: Managing Groups ==
 
== Part 3: Managing Groups ==
  
#Perform this part in your centos1 VM.
+
#Remain in your '''centos1''' VM for this section.
 
# Read the man page for the <b><code><span style="color:#3366CC;font-size:1.2em;">groupadd</span></code></b> and <b><code><span style="color:#3366CC;font-size:1.2em;">groupdel</span></code></b> commands.
 
# Read the man page for the <b><code><span style="color:#3366CC;font-size:1.2em;">groupadd</span></code></b> and <b><code><span style="color:#3366CC;font-size:1.2em;">groupdel</span></code></b> commands.
# Note which option allows you to set the Group ID number (GID) when you create a new group.
+
# Note which option allows you to set the Group ID number ('''GID''') when you create a new group.
 
# Examine the file <b><code><span style="color:#3366CC;font-size:1.2em;">/etc/group</span></code></b>
 
# Examine the file <b><code><span style="color:#3366CC;font-size:1.2em;">/etc/group</span></code></b>
 
#* Which values of GID are reserved for system accounts?
 
#* Which values of GID are reserved for system accounts?
Line 114: Line 123:
 
#* What is the default group name of a new user?
 
#* What is the default group name of a new user?
 
#* Add a new group named <b><code><span style="color:#3366CC;font-size:1.2em;">ops235</span></code></b> with a GID of <b><code><span style="color:#3366CC;font-size:1.2em;">600</span></code></b>.
 
#* Add a new group named <b><code><span style="color:#3366CC;font-size:1.2em;">ops235</span></code></b> with a GID of <b><code><span style="color:#3366CC;font-size:1.2em;">600</span></code></b>.
#* You are angry at some irresponsible users on your system.
+
#* The management at your organization have concerns regarding some irresponsible users on your system.
#** Add a new group named idiots.
+
#** Add a new group named '''investigation'''.
#** Look at /etc/group and note the GID of idiots.
+
#** Look at '''/etc/group''' and note the GID of group called '''investigation'''.
#** What GID is given to a new group if if you do not specify it?
+
#** What GID is given to a new group if you do not specify it?
#** Your anger has subsided. Delete the <b><code><span style="color:#3366CC;font-size:1.2em;">idiots</span></code></b> group.
+
#** In the file, add those users to the end of the concerned group (separate each user-name with a comma).
#** Look at /etc/group again and note the change.
+
#** Those individuals have explained their actions to management and the crisis has been resolved. Delete the '''investigation''' group.
 +
#** Look at '''/etc/group''' again and note the change.
  
 
'''Answer the Part 3 observations / questions in your lab log book.'''
 
'''Answer the Part 3 observations / questions in your lab log book.'''
Line 125: Line 135:
 
== Part 4: Deleting / Modifying Users ==
 
== Part 4: Deleting / Modifying Users ==
  
#Perform this part in your centos1 VM.
+
#Remain in your '''centos1''' VM for this section.
# Read the man page for the <b><code><span style="color:#3366CC;font-size:1.2em;">userdel</span></code></b> command. Note which option automatically removes the users home directory when that user is deleted.
+
# Read the man page for the '''userdel''' command. Note which option automatically removes the users home directory when that user is deleted.
 
+
# Delete the user '''ops235_1''' using the command <b><code><span style="color:#3366CC;font-size:1.2em;">userdel ops235_1</span></code></b>
# Delete the user ops235_1 using the command <b><code><span style="color:#3366CC;font-size:1.2em;">userdel ops235_1</span></code></b>
+
# Delete the user '''ops235'''_2 using the same command with the option which removes the home directory of the user.
# Delete the user ops235_2 using the same command with the option which removes the home directory of the user.
 
 
# Check the contents of the /home directory. What do you notice?
 
# Check the contents of the /home directory. What do you notice?
 
# Check the contents of the <b><code><span style="color:#3366CC;font-size:1.2em;">/etc/group</span></code></b> file. What do you notice?
 
# Check the contents of the <b><code><span style="color:#3366CC;font-size:1.2em;">/etc/group</span></code></b> file. What do you notice?
 
# Read the man page for the usermod command. Note which options change the user's full name, primary group, supplementary groups, and shell.
 
# Read the man page for the usermod command. Note which options change the user's full name, primary group, supplementary groups, and shell.
 
+
# Create a new user account called '''noobie''' for the employee: '''"Really Green"''' . Assign a password for that newly created user.
 +
# Management has indicated that this employee be on on probation for 3 months. Use the '''usermod''' command to set the account for noobie to expire in 3 months from this day as part of the security policy of this organization.
 
# Add each of your new users to the group ops235 (in other words, add ops235 to each user as a supplementary group).
 
# Add each of your new users to the group ops235 (in other words, add ops235 to each user as a supplementary group).
 
# Examine <b><code><span style="color:#3366CC;font-size:1.2em;">/etc/group</span></code></b>. What has changed?
 
# Examine <b><code><span style="color:#3366CC;font-size:1.2em;">/etc/group</span></code></b>. What has changed?
# Use the usermod command to associate each of your pod mates' full name to their user name. With each change, examine their entries in the <b><code><span style="color:#3366CC;font-size:1.2em;">/etc/passwd</span></code></b> file. What has changed?
+
# Use the '''usermod''' command to change the full name of the user account '''noobie''' from '''"Really Green"''' to '''"Outstanding Employee"'''. Examine the result of running that command in the <b><code><span style="color:#3366CC;font-size:1.2em;">/etc/passwd</span></code></b> file. What has changed?
 +
# Use the '''usermod''' command to extend the use of their account for 5 years as of today.
 
# Be sure to record your observations in your lab notes.
 
# Be sure to record your observations in your lab notes.
  
 
'''Answer the Part 4 observations / questions in your lab log book.'''
 
'''Answer the Part 4 observations / questions in your lab log book.'''
  
=INVESTIGATION 2: Managing Run-Levels and System Services=
 
  
===Part 1: How do we Manage Runlevels?===
+
=INVESTIGATION 2: Managing System Services and Run-levels=
  
#Perform this part in both your centos2 and centos3 VMs.
+
Many students may think that the following topic is small and "not a big deal". Those students may say, '''"How hard is running and stopping services?"'''
The runlevel command is now deprecated in Fedora, and will likely be deprecated in RHEL/CentOS at some point as well, but for now this is what the industry is using.
 
