Network Configuration (Files and Commands)

Files

/etc/hostname – holds the hostname
/etc/hosts – file mapping of IP addresses – hostnames
/etc/networks – maps network addresses -names
/etc/host.conf – replaced by nsswitch
/etc/resolv.conf – client dns configuration
/etc/services – maps port numbers to names
/etc/nsswich.conf – name service switch configuration file, determines how system looks up name and various other things.

Commands

ifconfig – show and configure network interfaces
route – show and configure network routes
dhcpcd, dhcpclient, pmp – DHCP clients
dig – tests DNS servers
host – query and debug DNS servers
hostname – display hostname, and NIS domaind setting
netstat – shows what service is listening on what port
ping – sends ICMP echo request to hosts
traceroute – show the path (display routes) that a network connection takes.
mtr – works like traceroute in real time
tcpdump – packet sniffer command that displays the contents of packets received on a network interface.
route -n – view the routing table
whois – queries information about the owner of the domain

Netstat
netstat -a -u -t – Prints ports in use
netstat -r – Prints routing table
netstat -i – Prints interfaces
netstat -g – Prints multicast groups
netstat -M – Prints masqueraded connections
netstat -s – Prints statistics

System Logs

Files

/etc/syslog.conf – configuration file for sysylogd in Red Hat
/etc/rsyslog.conf – configuration file for syslogs in Debian. Consists rules of the form: (facility) .(level ) (action)

rsyslog.conf contains:

# Include all config files in /etc/rsyslog.d/
#
$IncludeConfig /etc/rsyslog.d/*.conf
less 50   
...
...
...
/var/log/* # log files are found

syslog facility shows where the log messages come from:
authpriv — security/authorization messages (private)
cron — clock daemon (cron and at)
daemon — system daemons without separate facility
value
ftp — ftp daemon
kern — kernel messages
local0. . . local7 — reserved for local use
lpr — line printer subsystem
mail — mail subsystem
news — USENET news subsystem
syslog — messages generated internally by syslogd
user — generic user-level message
uucp — UUCP subsystem

security threshhold beyond which messages are logged in decreasing importance:
emerg — system is unusable
alert — action must be taken immediately
crit — critical conditions
err — error conditions
warning — warning conditions
notice — normal, but significant, condition
info — informational message
debug — debug-level message

syslog actions can be:
– filename (with full pathname), or
– a hostname preceded with ‘@’, or
– a comma-separated list of users, or
– an asterisk ‘*’ meaning all logged in users

logrotate

logrotate rotates, compresses, and mails system logs. Main configuration file is stored in /etc/logrotate.conf but most configuration belongs to the software packages, which put a file into directory /etc/logrotate.d/.

Examining Log Files

tail -f – watch log files in real time
e.g.:

sudo tail -f /var/log/messages
sudo less /var/log/messages

each syslog message contains:
date and time – machine’s local time
hostname – hostname of the ,achine that generated the message
program or user – that generates the message
message text

Scheduling Jobs

at

at runs a command once. at takes a time and a list of commands to run. Any output to STDOUT or STDERR will be mailed to the user running at.

e.g.:

at 5pm
at> date
at> ^D

Commands:
atrm – remove jobs, identified by job number
syntax:
atrm job#

atq – lists a user’s pending jobs
syntax:
atq

at -c – to dump the job on STDOUT
syntax
at -c job#

at File Formats:
17:36 – Run at 5:36pm today or tomorrow.
9pm May 8 – Run at 9pm on May 8th.
noon tomorrow – Run at 12pm tomorrow.
now + 2 hours – Run in 2 hours.

cron

cron runs a command periodically.

crond is a daemon that reads everyone’s crontab information. crontab is located in /etc/crontab.

/etc/crontab contains:

# /etc/crontab: system-wide crontab
# Unlike any other crontab you don't have to run the `crontab'
# command to install the new version when you edit this file
# and files in /etc/cron.d. These files also have username fields,
# that none of the other crontabs do.

