ATTENTION PLEASE

When you see slides with a white background:

• listen to your instructor
• takes note if you want
• ask questions ;)

🚀 HANDS-ON

When you see slides with a colored background:

• do the exercices
• talk to your instructor
• ask questions ;)

AGENDA

FEW DAYS WITH 

• Command line
• Shell expansion
• Pipes and commands
• vi
• Scripting
• Local user management
• File security

Back to basics

Computer ?

What's inside ?

Processor ?

Computer ?

• Personnal Computer
  • Workstation, Laptop
  • Mac
  • ...
• Terminal
• Service

Server ?

Client-Server ?

Operating System

• Human / Machine interface:
  • Textual
  • Graphical
• Management role:
  • Resources (files, memory, devices)
  • Users data & applications
  • Conflicts btw users (multi-user architecture)
• Ex: Windows, Linux, UNIX, MacOS, AS400
• Commande language: shell/DOS, powershell ...

Back to basics #2
Computer Networks

Networking

Computer Network
 

 A collection of computing devices that are connected in various ways in order to communicate and share resources.

  Usually, the connection between computer in a network are made using physical wires or cables.

  However, some connections are wireless, using radio waves or infrared signals.

Networking

• The generic term node or host refers to any device on a network.
• Data transfer rate - The speed with which data is moved from one place on a network to another.
• Data transfer rate is a key issue in computer networks.

Networking

• Computer networks have opened up an entire frontier in the world of computing called the client/server model

Networking

• File server - A computer that stores and manages files for multiple users on a network.
• Web server - A computer dedicated to responding to requests (from the browser client) for web pages.

Types of Networks

• Local-area network (LAN) - A network that connects a relatively small number of machines in a relatively close geographical area.

Types of Networks

• Various configurations, called topologies, have been used to administer LANs
  • Ring topology - A configuration that connects all nodes in a closed loop on which messages travel in one direction.
  • Star topology - A configuration that centers around one node to which all others are connected and through which all messages are sent
  • Bus topology - All node are connected to a single communication line that carries messages in both directions

Types of Networks

Types of Networks

• Wide-area network (WAN) - A network that connects two or more local-area networks over a potentially large geographic distance.

Often one particular node on a LAN is set up to server as a gateway to handle all communication going between that LAN and other networks.

Communication between networks is called internetworking. The Internet, as we know it today, is essentially the ultimate wide-are network, spanning the entire globe.

Types of Networks

• Metropolitan-area network (MAN) - The communication infrastructures that have been developed in and around large cities.

So, who owns the Internet?

Well, nobody does. No single person or company owns the Internet or even controls it entirely. As a wide-are network, it is made up of many smaller networks. These smaller networks are often owned and managed by a person or organization.

The Internet, then, is really defined by how connections can be made between these networks.

Internet Connections

• Internet backbone - A set of high-speed networks that carry Internet traffic. These network are provided by companies such as AT&T, GTE, IBM, ...
• Internet service provider (ISP) - A company that provides other companies or individuals with access to the Internet.

Internet Connections

• There are various technologies available that you can use to connect a home computer to the Internet :
  • A phone modem - converts computer data into an analog audio signal for transfer over a telephone line, and then a model at the destination converts it back again into data.
  • A digital subscriber line (DSL) uses regular copper phone lines to transfer digital data to and from the phone company's central office
  • A cable model uses the same line that you cable TV signals come in on to transfer the data back and forth.

Internet Connections

• Broadband - A connection in which transfer speeds are faster than 128 bits per second
  • DSL connections and cable modems are broadband connections
  • The speed for downloads (getting data from the Internet to your home computer) may not be the same as uploads (sending data from your home computer to the Internet).

Packet Switching

• To improve the efficiency of transferring information over a shared communication line, messages are divided into fixed-sized, numbered packets.
• Network devices called routers are used to direct packets between networks.

Open Systems

• Proprietary system - A system that uses technologies kept private by a particular commercial vendor.
• Interoperability - The ability of software and hardware on multiple machines and from multiple commercial vendors to communicate.
• Open systems - Systems based on a common model of network architecture and a suite of protocols used in its implementation.

Network Protocols

• Network protocols are layered such that each one relies on the protocols that underlie it
• Sometimes referred to as a protocol stack

TCP/IP

• TCP stands for Transmission Control Protocol
  • TCP software breaks messages into packets, hand them off to the IP software for delivery, and the orders and reassembles the packets at their destination.
• IP stands for Internet Protocol
  • IP software deals with the routing of packets through the maze of interconnected networks to their final destination.

TCP/IP (cont.)