  
 +
The process may not be hard, but knowing how to stop, start, restart and check the status of services is absolutely critical to a Linux server. '''Aside from learning to trouble-shoot problems''' by checking the status of running services, '''understanding how to manage services is critical to help protect a Linux server from penetration''' (this term is referred to as "'''Hardening a system'''"). Sometimes it is "what we don't know" that can harm us. One key element in hardening a computer system is to disable non essential networkng services to allow IDSs ('''Intrusion Detection Systems''') to focus on a narrower range of policy violations. A Debian-based penetration testing distribution called '''Kali''' (formerly referred to as '''"BackTrax"''') allows sysadmins and security professionals to identify vulnerabilities in their computer systems, and thus improve (harden) their systems against penetration. Learning to monitor the status, enable and disable networking services underlies the '''Backtrax''' motto:<br><br>'''''"The quieter you are, then more you will hear..."'''''<br><br>
 +
 +
=== Part 1: How do we Manage System Services? ===
 +
 +
We have seen that maintaining unneeded '''packages can be a security risk''' due to the unnecessary increase in the complexity of your system. Similarly, it is also unnecessarily hazardous, and even more so, to leave unneeded services running. In this investigation, we will learn how to '''control services, and turn off those services that we think are not necessary to help reduce security risks'''.
 +
 +
#Use your '''centos2''' VM for this part.
 
<ol>
 
<ol>
   <li value="2">Issue the following Linux command:
+
   <li value="2">Use the '''man''' pages to learn about the '''service''' command.</li><li>Issue the following Linux command:
 
       <ul>
 
       <ul>
         <li><b><code><span style="color:#3366CC;font-size:1.2em;">runlevel</span></code></b></li>
+
         <li><b><code><span style="color:#3366CC;font-size:1.2em;">service --status-all</span></code></b></li>
 
       </ul>
 
       </ul>
 
   </li>
 
   </li>
   <li>Note the difference in output between centos2 and centos3.</li>
+
   <li>Note the services that are currently running.</li>
   <li>You can use the <code>init</code> command to change the current runlevel. See a list of runlevels [https://www.centos.org/docs/5/html/5.2/Installation_Guide/s2-init-boot-shutdown-rl.html here]. Use the <code>man</code> command to learn how to use the <code></code>init command. Use this command to change the current runlevel in centos2 to 3. What happened? What happens after your reboot?</li>
+
   <li>Use the command <b><code><span style="color:#3366CC;font-size:1.2em;">service iptables stop</span></code></b> to stop the service named '''iptables'''</li>
  <li>Change the default runlevel on centos2 to 3. What happens now after you reboot?</li>
+
  <li>Run a command to verify that the '''iptables''' service has stopped.<br><br>'''NOTE:''' Although the service command seems to work, it is <u>'''deprecated'''</u> (i.e. "out-dated:). It has been replaced by using the [http://zenit.senecac.on.ca/wiki/index.php/Init_vs_systemd#systemd_Command_Usage systemctl] command. This is a command based upon a newer method of starting and managing system services called [http://zenit.senecac.on.ca/wiki/index.php/Init_vs_systemd systemd] (which replaces init - the "initialization table"). This method allows services to run more independently of each other, so that a service may be stopped without other dependent services to be stopped as well.<br><br>The most common '''systemctl''' commands are shown below (it is optional to include the filename extension '''.service''' after the service-name):<ul><li><span style="font-family:courier;font-size:1.2em;font-weight:bold;">'''systemctl list-units --all'''</span> &nbsp; (get a listing of all service names. Can pipe to grep to list service you are interested in)</li><li><span style="font-family:courier;font-size:1.2em;font-weight:bold;">'''systemctl status service-name'''</span> &nbsp; (Confirm status of a service - running or not-running)</li><li><span style="font-family:courier;font-size:1.2em;font-weight:bold;">'''systemctl stop service-name'''</span> &nbsp; (stop a service)</li><li><span style="font-family:courier;font-size:1.2em;font-weight:bold;">'''systemctl start service-name'''</span> &nbsp; (start a service)</li><li><span style="font-family:courier;font-size:1.2em;font-weight:bold;">'''systemctl restart service-name'''</span> &nbsp; (restart a service)</li><li><span style="font-family:courier;font-size:1.2em;font-weight:bold;">'''systemctl enable service-name'''</span> &nbsp; (enable service so service runs upon system startup)</li><li><span style="font-family:courier;font-size:1.2em;font-weight:bold;">'''systemctl disable service-name'''</span> &nbsp; (disable service so it does NOT run upon system startup)<br><br></li></ul></li>
  <li>Issue the following Linux command:
+
   <li>If you reboot now - the iptables service will be turned back on. We don't want it on though, it causes students headaches.<br>To turn it off permanently we need to use the '''systemctl''' command:<b><code><span style="color:#3366CC;font-size:1.2em;">systemctl disable iptables</span></code></b><br>(the '''chkconfig''' command used to be the way to enble/disable services, but is now deprecated).</li>
    <ul>
+
   <li>Use the '''systemctl''' command to verify that the '''iptables''' service is no longer running ('''hint:''' issue command, and pipe to grep "'''iptables'''").
      <li><b><code><span style="color:#3366CC;font-size:1.2em;">startx</span></code></b></li>
+
  <li>Reboot and confirm that it's no longer running.</li>
    </ul>
 
  </li>
 
  <li>What happens?</li>
 
   <li>Log-off your graphical system. You should return to your shell prompt.</li>
 
   <li>Change the default runlevel for centos2 back to 5 and reboot to make sure it works.</li>
 
 
</ol>
 
</ol>
  
 
'''Answer Part 1 observations / questions in your lab log book.'''
 
'''Answer Part 1 observations / questions in your lab log book.'''
  
=== Part 2: How do we Manage System Services? ===
+
===Part 2: How do we Manage Runlevels?===
 +
 
 +
Running servers in graphical mode will make your system most likely to be penetrated. The X-windows framework can be vulnerable to attacks when these servers are connected to the Internet. This is why when you install server versions of Linux, they work in text-based mode only. Desktop versions of Linux are then installed on workstations (working in graphical mode) that connect to the server (for security reasons).
 +
 
 +
The Linux sysadmin can also change the run-level (or state) of a graphical Linux server to run in text-based mode and run the graphical mode by issuing a command when graphic mode is required. The run-level term is now deprecated in Fedora, and will likely be deprecated in RHEL/CentOS at some point as well, but for now this is what the industry is using.
  
