13,420
edits
Changes
Created page with 'Category:OPS235 =LAB PREPARATION= {| width="40%" align="right" cellpadding="10" |- valign="top" |style="padding-left:20px;" |[[Image:users.png|thumb|right|200px|System admin…'
[[Category:OPS235]]
=LAB PREPARATION=
{| width="40%" align="right" cellpadding="10"
|- valign="top"
|style="padding-left:20px;" |[[Image:users.png|thumb|right|200px|System administrators are required to add, remove and modify user accounts.]]
|style="padding-left:20px;" |[[Image:stop.png|thumb|right|100px|Linux system administrators need to know how to stop / disable Linux services.]]
|style="padding-left:20px;" |[[Image:go.png|thumb|right|100px|Linux system administrators need to know how to start / enable Linux services.]]
|}
===Purpose / Objectives of Lab 4===
There are many other tasks that a Linux system administrator must perform other than installing Linux and installing software.
A few additional tasks are user management and managing services.
<u>Main Objectives</u>:
<br>
:* Administer '''(add, remove, modify) users''' on a Linux system.
:* Save time while adding new users using a template of '''start-up files'''.
:* Create and manage '''groups''' on a Linux system.
:* '''Start and Stop services''' on a Linux system.
:* Display the '''status of running services''' on a Linux system.
{|width="80%" cellspacing="0"
|- valign="top"
|colspan="3" style="font-size:16px;font-weight:bold;border-bottom: thin solid black;border-spacing:0px;"|Minimum Required Materials<br>
|colspan="3" style="font-size:16px;font-weight:bold;border-bottom: thin solid black;border-spacing:0px;padding-left:20px;"|Linux Command Reference<br>
|- valign="top"
|style="padding-left:20px;" |[[Image:ssd.png|thumb|left|85px|<b>Solid State Drive</b>]]
|style="padding-left:20px;" |[[Image:ubs-key.png|thumb|left|85px|<b>USB key</b><br>(for backups)]]
|style="padding-left:20px;" |[[Image:log-book.png|thumb|left|70px|<b>Lab4 Log Book</b>]]
|style="padding-left:20px;" |User Management
[http://unixhelp.ed.ac.uk/CGI/man-cgi?useradd+8 useradd]<br>
[http://unixhelp.ed.ac.uk/CGI/man-cgi?userdel+8 userdel]<br>
[http://unixhelp.ed.ac.uk/CGI/man-cgi?usermod+8 usermod]<br>
[http://unixhelp.ed.ac.uk/CGI/man-cgi?groupadd+8 groupadd]<br>
[http://unixhelp.ed.ac.uk/CGI/man-cgi?groupdel+8 groupdel]<br>
[http://www.agr.unideb.hu/~agocs/informatics/11_e_unix/unixhelp/unixhelp.ed.ac.uk/CGI/man-cgied74.html?chage chage]<br><br>
Managing Services<br>
[http://unixhelp.ed.ac.uk/CGI/man-cgi?chkconfig+8 chkconfig]<br>
[http://unixhelp.ed.ac.uk/CGI/man-cgi?service+8 service]<br>
[http://www.dsm.fordham.edu/cgi-bin/man-cgi.pl?topic=systemctl systemctl]<br>
|style="padding-left:20px;" |Miscellaneous
[http://man7.org/linux/man-pages/man5/passwd.5.html /etc/passwd]<br>
[http://man7.org/linux/man-pages/man5/group.5.html /etc/group]<br>
[http://man7.org/linux/man-pages/man5/shadow.5.html /etc/shadow]<br>
[http://archive.linuxfromscratch.org/blfs-museum/1.0/BLFS-1.0/postlfs/skel.html /etc/skel]<br>
[http://zenit.senecac.on.ca/wiki/index.php/Init_vs_systemd init vs systemd]
|}
= INVESTIGATION 1: User/Group Management =
User account management is a very important operation that a Linux sysadmin does on a consistent basis. The sysadmin not only needs to add or remove user accounts by issuing commands, but may need to automate user account creations a large number (batch) of potential employees. There are many features with the Linux command to create new users including: specification of a home directory, type of shell used, name, password and time-limit (referred to as "aging") for a new user account. Remove user accounts also have options such as removing the user account but keeping the home directory for reference or evidence of "wrong-doing"
In your ULI101 course, you learned to change permissions for directories and files relating to user, same group members and other group members. In this course, since you are the sysadmin with root privileges, you can create or remove groups as well as change the ownership of directories and files! We will now learn to perform key user account management operations in this section.
{| width="40%" align="right" cellpadding="10"
|- valign="top"
|
[[Image:passwd-file.png|thumb|right|500px|The /etc/passwd file contains records for users (system accounts and regular-user accounts). There are several fields including: '''Username''', '''password link''' ("x" indicates hashed password stored in /etc/shadow file only accessible by root), '''user-id''', '''primary group-id''', '''user defined field''' (eg. Full Name), '''default home directory''', and '''default shell'''. ]]
|}
=== Part 1: Studying the /etc/passwd file ===
The /etc/passwd file is a database that stores user accounts (both system and regular users). Since we will be learning to create, modify and remove users on our Linux system, we should study this file in order to understand how those user account management commands will affect this file.
'''Perform the following steps:'''
# Launch your c7host and centos1 VMs.
# Open a shell terminal and login as root.
# Look at the <b><code><span style="color:#3366CC;font-size:1.2em;">/etc/passwd</span></code></b> file.
# Make note of the contents of that file.
# Read about the file: http://man7.org/linux/man-pages/man5/passwd.5.html
# Make sure you know what information each field contains.
# Why do you think there are so many users?
# Look at the names of the users. What do you think these user names represent? Are they people?
# What is the numeric user ID (UID) of the root user?
# The user IDs of real users (people) are different from the user IDs of system accounts. What is the pattern?
{| width="40%" align="right" cellpadding="10"
|- valign="top"
|
[[Image:user-management.png|thumb|right|500px|Another essential responsibility for Linux system administrators is to '''add''', '''modify''', and '''remove''' user accounts. ]]
|}
=== Part 2: Adding, Removing, and Modifying Users ===
In this section, we will now learn how to <u>properly</u> add user accounts, remove user accounts, and modify existing user account information.
'''Perform the following steps:'''
# Remain in your '''centos1''' VM for this section.
# Read the man page for the <b><code><span style="color:#3366CC;font-size:1.2em;">useradd</span></code></b> command.
# Create a new user called '''ops235_1''' by issuing the command: <b><code><span style="color:#3366CC;font-size:1.2em;">useradd ops235_1</span></code></b>
# Issue the command: <b><code><span style="color:#3366CC;font-size:1.2em;">grep ops235_1 /etc/passwd</span></code></b> to see if that user account was created.
# View the '''/home''' directory to view the contents. Is the user ops235_1's home directory there?
# Issue the following command to create the user called ops235_2: <b><code><span style="color:#3366CC;font-size:1.2em;">useradd -m ops235_2</span></code></b>
# View the '''/home''' directory to verify that the home directory for '''ops235_2''' has been created. What does the -m option do for the useradd command?