SHELL=/bin/sh
PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin

# m h dom mon dow user  command
17 *    * * *   root    cd / && run-parts --report /etc/cron.hourly
25 6    * * *   root    test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.daily )
47 6    * * 7   root    test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.weekly )
52 6    1 * *   root    test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.monthly )
#

Commands:
crontab file – replace crontab file with file.
crontab -l – list crontab.
crontab -r -remove crontab.
crontab -e – edit crontab (with $EDITOR).

crontab File Format
minute (0-59)
hour (0-23)
day of month (1-31)
month (1-12 or jan-dec)
day of week (0-7 or sun-sat)

e.g.:

0 7 1 jan * echo "sleep in, you dont feel so good"
# gratuitous noise
0 17 * * mon,wed,fri wall%meeting in 5 minutes%
0 9-18/2 * * mon-fri $HOME/bin/cron.bihourly

anacron

anacron runs any missed jobs after reboot. It is located in /etc/anacrontab.

/etc/anacrontab contains:

# /etc/anacrontab: configuration file for anacron

# See anacron(8) and anacrontab(5) for details.

SHELL=/bin/sh
PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin

# These replace cron's entries
1       5       cron.daily       nice run-parts --report /etc/cron.daily
7       10      cron.weekly      nice run-parts --report /etc/cron.weekly
@monthly        15      cron.monthly nice run-parts --report /etc/cron.monthly

Frequency of anacron jobs can only be specified in days.

System Time (Files and Commands)

Important Files

/usr/share/zoneinfo — contains time zone information for many different regions
/etc/timezone — holds the timezone
/etc/localtime — a symbolic link to the correct file in /path/usr/share/zoneinfo/
etc/ntp.conf — configuration file for NTP
/etc/ntp.drift — where NTP stores correction for local clock being fast/slow

Commands

date — display/set system time
hwclock — query and set the hardware clock (RTC)
ntpdate — used to set system date and time via NTP

The Hardware and The System Clock

The hardware or Real Time Clock (RTC) hardware clock is located on the motherboard.
System Clock is maintained in the Linux kernel and is used while the system is running.

hwclock options

Set the system time from the RTC

hwclock -s or hwclock --hctosys

Set the RTC from the system time

hwclock -w or hwclock --systohc

Display the contents of the RTC

hwclock -r or hwclock --show 

Ajust the RTC for clock drift

hwclock -a or hwclock --adjust

The file /etc/adjtime is used to hold information about the extent to which (and direction) the RTC drifts.

Managing Group Accounts (Files and Commands)

/etc/group contains group account information.

Format:
groupname:password: GID:userlist

e.g.:

admin:x:119:diane
ssh:x:109:

/etc/gshadow contains group passwords.

Format:
groupname:password:administrators:members

e.g.:

diane:!::

Commands:

chage – change user password expiry information

gpasswd – change group membership, group passwords

groupadd – create a group

groupdel – delete a group

groupmod – modify a group

grpconv – moves all group password information to /etc/gshadow

grpunconv – creates group from group and gshadow and then removes gshadow

Shared password is not recommended, so do not use group passwords unless necessary.

In adding a user to a group, usermod removes user from any groups not specified, instead use gpasswd. gpasswd adds the new user without removing the new user from any existing group memberships.
syntax:
gpasswd -a user group

Managing User Accounts (Files and Commands)

etc/passwd contains the user account information(for human or non-human users). Non-human users like sshd also owns files and run processes.

Format:
username:password:userid:groupid:GECOS:homedirectory:loginshell

e.g:

diane:x:1000:1000:Diane Palo,,,:/home/diane:/bin/bash
sshd:x:115:65534::/var/run/sshd:/usr/sbin/nologin

All added users will have a userid of greater than or equall to 1000.

To suspend an account, replace the login shell to bin/false or sbin/nologin to prevent the user from logging in to the machine. Setting the login shell to bin/false or sbin/nologin is used to create limited accounts.

/etc/shadow contains user password information.

Format:
username
:password
:days since Jan 1, 1970 that password was last changed
:days before password may be changed
:days after which password must be changed
:days before password is to expire that user is warned
:days after password expires that account is disabled
:days since Jan 1, 1970 that account is disabled
:a reserved field

e.g:

diane:$6$CnGqE0NA$iLrquxZUS6bqnAbffVNtS/BRy2CB/abthemvhyUHm9A5EK8YdZtj0fSAEhUg8B2YConm0hXCuJsaItAr6RU5R1:15165:0:99999:7:::

Password is encypted, a hash of the password.

Add ‘!’ to disable an account temporarily or sudo passwd -l username.
Remove ‘!’ to enable the account or sudo passwd -u username.
To change user password expiry information, use chage username.