We have seen that maintaining unneeded '''packages can be a security risk''' due to the unnecessary increase in the complexity of your system. Similarly, it is also unnecessarily hazardous, and even more so, to leave unneeded services running. In this investigation, we will learn how to '''control services, and turn off those services that we think are not necessary to help reduce security risks'''.}}
 
  
#For this part, remain in your centos2 VM.
+
 
 +
#Perform this part in both your '''centos2''' and '''centos3''' VMs.
 
<ol>
 
<ol>
 
   <li value="2">Issue the following Linux command:
 
   <li value="2">Issue the following Linux command:
 
       <ul>
 
       <ul>
         <li><b><code><span style="color:#3366CC;font-size:1.2em;">service --status-all</span></code></b></li>
+
         <li><b><code><span style="color:#3366CC;font-size:1.2em;">runlevel</span></code></b></li>
 
       </ul>
 
       </ul>
 
   </li>
 
   </li>
   <li>Note the services that are currently running.</li>
+
   <li>Note the difference in output between '''centos2''' and '''centos3'''.</li>
   <li>Use the <b><code><span style="color:#3366CC;font-size:1.2em;">service</span></code></b> command to stop the service named '''iptables'''</li>
+
   <li>You can use the '''init''' command to change the current run-level. See a list of runlevels [https://www.centos.org/docs/5/html/5.2/Installation_Guide/s2-init-boot-shutdown-rl.html here].</li><li> Use the '''man''' command to learn how to use the '''init''' command. Use this command to change the current run-level in '''centos2''' to '''3'''. What happened?</li>
  <li>Issue the <b><code><span style="color:#3366CC;font-size:1.2em;">service</span></code></b> command to verify that this service has stopped.</li>
+
  <li>Issue the following Linux command:
   <li>If you reboot now - the iptables service will be turned back on. We don't want it on though, it causes students headaches. To turn it off permanently we need to use the chkconfig command: <b><code><span style="color:#3366CC;font-size:1.2em;">chkconfig iptables off</span></code></b></li>
+
    <ul>
   <li>Reboot and confirm that it's no longer running.</li>
+
      <li><b><code><span style="color:#3366CC;font-size:1.2em;">startx</span></code></b></li>
 +
    </ul>
 +
  </li>
 +
  <li>What happens?</li>
 +
   <li>Log-off your graphical system. You should return to your shell prompt.</li>
 +
  <li>Using systemd requires a different method of setting text mode and graphical mode. You can refer to this link for future reference:  
 +
[http://fedoraproject.org/wiki/Systemd#How_do_I_change_the_runlevel.3F How to Change Run-Levels with Systemd]</li><li>Restart your centos2 machine, and make certain that it runs in '''graphical''' mode</li>
 +
   </li>Why would you want to make a graphical Linux system run in text-based mode?</li>
 
</ol>
 
</ol>
 +
  
 
'''Answer Part 2 observations / questions in your lab log book.'''
 
'''Answer Part 2 observations / questions in your lab log book.'''
Line 196: Line 219:
 
|- valign="top"
 
|- valign="top"
 
|
 
|
{{Admon/tip|Bash Shell Scripting Tips:|<br><ul><li>'''The case statement:'''<br><br>The case statement is a control-flow statement that works in a similar way as the if-elif-else statement (but is more concise). This statement presents scenerios or "cases" based on values or regular expressions (not ranges of values like if-elif-else statements). After action(s) are taken for a particular scenerio (or "case"), a break statement (''';;''') is used to "break-out" of the statement (and not perform other actions). A default case (*) is also used to catch exceptions.<br><br><u>'''Examples (try in shell script):'''</u><br><br>''read -p "pick a door (1 or 2): " pick<br>case $pick in<br>&nbsp; 1) echo "You win a car!" ;;<br>&nbsp; 2) echo "You win a bag of dirt!" ;;<br>&nbsp; *) echo "Not a valid entry"<br>&nbsp;&nbsp;&nbsp;&nbsp; exit 1 ;;<br>esac''<br><br>''read -p "enter a single digit: " digit<br>case $digit in<br>&nbsp; [0-9]) echo "Your single digit is: $digit" ;;<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;  *)&nbsp;echo "not a valid single digit"<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;  exit 1 ;;<br>esac''<br><br></li><li>'''The getopts function:'''<br><br></li></ul>The getopts function allows the shell scripter to create scripts that accept options (like options for Linux commands). This provides the Linux administrator with scripts that provide more flexibility and versatility. A built-in function called '''getopts''' (i.e. get command options) is used in conjunction with a '''while''' loop and a '''case''' statement to carry out actions based on if certain options are present when the shell script is run. The variable '''$OPTARG''' can be used if an option accepts text (denoted in the getopts function with an option letter followed by a colon. Case statement exceptions use the ''':)''' and '''\?)''' cases for error handling.<br><br>'''<u>Example of getopts</u>''' (try in script and run with options)<br><br>''while getopts abc: name<br>do<br>&nbsp; case $name in<br>&nbsp; &nbsp; a) echo "Action for option \"a\"" ;;<br>&nbsp; &nbsp; b) echo "Action for option \"b\"" ;;<br>&nbsp; &nbsp; c) echo "Action for option \"c\""<br>&nbsp; &nbsp; &nbsp; &nbsp; echo Value is: $OPTARG" ;;<br>&nbsp; &nbsp; :) echo "Error: You need text after -c option"<br>&nbsp; &nbsp; &nbsp; &nbsp; exit 1 ;;<br>&nbsp; &nbsp; \?) echo "Error: Incorrect option"<br>&nbsp; &nbsp; &nbsp; &nbsp; exit 1 ;;<br>esac''<br><br>}}
+
{{Admon/tip|Bash Shell Scripting Tips:|<br><ul><li>'''The case statement:'''<br><br>The case statement is a control-flow statement that works in a similar way as the if-elif-else statement (but is more concise). This statement presents scenerios or "cases" based on values or regular expressions (not ranges of values like if-elif-else statements). After action(s) are taken for a particular scenerio (or "case"), a break statement (''';;''') is used to "break-out" of the statement (and not perform other actions). A default case (*) is also used to catch exceptions.<br><br><u>'''Examples (try in shell script):'''</u><br><br>''read -p "pick a door (1 or 2): " pick<br>case $pick in<br>&nbsp; 1) echo "You win a car!" ;;<br>&nbsp; 2) echo "You win a bag of dirt!" ;;<br>&nbsp; *) echo "Not a valid entry"<br>&nbsp;&nbsp;&nbsp;&nbsp; exit 1 ;;<br>esac''<br><br>''read -p "enter a single digit: " digit<br>case $digit in<br>&nbsp; [0-9]) echo "Your single digit is: $digit" ;;<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;  *)&nbsp;echo "not a valid single digit"<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;  exit 1 ;;<br>esac''<br><br></li><li>'''The getopts function:'''<br><br></li></ul>The getopts function allows the shell scripter to create scripts that accept options (like options for Linux commands). This provides the Linux administrator with scripts that provide more flexibility and versatility. A built-in function called '''getopts''' (i.e. get command options) is used in conjunction with a '''while''' loop and a '''case''' statement to carry out actions based on if certain options are present when the shell script is run. The variable '''$OPTARG''' can be used if an option accepts text (denoted in the getopts function with an option letter followed by a colon. Case statement exceptions use the ''':)''' and '''\?)''' cases for error handling.<br><br>'''<u>Example of getopts</u>''' (try in script and run with options)<br><br>''while getopts abc: name<br>do<br>&nbsp; case $name in<br>&nbsp; &nbsp; a) echo "Action for option \"a\"" ;;<br>&nbsp; &nbsp; b) echo "Action for option \"b\"" ;;<br>&nbsp; &nbsp; c) echo "Action for option \"c\""<br>&nbsp; &nbsp; &nbsp; &nbsp; echo Value is: $OPTARG" ;;<br>&nbsp; &nbsp; :) echo "Error: You need text after -c option"<br>&nbsp; &nbsp; &nbsp; &nbsp; exit 1 ;;<br>&nbsp; &nbsp; \?) echo "Error: Incorrect option"<br>&nbsp; &nbsp; &nbsp; &nbsp; exit 1 ;;<br>esac''<br>done<br><br>}}
 