# Issue the following command to remove the user called ops235_2: <b><code><span style="color:#3366CC;font-size:1.2em;">userdel ops235_2</span></code></b>
# Issue the grep command with the /etc/passwd file to verify that the username ops235_2 was removed.
# View the contents of the '''/home''' directory. Was the home directory for user '''ops235_2''' removed? As root, remove that directory. What option do you need to use with the userdel command to automatically remove the user's home directory?
# Issue the userdel comamnd to remove the '''ops235_1''' account with the '''-r option''' (and home directory regardless if it exists or not).
# Recreate the new user (with home directories automatically created) for '''ops235_1'''.
# Use the '''passwd''' command to set the password for the user '''ops235_1'''.
# View the <u>contents</u> for '''ops235_1's''' home directory and note the files.
# Look at the man page for '''/etc/shadow''' using the command: <b><code><span style="color:#3366CC;font-size:1.2em;">man 5 shadow</span></code></b>
# Create a new file in the /etc/skel directory with the following command: <b><code><span style="color:#3366CC;font-size:1.2em;">touch /etc/skel/foo</span></code></b>
# Recreate the new user (with home directories automatically created) for '''ops235_2'''.
# Set the password for the user '''ops235_2'''.
# View the <u>contents</u> for ops235_2's home directory and note the files. What do you notice that is different. What do you think is the purpose of the '''/etc/skel''' directory?
# Be sure to record your observations in your lab notes.
#Issue the man pages for the '''useradd''' command. Explain the purpose of using the '''-e''' option for the ''useradd'' command.
#Issue the following command: <b><code><span style="color:#3366CC;font-size:1.2em;">chage -E 2018-05-31 ops235_1</span></code></b>
#Issue the following command: <b><code><span style="color:#3366CC;font-size:1.2em;">chmod -c "New Name" ops235_2</span></code></b>. View ops235_2's account information in the '''/etc/passwd''' file. What do you notice is different?
# Issue the following command to obtain information regarding the user called ops235_1: <b><code><span style="color:#3366CC;font-size:1.2em;">chage -l ops235_1</span></code></b>. What do you think is the purpose of the chage command and the useradd command with the -e option?
{| width="40%" align="right" cellpadding="10"
|- valign="top"
|
[[Image:group-add.png|thumb|right|300px|When a file is created it is assigned an owner and a default (primary) group. The Linux system administrator can not only change a file's ownership, but also change the default group that file belongs to. In addition, the sysadmin can also add other users to a supplementary group that they have created via the '''usermod''' command. This is useful in setting "same group" permissions via the '''chmod''' command. ]]
|}
=== Part 3: Managing Groups ===
In this section, we will learn how to create, remove and modify groups in our Linux VM. You learned in ULI101 how to change permissions with the '''chmod''' command, but you didn't have admin privileges to create groups to allow directory and regular file sharing. Since you now have admin privileges with your VM, you can now create groups, and add users to this group to allow file-sharing among users.
'''Perform the following steps:'''
#Remain in your '''centos1''' VM for this section.
#Switch to '''ops235_1's''' user account by issuing the following command: <b><code><span style="color:#3366CC;font-size:1.2em;">login ops235_1</span></code></b>
#Create a file called '''information.txt''' in home directory of that user.
#Issue the following command: <b><code><span style="color:#3366CC;font-size:1.2em;">ls -l information.txt</span></code></b>. Who owns that file? What primary group does that file belong to?
#Issue the command <b><code><span style="color:#3366CC;font-size:1.2em;">exit</span></code></b> to return to your root account.
#Issue the following command to create a group called '''welcome''': <b><code><span style="color:#3366CC;font-size:1.2em;">groupadd welcome</span></code></b>
#Issue the command: <b><code><span style="color:#3366CC;font-size:1.2em;">grep welcome /etc/group</span></code></b> file to confirm that group was created.
# Read the man page for the <b><code><span style="color:#3366CC;font-size:1.2em;">usermod</span></code></b> command. Which option allow you to set the Group ID number ('''GID''') when you create a new group? Which options allow you to both append and assign users to an existing group name?
# Issue the usermod command to add both '''ops235_1''' and '''ops235_2''' to the newly-created welcome group.
===Practical Example===
Management has indicated that the "noobie" employee be on on probation for 3 months. As the Linux system administrator, they want you to perform the following steps:
# Remain in your '''centos1''' VM for this section.
# Use the '''useradd''' command to create a user account called: '''noobie''' to expire in 3 months from this date as part of the security policy of this organization.
# Set an appropriate password for this user account.
# Add this newly-created user to the newly-created '''welcome''' group.
# Examine <b><code><span style="color:#3366CC;font-size:1.2em;">/etc/group</span></code></b> to verify that you made the correct operations.
# Use the '''usermod''' command to change the full name of the user account '''noobie''' from '''"Really Green"''' to '''"Outstanding Employee"'''. Examine the result of running that command in the <b><code><span style="color:#3366CC;font-size:1.2em;">/etc/passwd</span></code></b> file. What has changed?
Unfortunately, you were later informed that this "'''noobie'''" employee was caught stealing from the company. They want you to perform the following operations:
# Remove this account, but keep "noobie's" home directory for police investigation purposes.
# Verify that you correctly issued the correct commands.
'''Answer INVESTIGATION 1 observations / questions in your lab log book.'''
=INVESTIGATION 2: Managing System Services and Run-levels=
Many students may think that the following topic is small and "not a big deal". Those students may say, '''"How hard is running and stopping services?"'''
The process may not be hard, but knowing how to stop, start, restart and check the status of services is absolutely critical to a Linux server. '''Aside from learning to trouble-shoot problems''' by checking the status of running services, '''understanding how to manage services is critical to help protect a Linux server from penetration''' (this term is referred to as "'''Hardening a system'''"). Sometimes it is "what we don't know" that can harm us. One key element in hardening a computer system is to disable non essential networkng services to allow IDSs ('''Intrusion Detection Systems''') to focus on a narrower range of policy violations. A Debian-based penetration testing distribution called '''Kali''' (formerly referred to as '''"BackTrax"''') allows sysadmins and security professionals to identify vulnerabilities in their computer systems, and thus improve (harden) their systems against penetration. Learning to monitor the status, enable and disable networking services underlies the '''Backtrax''' motto: '''''"The quieter you are, then more you will hear..."'''''<br><br>
{| width="40%" align="right" cellpadding="10"
|- valign="top"
|
[[Image:manage-service.png|thumb|right|500px|It is important for a Linux system administrator to be able to start/stop, enable/disable and check the status of services on their Linux server. Students will be commonly performing these operations in their OPS335 course when configuring and troubleshooting network services. ]]
|}
=== Part 1: How do we Manage System Services? ===
We have seen that maintaining unneeded '''packages can be a security risk''' due to the unnecessary increase in the complexity of your system. Similarly, it is also unnecessarily hazardous, and even more so, to leave unneeded services running. In this investigation, we will learn how to '''control services, and turn off those services that we think are not necessary to help reduce security risks'''.
Although there is a command called: '''service''' that may appear to manager services on your Linux system, it is considered <u>'''deprecated'''</u> (i.e. "obsolete"). It has been replaced by using the [http://zenit.senecac.on.ca/wiki/index.php/Init_vs_systemd#systemd_Command_Usage systemctl] command.
