Linux Administration

searches a broader range of system directories and is independent of your shell’s search path

consults a precompiled index of the filesystem to locate file

• Login name required
• Encrypted password required
• Date of last password change
• Minimum number of days between changes
• Maximum number of days between password changes
• Number of days in advance to warn users about password expiration
• Linux: Days after password expiration that account is disabled
• Account expiration date
• A reserved field that is currently always empty

• Group name
• Encrypted password or a placeholder
• GID number
• List of members, separated by commas

It is possible to enter a group password to allow users not belonging to a group to enter it with the newgrp command.

A password can be set with the gpasswd command

A user’s personal group should contain only that user. If you want to let users share files by way of the group mechanism, create separate groups for that purpose

mark, ed    SOME_HOST_ALIAS=ALL
herb    SOME_HOST_ALIAS=/usr/sbin/tcpdump : !SOME_HOST_ALIAS=(operator) DUMP
lynda    ALL=(ALL)ALL, !SOME_CMND_ALIAS
%wheel    ALL, !SOME_HOST_ALIAS = NOPASSWD: SOME_CMND_ALIAS

Whitelist the environment variables by adding them to the sudoers file’s env_keep list

• usermod -L to lock user
• usermod -U to unlock user

• The process’s address space map
• The current status of the process (sleeping, stopped, runnable, etc.)
• The execution priority of the process
• Information about the resources the process has used (CPU, memory, etc.)
• Information about the files and network ports the process has opened
• The process’s signal mask (a record of which signals are blocked)
• The owner of the process

kill -l to list signals.

• killall: kill by process name
• pkill: search for process to kill

Useful options

• aux: a show all processes; x show processes that don't have a control terminal; u user oriented output format
• lax: faster than aux(UID only), aslo includes PPID, NI(niceness) and wait channel
  • ww: enable unlimited column width

1: show loads of individual cores

• H: show threads

• Niceness range: -20 to 19
• Only root can run a command with high priority
• renice

ps and top read their process status information from the /proc directory

Display every system call that a process makes and every signal it receives

• -f to trace sub processes

• uptime: load average of 1-, 5-, 15-minute intervals(cpu&io)

• fuser
• lsof: list open files

• crontab
• systemd timer

• R: Running/Runnable
• D: Disk Sleep (Uninterruptible Sleep)
• Z: Zombie
• S: Interruptible Sleep
• I: Idle

1. mkfs.type
2. mount -t type /dev/sda [mountpoint]
3. umount [mountpoint]

/etc/fstab

lists filesystems that are normally mounted on the system.

fuser -c mountpoint

prints the PID of every process that’s using a file or directory on that filesystem. uses -v to display command name

lsof

alternative to fusr, -F for easy parsing

• investigating file type: file or ls

  Symbol	Type	Created by
  -	regular file	editors
  d	directory	mkdir
  c	character device file	mknod
  b	block device file	mknod
  s	domain socket
  p	named pipe	mknod
  l	symbolic link	ln -s

• man hier

• /boot/grub/grub.cfg, which are used to configure the boot loader
• /boot/vmlinuz, the Linux kernel
• /etc/crontab, a file that defines when automated jobs will run
• /etc/fstab, a table of storage devices and their associated mount points1

• Collecting logs from a variety of sources
• Providing a structured interface for querying, analyzing, filtering, and monitoring messages
• Managing the retention and expiration of messages so that information is kept as long as it is potentially useful or legally required, but not indefinitely

• Rudimentary
• Message collection only
• Sorts messages and saves them to files or forwards them to another host over the network.
• New implementation is rsyslogd origin daemon is syslogd
• Programs that are syslog aware write log entries to the special file /dev/log, a UNIX domain socket.
• A HUP signal causes rsyslogd to close all open log files, which is useful for rotating (renaming and restarting) logs
  • rsyslogd's PID is in /var/run/syslogd.pid
  • sudo kill -HUP `/bin/cat /var/run/syslogd.pid`

The journal collects messages, stores them in an indexed and compressed binary format, and furnishes a command-line interface for viewing and filtering logs.

• The ELK stack

• It's often helpful to define /var/log as a separate disk partition or filesystem
• last command to decode wtmp
• lastlog command to show lastlog

• logrotate is normally run out of cron once a day.
• Configuration file: /etc/logrotate.d
• Alternatively, a simpler program called savelog that manages rotation for individual files.

Answers four questions:

• How many systems and applications will be included?
• What type of storage infrastructure is available?
• How long must logs be retained?
• What types of events are important?

For most applications, consider capturing at least the following information:

• Username or user ID
• Event success or failure
• Source address for network events
• Date and time (NTP)
• Sensitive data added, altered, or removed
• Event details

Suggestions:

• 20 servers is a reasonable threshold for considering centralization
• Include log files in a monitoring solution that alerts you if a log file stops growing.

• command: slapd
• cluster: slurpd (master server)

• configuration: /etc/openldap/slapd.conf

  database bdb # default: Berkely DB
  suffix "dc=mydomain,dc=com" # LDAP basename, like DNS domain name
  rootdn "cn=admin,dc=mydomain,dc=com" # administrator name
  rootpw {crypt}abcDEFg/uiR # hashed password
  directory /var/lib/ldap
  

• configuration: /etc/openldap/lapd.conf, set the base to the same value as the suffix

  BASE dc=mydomain,dc=com
  URI ldap://xxx.mydomain.com
  

• use slappasswd to change password

Advantages:

• Multimaster replication
• Active Directory user and group synchronization
• A graphical console for all facets of user, group, and server management

command-line tool

BIND

Berkeley Internet Name Domain. Most common DNS implementation.

• dig +trace

• uname -a
• lsb_release -a

• which: Display which executable program will be executed.
• man: Display a command’s manual page.
• apropos: Display a list of appropriate commands. same as man -k
• info: Display a command’s info entry.
• whatis: Display a very brief description of a command.

• $0: command
• $1, $2: arguments
• $#: argument count
• $*: all arguments
• $?: return value of last command

• eq, ne, lt, le, gt, ge, -n, -z
• file: -d, -e, -f, -r, -s, -w, -nt(newer than), -ot(older than)

find . -name '*log '
find . -type f -name '*.log '
find . -type f -name '*.log ' | grep -v .do-not-touch
find . -type f -name '*.log ' | grep -v .do-not-touch | while read fname
do
echo mv $fname ${fname/.log/.LOG/}
done
# finally
find . -type f -name '*.log ' | grep -v .do-not-touch | while read fname; do
echo mv $fname ${fname/.log/.LOG/}; done | bash -x

bash -x prints each command before executing it. Use fc to transfer last command to editor.

• $0: name of the script
• $1: first argument
• $#: the number of arguments
• $*: contains all the arguments at once
• echo $?: the exit status of the last command executed

• /proc/cpuinfo
• /proc/meminfo
• /proc/diskstats
• dmidecode -t

• apt install sysstat
• vmstat 5 5: 5 updates; delay between updates is 5 secs
• mpstat -P ALL
• uptime
• ps -aux
• pidstat
• dstat
• perf top, perf record, perf report

• /proc/sys/vm/swappiness
• swapon -s

• iostat 5 5
• xdd
• sar -[ndA]

• stress