|}
 
|}
  
Line 202: Line 225:
  
  
#Use the <b><code>wget</code></b> command to download, study, and run the following shell scripts on-line:<blockquote><b><code><span style=" pointer-events:none;cursor:default;color:#3366CC;font-size:1.2em;">https://scs.senecac.on.ca/~murray.saul/user-create.bash</span></code></b>
+
#You will be using your '''c7host''' machine for this section.
 +
#Download, study, and run the following shell script. Issue the command:<br><b><code><span style=" pointer-events:none;cursor:default;color:#3366CC;font-size:1.2em;">wget https://scs.senecac.on.ca/~murray.saul/user-create.bash</span></code></b>
 
#Try to understand what these Bash Shell scripts do, and then run the script as root. After running the shell script, view the contents of the '''/home''' directory to confirm.
 
#Try to understand what these Bash Shell scripts do, and then run the script as root. After running the shell script, view the contents of the '''/home''' directory to confirm.
  
Line 209: Line 233:
  
  
<ol><li value="3">Open a Bash shell terminal and login as root.</li><li>Use the wget command to download the input file called user-data.txt</li><li>View the contents on the user-data.txt file to confirm there are 3 fields (username, fullname, and e-mail address).<li><li>Use a text editor (such as <b><code><span style="color:#3366CC;font-size:1.2em;">vi</span></code></b> or <b><code><span style="color:#3366CC;font-size:1.2em;">nano</span></code></b>) to create a Bash Shell script called: <b><code><span style="color:#3366CC;font-size:1.2em;">createUsers.bash</span></code></b> in /root's home directory.</li><li>Enter the following text content into your text-editing session:</li></ol>
+
<ol><li value="3">Open a Bash shell terminal and login as root.</li><li>Use the wget command to download the input file called user-data.txt by issuing the command:<br><b><code><span style="color:#3366CC;font-size:1.2em;">wget https://scs.senecac.on.ca/~murray.saul/user-data.txt</span></code></b></li><li>View the contents on the user-data.txt file to confirm there are 3 fields (username, fullname, and e-mail address)which are separated by the colon (:) symbol.<li><li>Use a text editor (such as <b><code><span style="color:#3366CC;font-size:1.2em;">vi</span></code></b> or <b><code><span style="color:#3366CC;font-size:1.2em;">nano</span></code></b>) to create a Bash Shell script called: <b><code><span style="color:#3366CC;font-size:1.2em;">createUsers.bash</span></code></b> in /root's home directory.</li><li>Enter the following text content into your text-editing session:</li></ol>
 
<code style="color:#3366CC;font-family:courier;font-size:.9em;margin-left:20px;">
 
<code style="color:#3366CC;font-family:courier;font-size:.9em;margin-left:20px;">
 
<br>
 
<br>
::&#35;!/bin/bash  
+
&#35;!/bin/bash <br>
::
 
::
 
::&#35; createUsers.bash
 
::&#35; Purpose: Generates a batch of user accounts (user data stored in a text file)
 
::&#35;<br>&#35; USAGE:
 
::&#35;<br>&#35; /root/createUsers.bash [-i {input-path}] [-n {full name}] [-a {aging}] [-g {add to group}] [-o {output-path}]
 
::&#35;
 
::&#35; Author: *** INSERT YOUR NAME ***
 
::&#35; Date:  *** CURRENT DATE ***
 
 
<br>
 
<br>
::if [ $HOME != "root" ]  # only runs if logged in as root
+
&#35; createUsers.bash<br>
::then<br>&nbsp;echo "You must be logged in as root." >&2
+
&#35; Purpose: Generates a batch of user accounts (user data stored in a text file)<br>
::&nbsp;exit 1
+
&#35;<br>&#35; USAGE: /root/createUsers.bash [-i {input-path}] <br>
::fi
+
&#35;<br>
 +
&#35; Author: *** INSERT YOUR NAME ***<br>
 +
&#35; Date:  *** CURRENT DATE ***<br>
 +
<br>
 +
if [ $PWD != "/root" ]  # only runs if in root's home directory<br>
 +
then<br>&nbsp;echo "You must be in root's home directory." >&2<br>
 +
&nbsp;exit 1<br>
 +
fi<br>
 +
if [ "$#" -eq 0 ] #  if no arguments after command<br>
 +
then<br>
 +
&nbsp;echo "You must enter an argument" >&2<br>
 +
&nbsp;echo "USAGE: $0 [-i {input-path}]" >&2<br>
 +
&nbsp;exit 2<br>
 +
fi<br>
 
</code>
 
</code>
 
<br>
 
<br>
Line 232: Line 260:
 
