Changes

=LAB PREPARATION=Purpose / Objectives of Lab 4=={| width="40%" align="right" cellpadding="10"|- valign="top"|[[Image:users.png|thumb|right|150px|System administrators are required to add, remove and modify user accounts.]]|[[Image:on-off.png|thumb|right|135px|In order to perform maintenance, system administrators need to know how to stop and start services for a Linux system. ]]|}

<u>Main objectivesObjectives</u>:

:* Add a virtual hard disk and expand your vmAdminister '''s existing file system using LVM:* Administer (add, remove, modify) users ''' on a Linux system.:* Save time while adding new users using a template of '''start-up files'''.:* Create and manage '''groups ''' on a Linux system.:* '''Start and Stop services ''' on a Linux system.:* Display the '''status of running services ''' on a Linux system. 

[http://linuxmanpagesunixhelp.comed.ac.uk/man8CGI/man-cgi?useradd.+8.php useradd]<br>[http://linuxmanpagesunixhelp.ed.ac.comuk/man8CGI/man-cgi?userdel.+8.php userdel]<br>[http://linuxmanpagesunixhelp.ed.ac.comuk/man8CGI/man-cgi?usermod.+8.php usermod]<br>[http://linuxmanpagesunixhelp.comed.ac.uk/man8CGI/man-cgi?groupadd.+8.php groupadd]<br>[http://linuxmanpagesunixhelp.comed.ac.uk/man8CGI/man-cgi?groupdel.+8.php groupdel]

[http://linuxmanpagesunixhelp.comed.ac.uk/man8CGI/useradd.man-cgi?chkconfig+8.php chkconfig]<br>[http://linuxmanpagesunixhelp.ed.ac.comuk/man8CGI/userdel.man-cgi?service+8.php service]<br>[http://linuxmanpageswww.comdsm.fordham.edu/man8cgi-bin/userdel.8man-cgi.php pl?topic=systemctl systemctl]<br>

[http://linuxmanpagesman7.comorg/man8linux/useraddman-pages/man5/passwd.85.php html /etc/passwd]<br>[http://linuxmanpagesman7.comorg/man8linux/userdelman-pages/man5/group.85.php html /etc/group]<br>[http://linuxmanpagesman7.comorg/man8linux/userdelman-pages/man5/shadow.85.php html /etc/shadow]<br>[http://linuxmanpagesarchive.linuxfromscratch.comorg/blfs-museum/man81.0/userdelBLFS-1.80/postlfs/skel.php html /etc/skel]<br>[http://zenit.senecac.on.ca/wiki/index.php/Init_vs_systemd init vs systemd]

# Read about the file: http://man7.org/linux.die.net/man-pages/5man5/passwd .5.html

#Perform this part in your '''centos1 ''' VM.

# Create a new user account for each of your pod mates, using three fictitious users (make-up their learn account name as a user nameuserids and full names. Give each user of these newly-created users a password.

#* What is the '''home ''' directory of each user?#* What '''group ''' is each user in?#* What else do other information can you know about each userprovide regarding these users?#* Where are the '''passwords ''' stored?# Look at the man page for '''/etc/shadow ''' using the command : <b><code><span style="color:#3366CC;font-size:1.2em;">man 5 shadow</span></code></b>

#* How does the operating system determine which files are created in a new home account? The answer can be found here: <br>http://www.linuxhowtos.org/Tips%20and%20Tricks/using_skel.htm

 #Perform this part in your centos3 VMIssue the man pages for the '''useradd''' command.# Add your matrix account user to Explain the purpose of using the '''-e'''option for the 'centos3'useradd''command. Try to think what would be the purpose for a Linux sysadmin to use this option when creating new users.

#Perform this part Remain in your '''centos1 ''' VMfor this section.

# Note which option allows you to set the Group ID number ('''GID''') when you create a new group.

#* You are angry The management at your organization have concerns regarding some irresponsible users on your system.#** Add a new group named idiots'''investigation'''.#** Look at '''/etc/group ''' and note the GID of idiotsgroup called '''investigation'''.#** What GID is given to a new group if if you do not specify it?#** Your anger In the file, add those users to the end of the concerned group (separate each user-name with a comma).#** Those individuals have explained their actions to management and the crisis has subsidedbeen resolved. Delete the <b><code><span style="color:#3366CC;font-size:1.2em;">idiots</span></code></b> '''investigation''' group.#** Look at '''/etc/group ''' again and note the change.