'''Perform the following steps:'''
#Launch and use your '''centos2''' VM for this part.
<ol>
<li value="2">Use the '''man''' pages to learn about the '''systemctl''' command.</li><li>Issue the following Linux command:
<ul>
<li><b><code><span style="color:#3366CC;font-size:1.2em;">systemctl list-units --all</span></code></b></li>
</ul>
</li>
<li>Note the services that are currently running.</li>
<li>Use the command <b><code><span style="color:#3366CC;font-size:1.2em;">systemctl stop iptables</span></code></b> to stop the service named '''iptables'''</li>
<li>Run the following command to verify that the '''iptables''' service has stopped:<br><b><code><span style="color:#3366CC;font-size:1.2em;">systemctl list-units iptables</span></code></b>.</li>
<li>Issue the following command: <span style="font-family:courier;font-size:1.2em;font-weight:bold;">'''systemctl disable iptables'''</span> (disable iptables service so it does NOT run upon system startup)<br><br></li>
<li>If you reboot now - the iptables service will NOT be turned on upon system boot-up. We don't want it on though at this point anyways since it causes students headaches.</li>
<li>Use the '''systemctl''' command to verify that the '''iptables''' service is no longer running and is disabled.</li>
</ol>
{| width="50%" align="right" cellpadding="10"
|- valign="top"
|
[[Image:grub2_1.png|thumb|right|600px|The purpose of '''Linux servers''' are to run network-based services (i.e. they '''"serve"''' the users that operating in that Linux/Unix system). It is common that these Linux servers are separated (for security purposes) and they are '''run in Command-Line mode only'''. Running these Linux/Unix servers in '''Graphics Mode will make them more vulnerable to penetration from hackers, etc.''' Therefore, it is common that the Linux servers are CLI <u>only</u>, but the Workstations that connect to them within the network are GUI. Therefore, it is important that a Linux/Unix system administrator understand to switch to these different "run-levels". ]]
|}
===Part 2: How do we Manage Runlevels?===
Running servers in graphical mode will make your system most likely to be penetrated. The X-windows framework can be vulnerable to attacks when these servers are connected to the Internet. This is why when you install server versions of Linux, they work in text-based mode only. Desktop versions of Linux are then installed on workstations (working in graphical mode) that connect to the server (for security reasons).
The Linux sysadmin can also change the run-level (or state) of a graphical Linux server to run in text-based mode and run the graphical mode by issuing a command when graphic mode is required. The run-level term is now deprecated in Fedora, and will likely be deprecated in RHEL/CentOS at some point as well, but for now this is what the industry is using.
'''Perform the following steps:'''
#Perform this part in both your '''centos2''' and '''centos3''' VMs.
<ol>
<li value="2">Issue the following Linux command:
<ul>
<li><b><code><span style="color:#3366CC;font-size:1.2em;">runlevel</span></code></b></li>
</ul>
</li>
<li>Note the difference in output between '''centos2''' and '''centos3'''.</li>
<li>You can use the '''init''' command to change the current run-level. See a list of runlevels [https://www.centos.org/docs/5/html/5.2/Installation_Guide/s2-init-boot-shutdown-rl.html here].</li><li> Use the '''man''' command to learn how to use the '''init''' command. Use this command to change the current run-level in '''centos2''' to '''3'''. What happened?</li>
<li>Issue the following Linux command:
<ul>
<li><b><code><span style="color:#3366CC;font-size:1.2em;">startx</span></code></b></li>
</ul>
</li>
<li>What happens?</li>
<li>Log-off your graphical system. You should return to your shell prompt.</li>
<li>Using systemd requires a different method of setting text mode and graphical mode. You can refer to this link for future reference:
[http://fedoraproject.org/wiki/Systemd#How_do_I_change_the_runlevel.3F How to Change Run-Levels with Systemd]</li><li>Restart your centos2 machine, and make certain that it runs in '''graphical''' mode</li>
</li>Why would you want to make a graphical Linux system run in text-based mode?</li>
</ol>
'''Answer INVESTIGATION 2 observations / questions in your lab log book.'''
= INVESTIGATION 3: CREATING LINUX COMMANDS VIA SHELL SCRIPTS=
{|width="40%" align="right" cellpadding="10"
|- valign="top"
|
{{Admon/tip|Bash Shell Scripting Tips:|<br>'''T<u>he case statement</u>'''<ul><li>The case statement is a control-flow statement that works in a similar way as the if-elif-else statement (but is more concise). This statement presents scenerios or "cases" based on values or regular expressions (not ranges of values like if-elif-else statements).<br><br></li><li>After action(s) are taken for a particular scenerio (or "case"), a break statement (''';;''') is used to "break-out" of the statement (and not perform other actions). A default case (*) is also used to catch exceptions.<br><br></li><li>Examples:<br><br>''read -p "pick a door (1 or 2): " pick<br>case $pick in<br> 1) echo "You win a car!" ;;<br> 2) echo "You win a bag of dirt!" ;;<br> *) echo "Not a valid entry"<br> exit 1 ;;<br>esac''<br><br>''read -p "enter a single digit: " digit<br>case $digit in<br> [0-9]) echo "Your single digit is: $digit" ;;<br> *) echo "not a valid single digit"<br> exit 1 ;;<br>esac''<br><br></li></ul>'''<u>The getopts function</u>'''<ul><li>The getopts function allows the shell scripter to create scripts that accept options (like options for Linux commands). This provides the Linux administrator with scripts that provide more flexibility and versatility. A built-in function called '''getopts''' (i.e. get command options) is used in conjunction with a '''while''' loop and a '''case''' statement to carry out actions based on if certain options are present when the shell script is run.<br><br></li><li> The variable '''$OPTARG''' can be used if an option accepts text (denoted in the getopts function with an option letter followed by a colon. Case statement exceptions use the ''':)''' and '''\?)''' cases for error handling.<br><br><li>Example:<br><br>''while getopts abc: name<br>do<br> case $name in<br> a) echo "Action for option \"a\"" ;;<br> b) echo "Action for option \"b\"" ;;<br> c) echo "Action for option \"c\""<br> echo Value is: $OPTARG" ;;<br> :) echo "Error: You need text after -c option"<br> exit 1 ;;<br> \?) echo "Error: Incorrect option"<br> exit 1 ;;<br>esac''<br>done<br><br></li></ul>}}
|}
===Using getopts Function & case statement===
We will now use shell scripting to help automate the task for a Linux adminstrator to create regular user accounts.
'''Perform the following steps:'''
#You will be using your '''c7host''' machine for this section.
#Open a shell terminal, and login as root.
#Change to the '''/root/bin''' directory.
#Download, study, and run the following shell script. Issue the command:<br><b><code><span style=" pointer-events:none;cursor:default;color:#3366CC;font-size:1.2em;">wget https://scs.senecac.on.ca/~murray.saul/user-create.bash</span></code></b>
#Try to understand what these Bash Shell scripts do, and then run the script as root. After running the shell script, view the contents of the '''/home''' directory to confirm.