<br>
 
<br>
 
<code style="color:#3366CC;font-family:courier;font-size:.9em;">
 
<code style="color:#3366CC;font-family:courier;font-size:.9em;">
 
+
<br>
::outputFlag="n"<br>
+
outputFlag="n"<br>
::while getopts i:n:a:g:o: name
+
while getopts i: name<br>
::do
+
do<br>
:: &nbsp;case $name in
+
&nbsp;case $name in<br>
:: &nbsp; &nbsp;i) inputFile=$OPTARG ;;
+
&nbsp; &nbsp;i) inputFile=$OPTARG ;;<br>
:: &nbsp; &nbsp;:) echo "Error: You need text after options requiring text"
+
&nbsp; &nbsp;:) echo "Error: You need text after options requiring text"<br>
:: &nbsp; &nbsp; &nbsp; &nbsp;exit 1 ;;
+
&nbsp; &nbsp; &nbsp; &nbsp;exit 1 ;;<br>
:: &nbsp; &nbsp;\?) echo "Error: Incorrect option"
+
&nbsp; &nbsp;\?) echo "Error: Incorrect option"<br>
:: &nbsp; &nbsp; &nbsp; &nbsp; exit 1 ;;
+
&nbsp; &nbsp; &nbsp; &nbsp; exit 1 ;;<br>
:: &nbsp;esac
+
&nbsp;esac<br>
 +
done<br>
 
</code>
 
</code>
<ol><li value="6">Save your editing session, but remain in the text editor.</li><li>The code displayed below uses a trick called the "Here Document" to redirect stdin from within the command (a quick way to display output on the screen). The read command will store the different information report items as words (separated by a space). The sed command used to convert the spaces to pipes (|) and stored into another variable. This allows the sed command to use extended regular expressions to print rpm elements that match those various patterns to be added to the report. Add the following code</li></ol>
+
<ol><li value="6">Save your editing session, but remain in the text editor.</li><li>The code displayed below uses logic to exit the script if the input file does not exist. Command substitution is used to store each line of the input file as a positional parameter. There is one subtle problem here: The full names of the users contain spaces which can create havoc when trying to set each line as a separate positional parameter. In this case the sed command is used to convert spaces to plus signs (+), which will be converted back later. Finally, a '''for''' loop is used to create each account ('''useradd''') and mail the user their account information ('''mail'''). Add the following code:</li></ol>
 
<br>
 
<br>
 
<code style="color:#3366CC;font-family:courier;font-size:.9em;">
 
<code style="color:#3366CC;font-family:courier;font-size:.9em;">
::&#35; Clear screen and use Here Document to display select on report items to read into variable<br><br>
+
<br>
::cat &lt;&lt;+
+
if [ ! -f $inputFile ]<br>
::Available Package Information Items:
+
then<br>
 
+
&nbsp; echo "The file pathname \"$inputFile\" is empty or does not exist" >&2<br>
::Name
+
&nbsp; exit 2<br>
::Summary
+
fi<br>
::Version
+
<br>
::License
+
set $(sed 's/ /+/g' $inputFile) # temporarily convert spaces to + for storing lines as positional parameters<br>
::Source
+
<br>
::URL
+
for x<br>
::+
+
do<br>
::read -p "Enter word(s) shown above separated by spaces: " choice<br><br>
+
&nbsp; &nbsp; userPassWd=$(date | md5sum | cut -d" " -f1)<br>
::&#35; Convert spaces to pipe symbol (|)
+
&nbsp; &nbsp; useradd -m -c "$(echo $x | cut -d":" -f2 | sed 's/+/ /g')" -p $userPassWd $(echo $x | cut -d":" -f1)<br>
::processedChoice=$(echo $choice | sed 's/ /|/g')<br><br>
+
&nbsp; &nbsp; mail -s "Server Account Information" $(echo $x | cut -d":" -f3) <<+<br>
::&#35; Use sed with extended regular expressions to only print those matching report elements
+
&nbsp; &nbsp; Here is your server account information:<br>
::rpm -qi $1 | sed -r -n "/($processedChoice)/ p" &gt;&gt; /root/package-info.txt<br><br>
+
&nbsp; &nbsp; servername: myserver.senecac.on.ca<br>
::cat &lt;&lt;+
+
&nbsp; &nbsp; username:   $(echo $x | cut -d":" -f1)<br>
::File "/root/package-info.txt" can been created
+
&nbsp; &nbsp; password: $userPassWd<br>
::+
+
&nbsp; &nbsp; Regards,<br>
 +
&nbsp; &nbsp; IT Department<br>
 +
+<br>
 +
done<br>
 +
<br>
 +
echo -e "\n\nAccounts have been created\n\n"<br>
 +
exit 0<br>
 
</code>
 
</code>
  
 
<ol>
 
<ol>
<li value="8">Save, set permissions, and then run that shell script for the application '''gedit'''. Did it create that report? Try running the script without an argument - What did it do? <li>Use the <b><code>wget</code></b> command to download, study, and run the following shell scripts on-line:<blockquote><b><code><span style=" pointer-events:none;cursor:default;color:#3366CC;font-size:1.2em;">https://scs.senecac.on.ca/~murray.saul/packageInfoGraphical.bash</span></code></b></blockquote></li><li>Try to understand what this Bash Shell script does.</li><li>#You have completed lab3. Proceed to Completing The Lab, and follow the instructions for "lab sign-off".</li></ol>
+
<li value="8">Save, set permissions, and then run that shell script for the input text file '''user-data.txt'''. Did it work? Try running the script without an argument - What did it do? </li><li>You have completed lab4. Proceed to Completing The Lab, and follow the instructions for "lab sign-off".</li></ol>
  
 
'''Answer Investigation 3 observations / questions in your lab log book.'''
 
'''Answer Investigation 3 observations / questions in your lab log book.'''
  
 
= LAB 4 SIGN-OFF (SHOW INSTRUCTOR) =
 
= LAB 4 SIGN-OFF (SHOW INSTRUCTOR) =
{{Admon/important|Time for a new backup!|If you have successfully completed this lab, make a new backup of your virtual machines. Remember to also make a backup of the new second virtual disk drive on ''centos1'' -- you now have two virtual disks on ''centos1'', and therefore two image files, and therefore will need two backup files.}}
+
{{Admon/important|If you have successfully completed this lab, make a new backup of your virtual machines as well as your host machine.|}}
  
 
'''Arrange proof of the following on the screen:'''
 
'''Arrange proof of the following on the screen:'''
  
::<span style="color:green;font-size:1.5em;">&#x2713;</span> Account created on '''centos3''' matching your Matrix account.
+
<ol><li><span style="color:green;font-size:1.5em;">&#x2713;</span> '''centos1''' VM:<blockquote><ul><li>Account created on '''centos1''' VM</li><li> List contents of '''/etc/group''' file (ops235 group)</li><li>List contents of '''/etc/passwd''' file (created accounts)</li></ul></blockquote><li><span style="color:green;font-size:1.5em;">&#x2713;</span> '''centos2''' VM:<blockquote><ul><li>Display current run-level status on '''centos2''' VM</li></ul></blockquote></li></li><li><span style="color:green;font-size:1.5em;">&#x2713;</span>'''c7host''' machine<blockquote><ul><li>Creation of your bash shell script called '''createUsers.bash'''</li></ul></blockquote></li><li><span style="color:green;font-size:1.5em;">&#x2713;</span> '''Lab4''' log-book filled out.</li></ol>
::<span style="color:green;font-size:1.5em;">&#x2713;</span> List contents of '''/etc/group''' file (ops235 group).
 