#Perform this part Remain in your '''centos1 ''' VMfor this section.# Read the man page for the <b><code><span style="color:#3366CC;font-size:1.2em;">'''userdel</span></code></b> ''' command. Note which option automatically removes the users home directory when that user is deleted. # Delete the user '''ops235_1 ''' using the command <b><code><span style="color:#3366CC;font-size:1.2em;">userdel ops235_1</span></code></b># Delete the user ops235_2 '''ops235'''_2 using the same command with the option which removes the home directory of the user.

# Use the '''usermod ''' command to associate each change the full name of your pod matesthe user account '''noobie''' from '''"Really Green"''' full name to their user name'''"Outstanding Employee"'''. With each change, examine their entries Examine the result of running that command in the <b><code><span style="color:#3366CC;font-size:1.2em;">/etc/passwd</span></code></b> file. What has changed?# Use the '''usermod''' command to extend the use of their account for 5 years as of today.

=INVESTIGATION 2: Managing System Services and Run-levels= Many students may think that the following topic is small and "not a big deal". Those students may say, '''"How hard is running and stopping services?"''' The process may not be hard, but knowing how to stop, start, restart and check the status of services is absolutely critical to a Linux server. '''Aside from learning to trouble-shoot problems''' by checking the status of running services, '''understanding how to manage services is critical to help protect a Linux server from penetration''' (this term is referred to as "'''Hardening a system'''"). Sometimes it is "what we don't know" that can harm us. One key element in hardening a computer system is to disable non essential networkng services to allow IDSs ('''Intrusion Detection Systems''') to focus on a narrower range of policy violations. A Debian-based penetration testing distribution called '''Kali''' (formerly referred to as '''"BackTrax"''') allows sysadmins and security professionals to identify vulnerabilities in their computer systems, and thus improve (harden) their systems against penetration. Learning to monitor the status, enable and disable networking services underlies the '''Backtrax''' motto:<br><br>'''''"The quieter you are, then more you will hear..."'''''<br><br> ===Part 1: How do we Manage RunlevelsSystem Services?===

#Perform this part We have seen that maintaining unneeded '''packages can be a security risk''' due to the unnecessary increase in both the complexity of your centos2 and centos3 VMssystem.The runlevel command Similarly, it is now deprecated in Fedoraalso unnecessarily hazardous, and even more so, to leave unneeded services running. In this investigation, we will likely be deprecated in RHEL/CentOS at some point as welllearn how to '''control services, but for now this is what the industry is usingand turn off those services that we think are not necessary to help reduce security risks'''.

<li value="2">Use the '''man''' pages to learn about the '''service''' command.</li><li>Issue the following Linux command:

<li><b><code><span style="color:#3366CC;font-size:1.2em;">runlevelservice --status-all</span></code></b></li>

<li>Note the difference in output between centos2 and centos3services that are currently running.</li> <li>You can use Use the command <b><code>init<span style="color:#3366CC;font-size:1.2em;">service iptables stop</span></code> </b> to stop the service named '''iptables'''</li> <li>Run a command to change verify that the '''iptables''' service has stopped.<br><br>'''NOTE:''' Although the current runlevelservice command seems to work, it is <u>'''deprecated'''</u> (i. See a list of runlevels e. "out-dated:). It has been replaced by using the [httpshttp://wwwzenit.senecac.centoson.orgca/docswiki/5index.php/Init_vs_systemd#systemd_Command_Usage systemctl] command. This is a command based upon a newer method of starting and managing system services called [http:/html/5zenit.2senecac.on.ca/wiki/Installation_Guideindex.php/s2-Init_vs_systemd systemd] (which replaces init-boot-shutdown-rlthe "initialization table").html here]This method allows services to run more independently of each other, so that a service may be stopped without other dependent services to be stopped as well. Use the <codebr>man</codebr> command The most common '''systemctl''' commands are shown below (it is optional to learn how to use include the filename extension '''.service''' after the service-name):<codeul><li><span style="font-family:courier;font-size:1.2em;font-weight:bold;">'''systemctl list-units --all'''</codespan>init command&nbsp; (get a listing of all service names. Use this command Can pipe to grep to change the current runlevel list service you are interested in centos2 to 3. What happened? What happens after your reboot?)</li> <li>Change the default runlevel on centos2 to 3<span style="font-family:courier;font-size:1. What happens now after you reboot?2em;font-weight:bold;">'''systemctl status service-name'''</span> &nbsp; (Confirm status of a service - running or not-running)</li> <li>Issue the following Linux command<span style="font-family:courier;font-size:1.2em;font-weight: bold;">'''systemctl stop service-name'''</span> &nbsp; (stop a service)<ul/li> <li><bspan style="font-family:courier;font-size:1.2em;font-weight:bold;">'''systemctl start service-name'''</span> &nbsp; (start a service)</li><codeli><span style="colorfont-family:#3366CCcourier;font-size:1.2em;font-weight:bold;">startx'''systemctl restart service-name'''</span>&nbsp; (restart a service)</codeli><li><span style="font-family:courier;font-size:1.2em;font-weight:bold;">'''systemctl enable service-name'''</bspan>&nbsp; (enable service so service runs upon system startup)</li> <li><span style="font-family:courier;font-size:1.2em;font-weight:bold;">'''systemctl disable service-name'''</ulspan> &nbsp; (disable service so it does NOT run upon system startup)<br><br> </li> <li/ul>What happens?</li> <li>LogIf you reboot now -the iptables service will be turned back on. We don't want it on though, it causes students headaches.<br>To turn it off your graphical systempermanently we need to use the '''systemctl''' command:<b><code><span style="color:#3366CC;font-size:1. You should return 2em;">systemctl disable iptables</span></code></b><br>(the '''chkconfig''' command used to be the way to your shell promptenble/disable services, but is now deprecated).</li> <li>Change Use the default runlevel for centos2 back '''systemctl''' command to 5 verify that the '''iptables''' service is no longer running ('''hint:''' issue command, and reboot pipe to make sure grep "'''iptables'''"). <li>Reboot and confirm that it works's no longer running.</li>