Although the '''zenity''' command is a "user-friendly" way to run shell scripts, Linux administrators usually create shell scripts that resemble common Linux commands. In this lab, you will learn to create a shell script using the getopts function to make your shell script behave more like actual Linux commands (including the use of options). Refer to the notes section on the right-hand-side for reference about the '''case''' statement and the '''getopts''' function.
<ol><li value="3">Open a Bash shell terminal and login as root.</li><li>Use the wget command to download the input file called user-data.txt by issuing the command:<br><b><code><span style="color:#3366CC;font-size:1.2em;">wget https://scs.senecac.on.ca/~murray.saul/user-data.txt</span></code></b></li><li>View the contents on the user-data.txt file to confirm there are 3 fields (username, fullname, and e-mail address)which are separated by the colon (:) symbol.<li><li>Use a text editor (such as <b><code><span style="color:#3366CC;font-size:1.2em;">vi</span></code></b> or <b><code><span style="color:#3366CC;font-size:1.2em;">nano</span></code></b>) to create a Bash Shell script called: <b><code><span style="color:#3366CC;font-size:1.2em;">createUsers.bash</span></code></b> in /root's home directory.</li><li>Enter the following text content into your text-editing session:</li></ol>
<code style="color:#3366CC;font-family:courier;font-size:.9em;margin-left:20px;font-weight:bold;">
<br>
#!/bin/bash <br>
<br>
# createUsers.bash<br>
# Purpose: Generates a batch of user accounts (user data stored in a text file)<br>
#<br># USAGE: /root/createUsers.bash [-i {input-path}] <br>
#<br>
# Author: *** INSERT YOUR NAME ***<br>
# Date: *** CURRENT DATE ***<br>
<br>
if [ $PWD != "/root" ] # only runs if in root's home directory<br>
then<br> echo "You must be in root's home directory." >&2<br>
exit 1<br>
fi<br>
if [ "$#" -eq 0 ] # if no arguments after command<br>
then<br>
echo "You must enter an argument" >&2<br>
echo "USAGE: $0 [-i {input-path}]" >&2<br>
exit 2<br>
fi<br>
</code>
<br>
<ol><li value="6">Save your editing session, but remain in the text editor.</li><li>The code displayed below uses the getopt function set the input file pathname or check for invalid options or missing option text. Add the following code</li></ol>
<br>
<code style="color:#3366CC;font-family:courier;font-size:.9em;font-weight:bold;">
<br>
outputFlag="n"<br>
while getopts i: name<br>
do<br>
case $name in<br>
i) inputFile=$OPTARG ;;<br>
:) echo "Error: You need text after options requiring text"<br>
exit 1 ;;<br>
\?) echo "Error: Incorrect option"<br>
exit 1 ;;<br>
esac<br>
done<br>
</code>
<ol><li value="6">Save your editing session, but remain in the text editor.</li><li>The code displayed below uses logic to exit the script if the input file does not exist. Command substitution is used to store each line of the input file as a positional parameter. There is one subtle problem here: The full names of the users contain spaces which can create havoc when trying to set each line as a separate positional parameter. In this case the sed command is used to convert spaces to plus signs (+), which will be converted back later. Finally, a '''for''' loop is used to create each account ('''useradd''') and mail the user their account information ('''mail'''). Add the following code:</li></ol>
<br>
<code style="color:#3366CC;font-family:courier;font-size:.9em;font-weight:bold;">
<br>
if [ ! -f $inputFile ]<br>
then<br>
echo "The file pathname \"$inputFile\" is empty or does not exist" >&2<br>
exit 2<br>
fi<br>
<br>
set $(sed 's/ /+/g' $inputFile) # temporarily convert spaces to + for storing lines as positional parameters<br>
<br>
for x<br>
do<br>
userPassWd=$(date | md5sum | cut -d" " -f1)<br>
useradd -m -c "$(echo $x | cut -d":" -f2 | sed 's/+/ /g')" -p $userPassWd $(echo $x | cut -d":" -f1)<br>
mail -s "Server Account Information" $(echo $x | cut -d":" -f3) <<+<br>
Here is your server account information:<br>
servername: myserver.senecac.on.ca<br>
username: $(echo $x | cut -d":" -f1)<br>
password: $userPassWd<br>
Regards,<br>
IT Department<br>
+<br>
done<br>
<br>
echo -e "\n\nAccounts have been created\n\n"<br>
exit 0<br>
</code>
<ol>
<li value="8">Save, set permissions, and then run that shell script for the input text file '''user-data.txt'''. Did it work? Try running the script without an argument - What did it do? </li><li>You have completed lab4. Proceed to Completing The Lab, and follow the instructions for "lab sign-off".</li></ol>
'''Answer INVESTIGATION 3 observations / questions in your lab log book.'''
= LAB 4 SIGN-OFF (SHOW INSTRUCTOR) =
{{Admon/important|Time for a new backup!|If you have successfully completed this lab, make a new backup of your virtual machines as well as your host machine.}}
'''Perform the Following Steps:'''
# Make certain that your '''c7host''', '''centos1''' and '''centos2''' VMs are running.
# Switch to your '''centos1''' VM.
# Open a shell terminal, and issue the Linux command: <b><code><span style="color:#3366CC;font-size:1.2em;">wget http://matrix.senecac.on.ca/~murray.saul/ops235/lab4-check.bash</span></code></b>
# Give the '''lab4-check.bash''' file execute permissions (for the file owner).
# Run the shell script and if any warnings, make fixes and re-run shell script until you receive "congratulations" message.
#Arrange proof of the following on the screen:<br><blockquote><span style="color:green;font-size:1.5em;">✓</span> '''centos1''' VM:<blockquote><ul><li>Output from running the '''lab4-check.bash''' script with all OK messages</li></ul></blockquote><span style="color:green;font-size:1.5em;">✓</span> '''centos2''' VM:<blockquote><ul><li>Display current run-level status on '''centos2''' VM</li></ul></blockquote><span style="color:green;font-size:1.5em;">✓</span>'''c7host''' machine<blockquote><ul><li>Creation of your bash shell script called '''createUsers.bash'''</li></ul></blockquote><span style="color:green;font-size:1.5em;">✓</span> '''Lab4''' log-book filled out.
= Practice For Quizzes, Tests, Midterm & Final Exam =
# Describe all of the field in <code>'''/etc/passwd'''</code>
# What is the command to create a user? What option to create a home directory for that user?
# What is the command to change the full name of an already-created user?
# What is the command to delete a user account? What option allows for the user's home directory to be removed as well?
# What is the command to create a group? What is the command (or steps) to include a user in a newly-created group?
# What is the purpose of <code>'''/etc/shadow'''</code>?
# What is the purpose of <code>'''/etc/skel'''</code>?
# What does the term run-level mean?
# How to set the run-level of a Linux system to text-based only? How to set to graphical mode?
# What is the command to view the status of running services?
# What is the command to start a service (like httpd, or sshd)?
# What is the command to stop a service (like httpd, or sshd)?
# What is the difference between '''starting''' a service and '''enabling''' a service?
# Can a service be stopped and started by issuing just one command?
# What is the purpose of the '''case''' statement in shell scripting?
# What is the purpose of the '''getopts''' function in shell scripting?
# What type of shell script would be best to automatically create 1200 user accounts (which a list of usernames are stored in a text-file)?