::<span style="color:green;font-size:1.5em;">&#x2713;</span> List contents of '''/etc/passwd''' file (created accounts).
 
::<span style="color:green;font-size:1.5em;">&#x2713;</span> Fresh backup of the virtual machines.
 
  
= Preparing for the Quizzes =
 
  
 +
== Practice For Quizzes, Tests, Midterm &amp; Final Exam ==
  
 +
# Describe all of the field in <code>'''/etc/passwd'''</code>
 +
# What is the command to create a user? What option to create a home directory for that user?
 +
# What is the command to change the full name of an already-created user?
 +
# What is the command to delete a user account? What option allows for the user's home directory to be removed as well?
 +
# What is the command to create a group? What is the command (or steps) to include a user in a newly-created group?
 +
# What is the purpose of <code>'''/etc/shadow'''</code>?
 +
# What is the purpose of <code>'''/etc/skel'''</code>?
 +
# What does the term run-level mean?
 +
# How to set the run-level of a Linux system to text-based only? How to set to graphical mode?
 +
# What is the command to view the status of running services?
 +
# What is the command to start a service (like httpd, or sshd)?
 +
# What is the command to start a service?
 +
# Can a service be stopped and started by issuing just one command?
  
 
[[Category:OPS235]]
 
[[Category:OPS235]]
 
[[Category:OPS235 Labs]]
 
[[Category:OPS235 Labs]]

Latest revision as of 11:31, 24 September 2018

Stop (medium size).png
THIS IS AN OLD VERSION OF THE LAB
This is an archived version. Do not use this in your OPS235 course.

LAB PREPARATION

Purpose / Objectives of Lab 4

System administrators are required to add, remove and modify user accounts.
In order to perform maintenance, system administrators need to know how to stop and start services for a Linux system.


There are many other tasks that a Linux system administrator must perform other than installing Linux and installing software.

A few additional tasks are user management and managing services.


Main Objectives:

  • Administer (add, remove, modify) users on a Linux system.
  • Save time while adding new users using a template of start-up files.
  • Create and manage groups on a Linux system.
  • Start and Stop services on a Linux system.
  • Display the status of running services on a Linux system.


Minimum Required Materials

Removable Hard Disk Pack (SATA)
USB key
(for backups)
Lab4 Log Book

My Toolkit (CLI Reference)

User Management:

useradd
userdel
usermod
groupadd
groupdel

Managing Services

chkconfig
service
systemctl

Miscellaneous

/etc/passwd
/etc/group
/etc/shadow
/etc/skel
init vs systemd


INVESTIGATION 1: User/Group Management

User account management is a very important operation that a Linux sysadmin does on a consistent basis. The sysadmin not only needs to add or remove user accounts by issuing commands, but may need to automate user account creations a large number (batch) of potential employees. There are many features with the Linux command to create new users including: specification of a home directory, type of shell used, name, password and time-limit (referred to as "aging") for a new user account. Remove user accounts also have options such as removing the user account but keeping the home directory for reference or evidence of "wrong-doing"

In your ULI101 course, you learned to change permissions for directories and files relating to user, same group members and other group members. In this course, since you are the sysadmin with root privileges, you can create or remove groups as well as change the ownership of directories and files! We will now learn to perform key user account management operations in this section.

Part 1: The /etc/passwd file

  1. Look at the /etc/passwd file.
  2. Make note of the contents of that file.
  3. Read about the file: http://man7.org/linux/man-pages/man5/passwd.5.html
  4. Make sure you know what information each field contains.
  5. Why do you think there are so many users?
  6. Look at the names of the users. What do you think these user names represent? Are they people?
  7. What is the numeric user ID (UID) of the root user?
  8. The user IDs of real users (people) are different from the user IDs of system accounts. What is the pattern?

Answer the Part 1 observations / questions in your lab log book.

Part 2: Adding users

  1. Perform this part in your centos1 VM.
  2. Read the man page for the useradd command.
  3. Create three fictitious users (make-up their userids and full names. Give each of these newly-created users a password.
  4. Grep the /etc/passwd file for each of the new users.
    • What is the home directory of each user?
    • What group is each user in?
    • What other information can you provide regarding these users?
    • Where are the passwords stored?
  5. Look at the man page for /etc/shadow using the command: man 5 shadow
    • Grep the /etc/shadow file for each of the new users.
    • Make note of this information.
  6. Create two new dummy users, ops235_1 and ops235_2.
  7. Investigate the home directory of one of your new users.
    • What files are there? Be sure to include hidden files.
    • What do you think these files are used for?
    • How does the operating system determine which files are created in a new home account? The answer can be found here:
      http://www.linuxhowtos.org/Tips%20and%20Tricks/using_skel.htm
    • Look at the files (including hidden files) in the template directory referred to in the article. Compare them to what is in a home directory for a new user. What do you notice?
    • Create a new file in this directory with the following command: touch foo
    • Create a new user named foobar, with the option to automatically create a home directory.
    • Look at the contents of foobar's home directory. What do you notice?
  8. Be sure to record your observations in your lab notes.
  9. Issue the man pages for the useradd command. Explain the purpose of using the -e option for the useradd command. Try to think what would be the purpose for a Linux sysadmin to use this option when creating new users.

Answer the Part 2 observations / questions in your lab log book.

Part 3: Managing Groups

  1. Remain in your centos1 VM for this section.
  2. Read the man page for the groupadd and groupdel commands.
  3. Note which option allows you to set the Group ID number (GID) when you create a new group.
  4. Examine the file /etc/group
    • Which values of GID are reserved for system accounts?
    • Which values of GID are reserved for non-system user accounts?
    • What is the lowest available GID number for non-system users?
    • What is the default group name of a new user?
    • Add a new group named ops235 with a GID of 600.
    • The management at your organization have concerns regarding some irresponsible users on your system.
      • Add a new group named investigation.
      • Look at /etc/group and note the GID of group called investigation.
      • What GID is given to a new group if you do not specify it?
      • In the file, add those users to the end of the concerned group (separate each user-name with a comma).
      • Those individuals have explained their actions to management and the crisis has been resolved. Delete the investigation group.
      • Look at /etc/group again and note the change.