Commands:
passwd – change password
syntax:
passwd password

pwconv – moves all user password information from /etc/
passwd to /etc/shadow
syntax:
pwconv

pwunconv – moves all password information from /etc/shadow to /etc/passwd then deletes /etc/shadow
syntax:
pwunconv

useradd – create an account
syntax:
adduser username

userdel – delete an account
syntax:
userdel username

usermod – modify an account
syntax:
usermod username

Other Commands:

finger – display user’s information.
syntax:
finger username

chfn – change user’s information.
syntax:
chfn username

The Kernel: Loading and Removing Modules

The kernel is the heart of the Operating System. Linux Kernel could be Monolithic or Modular. A monolithic kernel supports everything (hardware, network, file systems) compiled from a single file; mostly used in embedded systems. A Modular kernel comprises of some drivers compiled as object files, which can be loaded or removed anytime. Modular kernel doesn’t need to be always recompiled when a hardware is added.

To check you current kernel version, enter the command:
uname -a
uname -r

More on Modular Kernel…
The modular kernel consists of the kernel itself and athe kernel modules.
All modules of a kernel are stored in /lib/modules/$(uname -r) and have a file extension of ko.

Controlling Kernel modules: utilities supplied by nmdutils package

lsmod – lists currently loaded kernel modules
syntax:

lsmod

rmmod – low level command used to remove a module
syntax:

rmmod modulename

insmod – low level command used to insert a module
syntax:

insmod filename

modinfo – display module details

depmode – determines module dependencies and rebuilds /lib/modules/kernel-version/modules.dep

modprobe – loads and removes modules, takes care of dependencies. configuration files is stored in /etc/module.conf & /etc/conf.modules.
syntax:

sudo modprobe modulename

sudo modprobe -r modulename

e.g.

sudo modprobe vfat
lsmod  | grep fat output:
vfat	17335	0
fat	55505	1 vfat

sudo modprobe -r vfat
lsmod | grep fat output:
--output blank--

Find Files and Commands in Linux

find – search a file from a certain criteria.
syntax:

find directory criteria [-exec command {} \;]

e.g.:

remove all files belonging to user 502:
find / - type f -user 502 –exec rm –f {} \;

locate – list all files and directories that match the expression.
syntax:

locate string

locate queries the /var/lib/slocate/slocate.db database. This database is kept up to date via a daily cron job which runs updatedb. updatedb read /etc/updatedb.conf file. The Security Enhanced version of the GNU locate is slocate.

whereis – return the full path to source or binaries as well as documentation files matching string by scanning the PATH variable as well as a number of well known locations.
syntax:

whereis string

which – return the full path to the file called string by scanning the directories defined in the user’s PATH variable only. which is only used to find commands.
syntax:

which string

apropos – search manual page names and description.
syntax:

apropros string

whatis – display manual page description.
syntax:

whatis string

Creating Hard and Symbolic Links

What’s the difference between soft link and hard link?

A soft link to a file/directory is the new inode created that points to the same data and it can be created across filesystems. A hard link is an additional name for the same inode and it can only be created within the same filesystem. The reference count for soft link is 1 while reference count for hard link increases by one every new hard link.

The syntax for soft link and hard link are:

ln -s filename softlinkname
ln filename hardlinkname

Creating a hard and soft link from the sample file
e.g.

ln -s sample sample.sl
ln sample sample.hl

ls -l output:
-rw-r--r-- 2 dhee dhee 27 2011-08-31 12:56 sample
lrwxrwxrwx 1 dhee dhee 6 2011-08-31 12:56 sample.sl -> sample
-rw-r--r-- 2 dhee dhee 27 2011-08-31 12:56 sample.hl

Speed Up Package Downloads and Updates with apt-fast

Use apt-fast instead of apt-get for faster download speed in downloading and updating packages in Ubuntu.

To use apt-fast:

1. Download the file apt-fast.sh from http://www.mattparnell.com/linux/apt-fast/.
2. Rename the file to apt-fast [mv apt-fast.sh apt-fast].
3. Move the file to /usr/bin [mv apt-fast /usr/bin].
4. Add execution permission to the file [chmod +x apt-fast].
5. Use apt-fast to download/upload packages.

apt-fast install package

apt-fast update

Faster downloading and updating time with apt-fast!