=== Part 2: How do we Manage System ServicesRunlevels? ===

We have seen that maintaining unneeded '''packages Running servers in graphical mode will make your system most likely to be penetrated. The X-windows framework can be a security risk''' due vulnerable to attacks when these servers are connected to the unnecessary increase in the complexity of your systemInternet. Similarly, it This is also unnecessarily hazardouswhy when you install server versions of Linux, and even more so, to leave unneeded services runningthey work in text-based mode only. In this investigation, we will learn how to '''control services, and turn off those services Desktop versions of Linux are then installed on workstations (working in graphical mode) that we think are not necessary connect to help reduce the server (for security risks'''reasons).}}

The Linux sysadmin can also change the run-level (or state) of a graphical Linux server to run in text-based mode and run the graphical mode by issuing a command when graphic mode is required. The run-level term is now deprecated in Fedora, and will likely be deprecated in RHEL/CentOS at some point as well, but for now this is what the industry is using.   #For Perform this part, remain in both your '''centos2 VM''' and '''centos3''' VMs.

<li><b><code><span style="color:#3366CC;font-size:1.2em;">service --status-allrunlevel</span></code></b></li>

<li>Note the services that are currently runningdifference in output between '''centos2''' and '''centos3'''.</li> <li>Use You can use the '''init''' command to change the <b><code><span style="color:#3366CC;fontcurrent run-sizelevel. See a list of runlevels [https:1//www.centos.org/docs/5/html/5.2em;">service<2/Installation_Guide/span>s2-init-boot-shutdown-rl.html here].</codeli></bli> Use the '''man''' command to stop learn how to use the service named '''iptablesinit'''command. Use this command to change the current run-level in '''centos2''' to '''3'''. What happened?</li> <li>Issue the following Linux command: <ul> <li><b><code><span style="color:#3366CC;font-size:1.2em;">servicestartx</span></code></b> command to verify that this service has stopped.</li> </ul> </li> <li>What happens?</li> <li>If you reboot now Log- the iptables service will be turned back onoff your graphical system. We don't want it on though, it causes students headachesYou should return to your shell prompt. To turn it off permanently we need to use the chkconfig command: <b/li> <codeli><span style="colorUsing systemd requires a different method of setting text mode and graphical mode. You can refer to this link for future reference:#3366CC;font-size[http:1//fedoraproject.2em;">chkconfig iptables off<org/wiki/span>Systemd#How_do_I_change_the_runlevel.3F How to Change Run-Levels with Systemd]</codeli></bli>Restart your centos2 machine, and make certain that it runs in '''graphical''' mode</li> </li>Reboot and confirm that it's no longer running.Why would you want to make a graphical Linux system run in text-based mode?</li>