Answer the Part 3 observations / questions in your lab log book.

Part 4: Deleting / Modifying Users

  1. Remain in your centos1 VM for this section.
  2. Read the man page for the userdel command. Note which option automatically removes the users home directory when that user is deleted.
  3. Delete the user ops235_1 using the command userdel ops235_1
  4. Delete the user ops235_2 using the same command with the option which removes the home directory of the user.
  5. Check the contents of the /home directory. What do you notice?
  6. Check the contents of the /etc/group file. What do you notice?
  7. Read the man page for the usermod command. Note which options change the user's full name, primary group, supplementary groups, and shell.
  8. Create a new user account called noobie for the employee: "Really Green" . Assign a password for that newly created user.
  9. Management has indicated that this employee be on on probation for 3 months. Use the usermod command to set the account for noobie to expire in 3 months from this day as part of the security policy of this organization.
  10. Add each of your new users to the group ops235 (in other words, add ops235 to each user as a supplementary group).
  11. Examine /etc/group. What has changed?
  12. Use the usermod command to change the full name of the user account noobie from "Really Green" to "Outstanding Employee". Examine the result of running that command in the /etc/passwd file. What has changed?
  13. Use the usermod command to extend the use of their account for 5 years as of today.
  14. Be sure to record your observations in your lab notes.

Answer the Part 4 observations / questions in your lab log book.


INVESTIGATION 2: Managing System Services and Run-levels

Many students may think that the following topic is small and "not a big deal". Those students may say, "How hard is running and stopping services?"

The process may not be hard, but knowing how to stop, start, restart and check the status of services is absolutely critical to a Linux server. Aside from learning to trouble-shoot problems by checking the status of running services, understanding how to manage services is critical to help protect a Linux server from penetration (this term is referred to as "Hardening a system"). Sometimes it is "what we don't know" that can harm us. One key element in hardening a computer system is to disable non essential networkng services to allow IDSs (Intrusion Detection Systems) to focus on a narrower range of policy violations. A Debian-based penetration testing distribution called Kali (formerly referred to as "BackTrax") allows sysadmins and security professionals to identify vulnerabilities in their computer systems, and thus improve (harden) their systems against penetration. Learning to monitor the status, enable and disable networking services underlies the Backtrax motto:

"The quieter you are, then more you will hear..."

Part 1: How do we Manage System Services?

We have seen that maintaining unneeded packages can be a security risk due to the unnecessary increase in the complexity of your system. Similarly, it is also unnecessarily hazardous, and even more so, to leave unneeded services running. In this investigation, we will learn how to control services, and turn off those services that we think are not necessary to help reduce security risks.

  1. Use your centos2 VM for this part.
  1. Use the man pages to learn about the service command.
  2. Issue the following Linux command:
    • service --status-all
  3. Note the services that are currently running.
  4. Use the command service iptables stop to stop the service named iptables
  5. Run a command to verify that the iptables service has stopped.

    NOTE: Although the service command seems to work, it is deprecated (i.e. "out-dated:). It has been replaced by using the systemctl command. This is a command based upon a newer method of starting and managing system services called systemd (which replaces init - the "initialization table"). This method allows services to run more independently of each other, so that a service may be stopped without other dependent services to be stopped as well.

    The most common systemctl commands are shown below (it is optional to include the filename extension .service after the service-name):
    • systemctl list-units --all   (get a listing of all service names. Can pipe to grep to list service you are interested in)
    • systemctl status service-name   (Confirm status of a service - running or not-running)
    • systemctl stop service-name   (stop a service)
    • systemctl start service-name   (start a service)
    • systemctl restart service-name   (restart a service)
    • systemctl enable service-name   (enable service so service runs upon system startup)
    • systemctl disable service-name   (disable service so it does NOT run upon system startup)

  6. If you reboot now - the iptables service will be turned back on. We don't want it on though, it causes students headaches.
    To turn it off permanently we need to use the systemctl command:systemctl disable iptables
    (the chkconfig command used to be the way to enble/disable services, but is now deprecated).
  7. Use the systemctl command to verify that the iptables service is no longer running (hint: issue command, and pipe to grep "iptables").
  8. Reboot and confirm that it's no longer running.

Answer Part 1 observations / questions in your lab log book.

Part 2: How do we Manage Runlevels?

Running servers in graphical mode will make your system most likely to be penetrated. The X-windows framework can be vulnerable to attacks when these servers are connected to the Internet. This is why when you install server versions of Linux, they work in text-based mode only. Desktop versions of Linux are then installed on workstations (working in graphical mode) that connect to the server (for security reasons).

The Linux sysadmin can also change the run-level (or state) of a graphical Linux server to run in text-based mode and run the graphical mode by issuing a command when graphic mode is required. The run-level term is now deprecated in Fedora, and will likely be deprecated in RHEL/CentOS at some point as well, but for now this is what the industry is using.


  1. Perform this part in both your centos2 and centos3 VMs.
  1. Issue the following Linux command:
    • runlevel
  2. Note the difference in output between centos2 and centos3.
  3. You can use the init command to change the current run-level. See a list of runlevels here.
  4. Use the man command to learn how to use the init command. Use this command to change the current run-level in centos2 to 3. What happened?
  5. Issue the following Linux command:
    • startx
  6. What happens?
  7. Log-off your graphical system. You should return to your shell prompt.
  8. Using systemd requires a different method of setting text mode and graphical mode. You can refer to this link for future reference: How to Change Run-Levels with Systemd
  9. Restart your centos2 machine, and make certain that it runs in graphical mode
  10. Why would you want to make a graphical Linux system run in text-based mode?


Answer Part 2 observations / questions in your lab log book.


INVESTIGATION 3: LOOKING AHEAD

Automating Routine Tasks (Shell Scripting)

Idea.png
Bash Shell Scripting Tips:

  • The case statement:

    The case statement is a control-flow statement that works in a similar way as the if-elif-else statement (but is more concise). This statement presents scenerios or "cases" based on values or regular expressions (not ranges of values like if-elif-else statements). After action(s) are taken for a particular scenerio (or "case"), a break statement (;;) is used to "break-out" of the statement (and not perform other actions). A default case (*) is also used to catch exceptions.