[[Category:OPS235]]
[[Category:OPS235 Labs]]
=LAB PREPARATION=
{| width="40%" align="right" cellpadding="10"
|- valign="top"
|style="padding-left:20px;" |[[Image:users.png|thumb|right|200px|System administrators are required to add, remove and modify user accounts.]]
|style="padding-left:20px;" |[[Image:stop.png|thumb|right|100px|Linux system administrators need to know how to stop / disable Linux services.]]
|style="padding-left:20px;" |[[Image:go.png|thumb|right|100px|Linux system administrators need to know how to start / enable Linux services.]]
|}
===Purpose / Objectives of Lab 4===
There are many other tasks that a Linux system administrator must perform other than installing Linux and installing software.
A few additional tasks are user management and managing services.
<u>Main Objectives</u>:
<br>
:* Administer '''(add, remove, modify) users''' on a Linux system.
:* Save time while adding new users using a template of '''start-up files'''.
:* Create and manage '''groups''' on a Linux system.
:* '''Start and Stop services''' on a Linux system.
:* Display the '''status of running services''' on a Linux system.
{|width="80%" cellspacing="0"
|- valign="top"
|colspan="3" style="font-size:16px;font-weight:bold;border-bottom: thin solid black;border-spacing:0px;"|Minimum Required Materials<br>
|colspan="3" style="font-size:16px;font-weight:bold;border-bottom: thin solid black;border-spacing:0px;padding-left:20px;"|Linux Command Reference<br>
|- valign="top"
|style="padding-left:20px;" |[[Image:ssd.png|thumb|left|85px|<b>Solid State Drive</b>]]
|style="padding-left:20px;" |[[Image:ubs-key.png|thumb|left|85px|<b>USB key</b><br>(for backups)]]
|style="padding-left:20px;" |[[Image:log-book.png|thumb|left|70px|<b>Lab4 Log Book</b>]]
|style="padding-left:20px;" |User Management
[http://unixhelp.ed.ac.uk/CGI/man-cgi?useradd+8 useradd]<br>
[http://unixhelp.ed.ac.uk/CGI/man-cgi?userdel+8 userdel]<br>
[http://unixhelp.ed.ac.uk/CGI/man-cgi?usermod+8 usermod]<br>
[http://unixhelp.ed.ac.uk/CGI/man-cgi?groupadd+8 groupadd]<br>
[http://unixhelp.ed.ac.uk/CGI/man-cgi?groupdel+8 groupdel]<br>
[http://www.agr.unideb.hu/~agocs/informatics/11_e_unix/unixhelp/unixhelp.ed.ac.uk/CGI/man-cgied74.html?chage chage]<br><br>
Managing Services<br>
[http://unixhelp.ed.ac.uk/CGI/man-cgi?chkconfig+8 chkconfig]<br>
[http://unixhelp.ed.ac.uk/CGI/man-cgi?service+8 service]<br>
[http://www.dsm.fordham.edu/cgi-bin/man-cgi.pl?topic=systemctl systemctl]<br>
|style="padding-left:20px;" |Miscellaneous
[http://man7.org/linux/man-pages/man5/passwd.5.html /etc/passwd]<br>
[http://man7.org/linux/man-pages/man5/group.5.html /etc/group]<br>
[http://man7.org/linux/man-pages/man5/shadow.5.html /etc/shadow]<br>
[http://archive.linuxfromscratch.org/blfs-museum/1.0/BLFS-1.0/postlfs/skel.html /etc/skel]<br>
[http://zenit.senecac.on.ca/wiki/index.php/Init_vs_systemd init vs systemd]
|}
= INVESTIGATION 1: User/Group Management =
User account management is a very important operation that a Linux sysadmin does on a consistent basis. The sysadmin not only needs to add or remove user accounts by issuing commands, but may need to automate user account creations a large number (batch) of potential employees. There are many features with the Linux command to create new users including: specification of a home directory, type of shell used, name, password and time-limit (referred to as "aging") for a new user account. Remove user accounts also have options such as removing the user account but keeping the home directory for reference or evidence of "wrong-doing"
In your ULI101 course, you learned to change permissions for directories and files relating to user, same group members and other group members. In this course, since you are the sysadmin with root privileges, you can create or remove groups as well as change the ownership of directories and files! We will now learn to perform key user account management operations in this section.
{| width="40%" align="right" cellpadding="10"
|- valign="top"
|
[[Image:passwd-file.png|thumb|right|500px|The /etc/passwd file contains records for users (system accounts and regular-user accounts). There are several fields including: '''Username''', '''password link''' ("x" indicates hashed password stored in /etc/shadow file only accessible by root), '''user-id''', '''primary group-id''', '''user defined field''' (eg. Full Name), '''default home directory''', and '''default shell'''. ]]
|}
=== Part 1: Studying the /etc/passwd file ===
The /etc/passwd file is a database that stores user accounts (both system and regular users). Since we will be learning to create, modify and remove users on our Linux system, we should study this file in order to understand how those user account management commands will affect this file.
'''Perform the following steps:'''
# Launch your c7host and centos1 VMs.
# Open a shell terminal and login as root.
# Look at the <b><code><span style="color:#3366CC;font-size:1.2em;">/etc/passwd</span></code></b> file.
# Make note of the contents of that file.
# Read about the file: http://man7.org/linux/man-pages/man5/passwd.5.html
# Make sure you know what information each field contains.
# Why do you think there are so many users?
# Look at the names of the users. What do you think these user names represent? Are they people?
# What is the numeric user ID (UID) of the root user?
# The user IDs of real users (people) are different from the user IDs of system accounts. What is the pattern?
{| width="40%" align="right" cellpadding="10"
|- valign="top"
|
[[Image:user-management.png|thumb|right|500px|Another essential responsibility for Linux system administrators is to '''add''', '''modify''', and '''remove''' user accounts. ]]
|}
=== Part 2: Adding, Removing, and Modifying Users ===
In this section, we will now learn how to <u>properly</u> add user accounts, remove user accounts, and modify existing user account information.
'''Perform the following steps:'''
# Remain in your '''centos1''' VM for this section.
# Read the man page for the <b><code><span style="color:#3366CC;font-size:1.2em;">useradd</span></code></b> command.
# Create a new user called '''ops235_1''' by issuing the command: <b><code><span style="color:#3366CC;font-size:1.2em;">useradd ops235_1</span></code></b>
# Issue the command: <b><code><span style="color:#3366CC;font-size:1.2em;">grep ops235_1 /etc/passwd</span></code></b> to see if that user account was created.
# View the '''/home''' directory to view the contents. Is the user ops235_1's home directory there?
# Issue the following command to create the user called ops235_2: <b><code><span style="color:#3366CC;font-size:1.2em;">useradd -m ops235_2</span></code></b>
# View the '''/home''' directory to verify that the home directory for '''ops235_2''' has been created. What does the -m option do for the useradd command?
# Issue the following command to remove the user called ops235_2: <b><code><span style="color:#3366CC;font-size:1.2em;">userdel ops235_2</span></code></b>
# Issue the grep command with the /etc/passwd file to verify that the username ops235_2 was removed.
# View the contents of the '''/home''' directory. Was the home directory for user '''ops235_2''' removed? As root, remove that directory. What option do you need to use with the userdel command to automatically remove the user's home directory?