{{Admon/tip|Bash Shell Scripting Tips:|<br><ul><li>'''The case statement:'''<br><br>The case statement is a control-flow statement that works in a similar way as the if-elif-else statement (but is more concise). This statement presents scenerios or "cases" based on values or regular expressions (not ranges of values like if-elif-else statements). After action(s) are taken for a particular scenerio (or "case"), a break statement (''';;''') is used to "break-out" of the statement (and not perform other actions). A default case (*) is also used to catch exceptions.<br><br><u>'''Examples (try in shell script):'''</u><br><br>''read -p "pick a door (1 or 2): " pick<br>case $pick in<br>&nbsp; 1) echo "You win a car!" ;;<br>&nbsp; 2) echo "You win a bag of dirt!" ;;<br>&nbsp; *) echo "Not a valid entry"<br>&nbsp;&nbsp;&nbsp;&nbsp; exit 1 ;;<br>esac''<br><br>''read -p "enter a single digit: " digit<br>case $digit in<br>&nbsp; [0-9]) echo "Your single digit is: $digit" ;;<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; *)&nbsp;echo "not a valid single digit"<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; exit 1 ;;<br>esac''<br><br></li><li>'''The getopts function:'''<br><br></li></ul>The getopts function allows the shell scripter to create scripts that accept options (like options for Linux commands). This provides the Linux administrator with scripts that provide more flexibility and versatility. A built-in function called '''getopts''' (i.e. get command options) is used in conjunction with a '''while''' loop and a '''case''' statement to carry out actions based on if certain options are present when the shell script is run. The variable '''$OPTARG''' can be used if an option accepts text (denoted in the getopts function with an option letter followed by a colon. Case statement exceptions use the ''':)''' and '''\?)''' cases for error handling.<br><br>'''<u>Example of getopts</u>''' (try in script and run with options)<br><br>''while getopts abc: name<br>do<br>&nbsp; case $name in<br>&nbsp; &nbsp; a) echo "Action for option \"a\"" ;;<br>&nbsp; &nbsp; b) echo "Action for option \"b\"" ;;<br>&nbsp; &nbsp; c) echo "Action for option \"c\""<br>&nbsp; &nbsp; &nbsp; &nbsp; echo Value is: $OPTARG" ;;<br>&nbsp; &nbsp; :) echo "Error: You need text after -c option"<br>&nbsp; &nbsp; &nbsp; &nbsp; exit 1 ;;<br>&nbsp; &nbsp; \?) echo "Error: Incorrect option"<br>&nbsp; &nbsp; &nbsp; &nbsp; exit 1 ;;<br>esac''<br>done<br><br>}}