    Examples (try in shell script):

    read -p "pick a door (1 or 2): " pick
    case $pick in
      1) echo "You win a car!" ;;
      2) echo "You win a bag of dirt!" ;;
      *) echo "Not a valid entry"
         exit 1 ;;
    esac


    read -p "enter a single digit: " digit
    case $digit in
      [0-9]) echo "Your single digit is: $digit" ;;
             *) echo "not a valid single digit"
                 exit 1 ;;
    esac


  • The getopts function:

The getopts function allows the shell scripter to create scripts that accept options (like options for Linux commands). This provides the Linux administrator with scripts that provide more flexibility and versatility. A built-in function called getopts (i.e. get command options) is used in conjunction with a while loop and a case statement to carry out actions based on if certain options are present when the shell script is run. The variable $OPTARG can be used if an option accepts text (denoted in the getopts function with an option letter followed by a colon. Case statement exceptions use the :) and \?) cases for error handling.

Example of getopts (try in script and run with options)

while getopts abc: name
do
  case $name in
    a) echo "Action for option \"a\"" ;;
    b) echo "Action for option \"b\"" ;;
    c) echo "Action for option \"c\""
        echo Value is: $OPTARG" ;;
    :) echo "Error: You need text after -c option"
        exit 1 ;;
    \?) echo "Error: Incorrect option"
        exit 1 ;;
esac

done

We will now use shell scripting to help automate the task for a Linux adminstrator to create regular user accounts.


  1. You will be using your c7host machine for this section.
  2. Download, study, and run the following shell script. Issue the command:
    wget https://scs.senecac.on.ca/~murray.saul/user-create.bash
  3. Try to understand what these Bash Shell scripts do, and then run the script as root. After running the shell script, view the contents of the /home directory to confirm.


Although the zenity command is a "user-friendly" way to run shell scripts, Linux administrators usually create shell scripts that resemble common Linux commands. In this lab, you will learn to create a shell script using the getopts function to make your shell script behave more like actual Linux commands (including the use of options). Refer to the notes section on the right-hand-side for reference about the case statement and the getopts function.


  1. Open a Bash shell terminal and login as root.
  2. Use the wget command to download the input file called user-data.txt by issuing the command:
    wget https://scs.senecac.on.ca/~murray.saul/user-data.txt
  3. View the contents on the user-data.txt file to confirm there are 3 fields (username, fullname, and e-mail address)which are separated by the colon (:) symbol.
  4. Use a text editor (such as vi or nano) to create a Bash Shell script called: createUsers.bash in /root's home directory.
  5. Enter the following text content into your text-editing session:


#!/bin/bash

# createUsers.bash
# Purpose: Generates a batch of user accounts (user data stored in a text file)
#
# USAGE: /root/createUsers.bash [-i {input-path}]
#
# Author: *** INSERT YOUR NAME ***
# Date: *** CURRENT DATE ***

if [ $PWD != "/root" ] # only runs if in root's home directory
then
 echo "You must be in root's home directory." >&2
 exit 1
fi
if [ "$#" -eq 0 ] # if no arguments after command
then
 echo "You must enter an argument" >&2
 echo "USAGE: $0 [-i {input-path}]" >&2
 exit 2
fi

  1. Save your editing session, but remain in the text editor.
  2. The code displayed below uses the getopt function set the input file pathname or check for invalid options or missing option text. Add the following code



outputFlag="n"
while getopts i: name
do
 case $name in
   i) inputFile=$OPTARG ;;
   :) echo "Error: You need text after options requiring text"
       exit 1 ;;
   \?) echo "Error: Incorrect option"
        exit 1 ;;
 esac
done

  1. Save your editing session, but remain in the text editor.
  2. The code displayed below uses logic to exit the script if the input file does not exist. Command substitution is used to store each line of the input file as a positional parameter. There is one subtle problem here: The full names of the users contain spaces which can create havoc when trying to set each line as a separate positional parameter. In this case the sed command is used to convert spaces to plus signs (+), which will be converted back later. Finally, a for loop is used to create each account (useradd) and mail the user their account information (mail). Add the following code:



if [ ! -f $inputFile ]
then
  echo "The file pathname \"$inputFile\" is empty or does not exist" >&2
  exit 2
fi

set $(sed 's/ /+/g' $inputFile) # temporarily convert spaces to + for storing lines as positional parameters

for x
do
    userPassWd=$(date | md5sum | cut -d" " -f1)
    useradd -m -c "$(echo $x | cut -d":" -f2 | sed 's/+/ /g')" -p $userPassWd $(echo $x | cut -d":" -f1)
    mail -s "Server Account Information" $(echo $x | cut -d":" -f3) <<+
    Here is your server account information:
    servername: myserver.senecac.on.ca
    username: $(echo $x | cut -d":" -f1)
    password: $userPassWd
    Regards,
    IT Department
+
done

echo -e "\n\nAccounts have been created\n\n"
exit 0

  1. Save, set permissions, and then run that shell script for the input text file user-data.txt. Did it work? Try running the script without an argument - What did it do?
  2. You have completed lab4. Proceed to Completing The Lab, and follow the instructions for "lab sign-off".

Answer Investigation 3 observations / questions in your lab log book.

LAB 4 SIGN-OFF (SHOW INSTRUCTOR)

Important.png
If you have successfully completed this lab, make a new backup of your virtual machines as well as your host machine.

Arrange proof of the following on the screen:

  1. centos1 VM:
    • Account created on centos1 VM
    • List contents of /etc/group file (ops235 group)
    • List contents of /etc/passwd file (created accounts)
  2. centos2 VM:
    • Display current run-level status on centos2 VM
  3. c7host machine
    • Creation of your bash shell script called createUsers.bash
  4. Lab4 log-book filled out.


Practice For Quizzes, Tests, Midterm & Final Exam

  1. Describe all of the field in /etc/passwd
  2. What is the command to create a user? What option to create a home directory for that user?
  3. What is the command to change the full name of an already-created user?
  4. What is the command to delete a user account? What option allows for the user's home directory to be removed as well?
  5. What is the command to create a group? What is the command (or steps) to include a user in a newly-created group?
  6. What is the purpose of /etc/shadow?
  7. What is the purpose of /etc/skel?
  8. What does the term run-level mean?
  9. How to set the run-level of a Linux system to text-based only? How to set to graphical mode?
  10. What is the command to view the status of running services?
  11. What is the command to start a service (like httpd, or sshd)?
  12. What is the command to start a service?
  13. Can a service be stopped and started by issuing just one command?