# Issue the userdel comamnd to remove the '''ops235_1''' account with the '''-r option''' (and home directory regardless if it exists or not).
# Recreate the new user (with home directories automatically created) for '''ops235_1'''.
# Use the '''passwd''' command to set the password for the user '''ops235_1'''.
# View the <u>contents</u> for '''ops235_1's''' home directory and note the files.
# Look at the man page for '''/etc/shadow''' using the command: <b><code><span style="color:#3366CC;font-size:1.2em;">man 5 shadow</span></code></b>
# Create a new file in the /etc/skel directory with the following command: <b><code><span style="color:#3366CC;font-size:1.2em;">touch /etc/skel/foo</span></code></b>
# Recreate the new user (with home directories automatically created) for '''ops235_2'''.
# Set the password for the user '''ops235_2'''.
# View the <u>contents</u> for ops235_2's home directory and note the files. What do you notice that is different. What do you think is the purpose of the '''/etc/skel''' directory?
# Be sure to record your observations in your lab notes.
#Issue the man pages for the '''useradd''' command. Explain the purpose of using the '''-e''' option for the ''useradd'' command.
#Issue the following command: <b><code><span style="color:#3366CC;font-size:1.2em;">chage -E 2018-05-31 ops235_1</span></code></b>
#Issue the following command: <b><code><span style="color:#3366CC;font-size:1.2em;">chmod -c "New Name" ops235_2</span></code></b>. View ops235_2's account information in the '''/etc/passwd''' file. What do you notice is different?
# Issue the following command to obtain information regarding the user called ops235_1: <b><code><span style="color:#3366CC;font-size:1.2em;">chage -l ops235_1</span></code></b>. What do you think is the purpose of the chage command and the useradd command with the -e option?
{| width="40%" align="right" cellpadding="10"
|- valign="top"
|
[[Image:group-add.png|thumb|right|300px|When a file is created it is assigned an owner and a default (primary) group. The Linux system administrator can not only change a file's ownership, but also change the default group that file belongs to. In addition, the sysadmin can also add other users to a supplementary group that they have created via the '''usermod''' command. This is useful in setting "same group" permissions via the '''chmod''' command. ]]
|}
=== Part 3: Managing Groups ===
In this section, we will learn how to create, remove and modify groups in our Linux VM. You learned in ULI101 how to change permissions with the '''chmod''' command, but you didn't have admin privileges to create groups to allow directory and regular file sharing. Since you now have admin privileges with your VM, you can now create groups, and add users to this group to allow file-sharing among users.
'''Perform the following steps:'''
#Remain in your '''centos1''' VM for this section.
#Switch to '''ops235_1's''' user account by issuing the following command: <b><code><span style="color:#3366CC;font-size:1.2em;">login ops235_1</span></code></b>
#Create a file called '''information.txt''' in home directory of that user.
#Issue the following command: <b><code><span style="color:#3366CC;font-size:1.2em;">ls -l information.txt</span></code></b>. Who owns that file? What primary group does that file belong to?
#Issue the command <b><code><span style="color:#3366CC;font-size:1.2em;">exit</span></code></b> to return to your root account.
#Issue the following command to create a group called '''welcome''': <b><code><span style="color:#3366CC;font-size:1.2em;">groupadd welcome</span></code></b>
#Issue the command: <b><code><span style="color:#3366CC;font-size:1.2em;">grep welcome /etc/group</span></code></b> file to confirm that group was created.
# Read the man page for the <b><code><span style="color:#3366CC;font-size:1.2em;">usermod</span></code></b> command. Which option allow you to set the Group ID number ('''GID''') when you create a new group? Which options allow you to both append and assign users to an existing group name?
# Issue the usermod command to add both '''ops235_1''' and '''ops235_2''' to the newly-created welcome group.
===Practical Example===
Management has indicated that the "noobie" employee be on on probation for 3 months. As the Linux system administrator, they want you to perform the following steps:
# Remain in your '''centos1''' VM for this section.
# Use the '''useradd''' command to create a user account called: '''noobie''' to expire in 3 months from this date as part of the security policy of this organization.
# Set an appropriate password for this user account.
# Add this newly-created user to the newly-created '''welcome''' group.
# Examine <b><code><span style="color:#3366CC;font-size:1.2em;">/etc/group</span></code></b> to verify that you made the correct operations.
# Use the '''usermod''' command to change the full name of the user account '''noobie''' from '''"Really Green"''' to '''"Outstanding Employee"'''. Examine the result of running that command in the <b><code><span style="color:#3366CC;font-size:1.2em;">/etc/passwd</span></code></b> file. What has changed?
Unfortunately, you were later informed that this "'''noobie'''" employee was caught stealing from the company. They want you to perform the following operations:
# Remove this account, but keep "noobie's" home directory for police investigation purposes.
# Verify that you correctly issued the correct commands.
'''Answer INVESTIGATION 1 observations / questions in your lab log book.'''
=INVESTIGATION 2: Managing System Services and Run-levels=
Many students may think that the following topic is small and "not a big deal". Those students may say, '''"How hard is running and stopping services?"'''
The process may not be hard, but knowing how to stop, start, restart and check the status of services is absolutely critical to a Linux server. '''Aside from learning to trouble-shoot problems''' by checking the status of running services, '''understanding how to manage services is critical to help protect a Linux server from penetration''' (this term is referred to as "'''Hardening a system'''"). Sometimes it is "what we don't know" that can harm us. One key element in hardening a computer system is to disable non essential networkng services to allow IDSs ('''Intrusion Detection Systems''') to focus on a narrower range of policy violations. A Debian-based penetration testing distribution called '''Kali''' (formerly referred to as '''"BackTrax"''') allows sysadmins and security professionals to identify vulnerabilities in their computer systems, and thus improve (harden) their systems against penetration. Learning to monitor the status, enable and disable networking services underlies the '''Backtrax''' motto: '''''"The quieter you are, then more you will hear..."'''''<br><br>
{| width="40%" align="right" cellpadding="10"
|- valign="top"
|
[[Image:manage-service.png|thumb|right|500px|It is important for a Linux system administrator to be able to start/stop, enable/disable and check the status of services on their Linux server. Students will be commonly performing these operations in their OPS335 course when configuring and troubleshooting network services. ]]
|}
=== Part 1: How do we Manage System Services? ===
We have seen that maintaining unneeded '''packages can be a security risk''' due to the unnecessary increase in the complexity of your system. Similarly, it is also unnecessarily hazardous, and even more so, to leave unneeded services running. In this investigation, we will learn how to '''control services, and turn off those services that we think are not necessary to help reduce security risks'''.
Although there is a command called: '''service''' that may appear to manager services on your Linux system, it is considered <u>'''deprecated'''</u> (i.e. "obsolete"). It has been replaced by using the [http://zenit.senecac.on.ca/wiki/index.php/Init_vs_systemd#systemd_Command_Usage systemctl] command.
'''Perform the following steps:'''
#Launch and use your '''centos2''' VM for this part.