 #You will be using your '''c7host''' machine for this section.#Download, study, and run the following shell script. Issue the command:<br><b><code><span style=" pointer-events:none;cursor:default;color:#3366CC;font-size:1.2em;">wget https://scs.senecac.on.ca/~murray.saul/user-create.bash</span></code></b>#Try to understand what these Bash Shell scripts do, and then run the script as root. After running the shell script, view the contents of the '''/home''' directory to confirm.  Although the '''zenity''' command is a "user-friendly" way to run shell scripts, Linux administrators usually create shell scripts that resemble common Linux commands. In this lab, you will learn to create a shell script using the getopts function to make your shell script behave more like actual Linux commands (including the use of options). Refer to the notes section on the right-hand-side for reference about the '''case''' statement and the '''getopts''' function.  <ol><li value="3">Open a Bash shell terminal and login as root.</li><li>Use the wget command to download the input file called user-data.txt by issuing the command:<br><b><code><span style="color:#3366CC;font-size:1.2em;">wget https://scs.senecac.on.ca/~murray.saul/user-data.txt</span></code></b></li><li>View the contents on the user-data.txt file to confirm there are 3 fields (username, fullname, and e-mail address)which are separated by the colon (:) symbol.<li><li>Use a text editor (such as <b><code><span style="color:#3366CC;font-size:1.2em;">vi</span></code></b> or <b><code><span style="color:#3366CC;font-size:1.2em;">nano</span></code></b>) to create a Bash Shell script called: <b><code><span style="color:#3366CC;font-size:1.2em;">createUsers.bash</span></code></b> in /root's home directory.</li><li>Enter the following text content into your text-editing session:</li></ol><code style="color:#3366CC;font-family:courier;font-size:.9em;margin-left:20px;"><br>&#35;!/bin/bash <br><br>&#35; createUsers.bash<br>&#35; Purpose: Generates a batch of user accounts (user data stored in a text file)<br>&#35;<br>&#35; USAGE: /root/createUsers.bash [-i {input-path}] <br>&#35;<br>&#35; Author: *** INSERT YOUR NAME ***<br>&#35; Date: *** CURRENT DATE ***<br><br>if [ $PWD != "/root" ] # only runs if in root's home directory<br>then<br>&nbsp;echo "You must be in root's home directory." >&2<br>&nbsp;exit 1<br>fi<br>if [ "$#" -eq 0 ] # if no arguments after command<br>then<br>&nbsp;echo "You must enter an argument" >&2<br>&nbsp;echo "USAGE: $0 [-i {input-path}]" >&2<br>&nbsp;exit 2<br>fi<br></code><br><ol><li value="6">Save your editing session, but remain in the text editor.</li><li>The code displayed below uses the getopt function set the input file pathname or check for invalid options or missing option text. Add the following code</li></ol><br><code style="color:#3366CC;font-family:courier;font-size:.9em;"><br>outputFlag="n"<br>while getopts i: name<br>do<br>&nbsp;case $name in<br>&nbsp; &nbsp;i) inputFile=$OPTARG ;;<br>&nbsp; &nbsp;:) echo "Error: You need text after options requiring text"<br>&nbsp; &nbsp; &nbsp; &nbsp;exit 1 ;;<br>&nbsp; &nbsp;\?) echo "Error: Incorrect option"<br>&nbsp; &nbsp; &nbsp; &nbsp; exit 1 ;;<br>&nbsp;esac<br>done<br></code><ol><li value="6">Save your editing session, but remain in the text editor.</li><li>The code displayed below uses logic to exit the script if the input file does not exist. Command substitution is used to store each line of the input file as a positional parameter. There is one subtle problem here: The full names of the users contain spaces which can create havoc when trying to set each line as a separate positional parameter. In this case the sed command is used to convert spaces to plus signs (+), which will be converted back later. Finally, a '''for''' loop is used to create each account ('''useradd''') and mail the user their account information ('''mail'''). Add the following code:</li></ol><br><code style="color:#3366CC;font-family:courier;font-size:.9em;"><br>if [ ! -f $inputFile ]<br>then<br>&nbsp; echo "The file pathname \"$inputFile\" is empty or does not exist" >&2<br>&nbsp; exit 2<br>fi<br><br>set $(sed 's/ /+/g' $inputFile) # temporarily convert spaces to + for storing lines as positional parameters<br><br>for x<br>do<br>&nbsp; &nbsp; userPassWd=$(date | md5sum | cut -d" " -f1)<br>&nbsp; &nbsp; useradd -m -c "$(echo $x | cut -d":" -f2 | sed 's/+/ /g')" -p $userPassWd $(echo $x | cut -d":" -f1)<br>&nbsp; &nbsp; mail -s "Server Account Information" $(echo $x | cut -d":" -f3) <<+<br>&nbsp; &nbsp; Here is your server account information:<br>&nbsp; &nbsp; servername: myserver.senecac.on.ca<br>&nbsp; &nbsp; username: $(echo $x| cut -d":" -f1)<br>&nbsp; &nbsp; password: $userPassWd<br>&nbsp; &nbsp; Regards,<br>&nbsp; &nbsp; IT Department<br>+<br>done<br><br>echo -e "\n\nAccounts have been created\n\n"<br>exit 0<br></code> <ol><li value="8">Save, set permissions, and then run that shell script for the input text file '''user-data.txt'''. Did it work? Try running the script without an argument - What did it do? </li><li>You have completed lab4. Proceed to Completing The Lab, and follow the instructions for "lab sign-off".</li></ol>

{{Admon/important|Time for a new backup!|If you have successfully completed this lab, make a new backup of your virtual machinesas well as your host machine. Remember to also make a backup of the new second virtual disk drive on ''centos1'' -- you now have two virtual disks on ''centos1'', and therefore two image files, and therefore will need two backup files.|}}

::<ol><li><span style="color:green;font-size:1.5em;">&#x2713;</span> '''centos1''' VM:<blockquote><ul><li> Account created on '''centos3centos1''' VM</li><li> List contents of '''/etc/group' matching your Matrix account.::'' file (ops235 group)</li><li>List contents of '''/etc/passwd''' file (created accounts)</li></ul></blockquote><li><span style="color:green;font-size:1.5em;">&#x2713;</span> List contents of '''/etc/groupcentos2''' file (ops235 group).:VM:<blockquote><ul><li>Display current run-level status on '''centos2''' VM</li></ul></blockquote></li></li><li><span style="color:green;font-size:1.5em;">&#x2713;</span> List contents '''c7host''' machine<blockquote><ul><li>Creation of your bash shell script called '''/etc/passwdcreateUsers.bash''' file (created accounts).::</li></ul></blockquote></li><li><span style="color:green;font-size:1.5em;">&#x2713;</span> Fresh backup of the virtual machines'''Lab4''' log-book filled out.</li></ol>