<ol>
<li value="2">Use the '''man''' pages to learn about the '''systemctl''' command.</li><li>Issue the following Linux command:
<ul>
<li><b><code><span style="color:#3366CC;font-size:1.2em;">systemctl list-units --all</span></code></b></li>
</ul>
</li>
<li>Note the services that are currently running.</li>
<li>Use the command <b><code><span style="color:#3366CC;font-size:1.2em;">systemctl stop iptables</span></code></b> to stop the service named '''iptables'''</li>
<li>Run the following command to verify that the '''iptables''' service has stopped:<br><b><code><span style="color:#3366CC;font-size:1.2em;">systemctl list-units iptables</span></code></b>.</li>
<li>Issue the following command: <span style="font-family:courier;font-size:1.2em;font-weight:bold;">'''systemctl disable iptables'''</span> (disable iptables service so it does NOT run upon system startup)<br><br></li>
<li>If you reboot now - the iptables service will NOT be turned on upon system boot-up. We don't want it on though at this point anyways since it causes students headaches.</li>
<li>Use the '''systemctl''' command to verify that the '''iptables''' service is no longer running and is disabled.</li>
</ol>
{| width="50%" align="right" cellpadding="10"
|- valign="top"
|
[[Image:grub2_1.png|thumb|right|600px|The purpose of '''Linux servers''' are to run network-based services (i.e. they '''"serve"''' the users that operating in that Linux/Unix system). It is common that these Linux servers are separated (for security purposes) and they are '''run in Command-Line mode only'''. Running these Linux/Unix servers in '''Graphics Mode will make them more vulnerable to penetration from hackers, etc.''' Therefore, it is common that the Linux servers are CLI <u>only</u>, but the Workstations that connect to them within the network are GUI. Therefore, it is important that a Linux/Unix system administrator understand to switch to these different "run-levels". ]]
|}
===Part 2: How do we Manage Runlevels?===
Running servers in graphical mode will make your system most likely to be penetrated. The X-windows framework can be vulnerable to attacks when these servers are connected to the Internet. This is why when you install server versions of Linux, they work in text-based mode only. Desktop versions of Linux are then installed on workstations (working in graphical mode) that connect to the server (for security reasons).
The Linux sysadmin can also change the run-level (or state) of a graphical Linux server to run in text-based mode and run the graphical mode by issuing a command when graphic mode is required. The run-level term is now deprecated in Fedora, and will likely be deprecated in RHEL/CentOS at some point as well, but for now this is what the industry is using.
'''Perform the following steps:'''
#Perform this part in both your '''centos2''' and '''centos3''' VMs.
<ol>
<li value="2">Issue the following Linux command:
<ul>
<li><b><code><span style="color:#3366CC;font-size:1.2em;">runlevel</span></code></b></li>
</ul>
</li>
<li>Note the difference in output between '''centos2''' and '''centos3'''.</li>
<li>You can use the '''init''' command to change the current run-level. See a list of runlevels [https://www.centos.org/docs/5/html/5.2/Installation_Guide/s2-init-boot-shutdown-rl.html here].</li><li> Use the '''man''' command to learn how to use the '''init''' command. Use this command to change the current run-level in '''centos2''' to '''3'''. What happened?</li>
<li>Issue the following Linux command:
<ul>
<li><b><code><span style="color:#3366CC;font-size:1.2em;">startx</span></code></b></li>
</ul>
</li>
<li>What happens?</li>
<li>Log-off your graphical system. You should return to your shell prompt.</li>
<li>Using systemd requires a different method of setting text mode and graphical mode. You can refer to this link for future reference:
[http://fedoraproject.org/wiki/Systemd#How_do_I_change_the_runlevel.3F How to Change Run-Levels with Systemd]</li><li>Restart your centos2 machine, and make certain that it runs in '''graphical''' mode</li>
</li>Why would you want to make a graphical Linux system run in text-based mode?</li>
</ol>
'''Answer INVESTIGATION 2 observations / questions in your lab log book.'''
= INVESTIGATION 3: CREATING LINUX COMMANDS VIA SHELL SCRIPTS=
{|width="40%" align="right" cellpadding="10"
|- valign="top"
|
{{Admon/tip|Bash Shell Scripting Tips:|<br>'''T<u>he case statement</u>'''<ul><li>The case statement is a control-flow statement that works in a similar way as the if-elif-else statement (but is more concise). This statement presents scenerios or "cases" based on values or regular expressions (not ranges of values like if-elif-else statements).<br><br></li><li>After action(s) are taken for a particular scenerio (or "case"), a break statement (''';;''') is used to "break-out" of the statement (and not perform other actions). A default case (*) is also used to catch exceptions.<br><br></li><li>Examples:<br><br>''read -p "pick a door (1 or 2): " pick<br>case $pick in<br> 1) echo "You win a car!" ;;<br> 2) echo "You win a bag of dirt!" ;;<br> *) echo "Not a valid entry"<br> exit 1 ;;<br>esac''<br><br>''read -p "enter a single digit: " digit<br>case $digit in<br> [0-9]) echo "Your single digit is: $digit" ;;<br> *) echo "not a valid single digit"<br> exit 1 ;;<br>esac''<br><br></li></ul>'''<u>The getopts function</u>'''<ul><li>The getopts function allows the shell scripter to create scripts that accept options (like options for Linux commands). This provides the Linux administrator with scripts that provide more flexibility and versatility. A built-in function called '''getopts''' (i.e. get command options) is used in conjunction with a '''while''' loop and a '''case''' statement to carry out actions based on if certain options are present when the shell script is run.<br><br></li><li> The variable '''$OPTARG''' can be used if an option accepts text (denoted in the getopts function with an option letter followed by a colon. Case statement exceptions use the ''':)''' and '''\?)''' cases for error handling.<br><br><li>Example:<br><br>''while getopts abc: name<br>do<br> case $name in<br> a) echo "Action for option \"a\"" ;;<br> b) echo "Action for option \"b\"" ;;<br> c) echo "Action for option \"c\""<br> echo Value is: $OPTARG" ;;<br> :) echo "Error: You need text after -c option"<br> exit 1 ;;<br> \?) echo "Error: Incorrect option"<br> exit 1 ;;<br>esac''<br>done<br><br></li></ul>}}
|}
===Using getopts Function & case statement===
We will now use shell scripting to help automate the task for a Linux adminstrator to create regular user accounts.
'''Perform the following steps:'''
#You will be using your '''c7host''' machine for this section.
#Open a shell terminal, and login as root.
#Change to the '''/root/bin''' directory.
#Download, study, and run the following shell script. Issue the command:<br><b><code><span style=" pointer-events:none;cursor:default;color:#3366CC;font-size:1.2em;">wget https://scs.senecac.on.ca/~murray.saul/user-create.bash</span></code></b>
#Try to understand what these Bash Shell scripts do, and then run the script as root. After running the shell script, view the contents of the '''/home''' directory to confirm.
Although the '''zenity''' command is a "user-friendly" way to run shell scripts, Linux administrators usually create shell scripts that resemble common Linux commands. In this lab, you will learn to create a shell script using the getopts function to make your shell script behave more like actual Linux commands (including the use of options). Refer to the notes section on the right-hand-side for reference about the '''case''' statement and the '''getopts''' function.
<ol><li value="3">Open a Bash shell terminal and login as root.</li><li>Use the wget command to download the input file called user-data.txt by issuing the command:<br><b><code><span style="color:#3366CC;font-size:1.2em;">wget https://scs.senecac.on.ca/~murray.saul/user-data.txt</span></code></b></li><li>View the contents on the user-data.txt file to confirm there are 3 fields (username, fullname, and e-mail address)which are separated by the colon (:) symbol.<li><li>Use a text editor (such as <b><code><span style="color:#3366CC;font-size:1.2em;">vi</span></code></b> or <b><code><span style="color:#3366CC;font-size:1.2em;">nano</span></code></b>) to create a Bash Shell script called: <b><code><span style="color:#3366CC;font-size:1.2em;">createUsers.bash</span></code></b> in /root's home directory.</li><li>Enter the following text content into your text-editing session:</li></ol>
<code style="color:#3366CC;font-family:courier;font-size:.9em;margin-left:20px;font-weight:bold;">
<br>
#!/bin/bash <br>
<br>
# createUsers.bash<br>
# Purpose: Generates a batch of user accounts (user data stored in a text file)<br>
#<br># USAGE: /root/createUsers.bash [-i {input-path}] <br>
#<br>
# Author: *** INSERT YOUR NAME ***<br>
# Date: *** CURRENT DATE ***<br>
<br>
if [ $PWD != "/root" ] # only runs if in root's home directory<br>
then<br> echo "You must be in root's home directory." >&2<br>
exit 1<br>
fi<br>
if [ "$#" -eq 0 ] # if no arguments after command<br>
then<br>
echo "You must enter an argument" >&2<br>
echo "USAGE: $0 [-i {input-path}]" >&2<br>
exit 2<br>
fi<br>
</code>
<br>
<ol><li value="6">Save your editing session, but remain in the text editor.</li><li>The code displayed below uses the getopt function set the input file pathname or check for invalid options or missing option text. Add the following code</li></ol>
<br>
<code style="color:#3366CC;font-family:courier;font-size:.9em;font-weight:bold;">
<br>
outputFlag="n"<br>
while getopts i: name<br>
do<br>
case $name in<br>
i) inputFile=$OPTARG ;;<br>
:) echo "Error: You need text after options requiring text"<br>
exit 1 ;;<br>
\?) echo "Error: Incorrect option"<br>
exit 1 ;;<br>
esac<br>
done<br>
</code>
<ol><li value="6">Save your editing session, but remain in the text editor.</li><li>The code displayed below uses logic to exit the script if the input file does not exist. Command substitution is used to store each line of the input file as a positional parameter. There is one subtle problem here: The full names of the users contain spaces which can create havoc when trying to set each line as a separate positional parameter. In this case the sed command is used to convert spaces to plus signs (+), which will be converted back later. Finally, a '''for''' loop is used to create each account ('''useradd''') and mail the user their account information ('''mail'''). Add the following code:</li></ol>
<br>
<code style="color:#3366CC;font-family:courier;font-size:.9em;font-weight:bold;">
<br>
if [ ! -f $inputFile ]<br>
then<br>
echo "The file pathname \"$inputFile\" is empty or does not exist" >&2<br>
exit 2<br>
fi<br>
<br>
set $(sed 's/ /+/g' $inputFile) # temporarily convert spaces to + for storing lines as positional parameters<br>
<br>
for x<br>
do<br>
userPassWd=$(date | md5sum | cut -d" " -f1)<br>
useradd -m -c "$(echo $x | cut -d":" -f2 | sed 's/+/ /g')" -p $userPassWd $(echo $x | cut -d":" -f1)<br>
mail -s "Server Account Information" $(echo $x | cut -d":" -f3) <<+<br>
Here is your server account information:<br>
servername: myserver.senecac.on.ca<br>
username: $(echo $x | cut -d":" -f1)<br>
password: $userPassWd<br>
Regards,<br>
IT Department<br>
+<br>
done<br>
<br>
echo -e "\n\nAccounts have been created\n\n"<br>
exit 0<br>
</code>
<ol>
<li value="8">Save, set permissions, and then run that shell script for the input text file '''user-data.txt'''. Did it work? Try running the script without an argument - What did it do? </li><li>You have completed lab4. Proceed to Completing The Lab, and follow the instructions for "lab sign-off".</li></ol>
'''Answer INVESTIGATION 3 observations / questions in your lab log book.'''
= LAB 4 SIGN-OFF (SHOW INSTRUCTOR) =
{{Admon/important|Time for a new backup!|If you have successfully completed this lab, make a new backup of your virtual machines as well as your host machine.}}
'''Perform the Following Steps:'''
# Make certain that your '''c7host''', '''centos1''' and '''centos2''' VMs are running.
# Switch to your '''centos1''' VM.
# Open a shell terminal, and issue the Linux command: <b><code><span style="color:#3366CC;font-size:1.2em;">wget http://matrix.senecac.on.ca/~murray.saul/ops235/lab4-check.bash</span></code></b>
# Give the '''lab4-check.bash''' file execute permissions (for the file owner).
# Run the shell script and if any warnings, make fixes and re-run shell script until you receive "congratulations" message.
#Arrange proof of the following on the screen:<br><blockquote><span style="color:green;font-size:1.5em;">✓</span> '''centos1''' VM:<blockquote><ul><li>Output from running the '''lab4-check.bash''' script with all OK messages</li></ul></blockquote><span style="color:green;font-size:1.5em;">✓</span> '''centos2''' VM:<blockquote><ul><li>Display current run-level status on '''centos2''' VM</li></ul></blockquote><span style="color:green;font-size:1.5em;">✓</span>'''c7host''' machine<blockquote><ul><li>Creation of your bash shell script called '''createUsers.bash'''</li></ul></blockquote><span style="color:green;font-size:1.5em;">✓</span> '''Lab4''' log-book filled out.
= Practice For Quizzes, Tests, Midterm & Final Exam =
# Describe all of the field in <code>'''/etc/passwd'''</code>
# What is the command to create a user? What option to create a home directory for that user?
# What is the command to change the full name of an already-created user?
# What is the command to delete a user account? What option allows for the user's home directory to be removed as well?
# What is the command to create a group? What is the command (or steps) to include a user in a newly-created group?
# What is the purpose of <code>'''/etc/shadow'''</code>?
# What is the purpose of <code>'''/etc/skel'''</code>?
# What does the term run-level mean?
# How to set the run-level of a Linux system to text-based only? How to set to graphical mode?
# What is the command to view the status of running services?
# What is the command to start a service (like httpd, or sshd)?
# What is the command to stop a service (like httpd, or sshd)?
# What is the difference between '''starting''' a service and '''enabling''' a service?
# Can a service be stopped and started by issuing just one command?
# What is the purpose of the '''case''' statement in shell scripting?
# What is the purpose of the '''getopts''' function in shell scripting?
# What type of shell script would be best to automatically create 1200 user accounts (which a list of usernames are stored in a text-file)?
[[Category:OPS235]]
[[Category:OPS235 Labs]]