• UDP stands for User Datagram Protocol
  • It is an alternative to TCP
  • The main difference is that TCP is highly reliable, at the cost of decreased performance, while UDP is less reliable, but generally faster.

High-Level Protocols

• Other protocols build on the foundation established by the TCP/IP protocol suite
  • Simple Mail Transfer Protocol (SMTP)
  • File Transfer Protocol (FTP)
  • Telnet
  • Hyper Text Transfer Protocol (HTTP)

MIME Types

Firewalls

• Firewall - A machine and its software that serve as a special gateway to a network, protecting it from inappropriate access
  • Filters the network traffic that comes in, checking the validity of the messages as much as possible and perhaps denying some messages altogether
  • Enforces an organization's access control policy

Network Addresses

• Hostname - A unique identification that specifies a particular computer on the Internet
  • For example :
    • ipme07.northeurope.cloudapp.azure.com

Network Addresses

• Network software translates a hostname into its corresponding IP address
  • For example

    • ipme07.northeurope.cloudapp.azure.com
                ==
      40.112.67.50

Network Addresses

• An IP address can be split into :
  • Network address, which specifies a specific network
  • Host number, which specifies a particular machine in that network

Domain Name System

• A hostname consists of the computer name followed by the domain name
• A domain name is separated into two or more sections that specify the organization, and possibly a subset of an organization, of which the computer is a part
• Two organizations can have a computer named the same thing because the domain name makes it clear which one is being referred to.

Domain Name System

• The very last section of the domain is called its top-level domain (TLD) name

Domain Name System

• Organizations based in countries other than the United States use a top-level domain that corresponds to their two-letter country codes

Domain Name System

• The domain name system (DNS) is chiefly used to translate hostnames into numeric IP addresses
  • DNS is an example of distributed database
  • If that server can resolve the hostname, it does so
  • If not, that server asks another domain name server

History

Birth of free software

1983 - Richard Stallman, GNU project and free software concept

==> Beginning of the development off gcc, gdb, glibc and important other tools

1991 - Linux Torvalds, Linux kernel project, an Unix-like operating system kernel

==> Together with GNU software and many other open-source components: a completely free operating system : GNU/Linux

1995 - Linux on server systems

2000 - Linux on embedded systems

2008 - Linux on mobile devices

2010 - Linux on phones

Free software ?

A program is considered free when its license offers to all its users the following 4 freedoms :

1. ​Freedom to run the software for any purpose
2. Freedom to study the software and to change it
3. Freedom to redistribute copies
4. Freedom to distribute copies of modifies versions

These freedoms are granted for both commercial and non-commercial use.

They imply the availability of source code, software can be modified and distributed to customers.

Linux philosophy

There are nine major tenets to the Linux philosophy:

1. Small is beautiful
2. Each program does one thing well
3. Build a prototype as soon as possible
4. Choose portability over efficiency
5. Store data in flat text files
6. Use software leverage to your advantage
7. Use shell scripts to increase leverage and portability
8. Avoid captive user interface
9. Make every program a filter

Linux distributions

Distribution = Kernel + Application + Branding

Linux

• Powerful
• Runs on multiple hardware platform
• Users like its speed and stability
• No requirement for the latest hardware
• It's "free"
• Licensed under GPL
• Vendors are distributors who packages Linux

Linux

Multi-user

 A multi-user OS allows for multiple users to use the same computer at the same time and/or different time

Multi-processing

  An operating system capable of supporting and utilizing more than one computer processor

Multi-tasking

  An operating system capable of allowing multiple software processes to run at the same time

Multi-threading

  OS that allows different parts of a software program to run concurrently

Linux

COMMAND LINE

COMMAND LINE

MAN PAGES

man

Press q to quit

whatis

To see just the description of a manual page, use whatis followed by a string

whereis

whereis locates source/binary and manual sections for specified files.

COMMAND LINE

WORKING WITH DIRECTORIES

pwd

The tool displays your current directory.

cd

Change your current directory.

ls

Display directory content.

mkdir

Create your own directories with mkdir.

rmdir

Use rmdir to remove a directory.

🚀 HANDS-ON

1. Display your current directory
2. Change to /tmp
3. List the content of /tmp directory
4. Create the useless folder useless/
5. Remove the directory useless/

COMMAND LINE

WORKING WITH FILES

FACTS

1. All files are case sensitive
2. Everything is a file ! 

file

file utility determines the file type.

touch

One easy way to create an empty file is with touch.

rm

Use rm to remove a file.

cp

Use cp to copy a file/directory.

mv

Use mv to rename a file/directory.

🚀 HANDS-ON

1. List files of /bin directory
2. Display the file type of /bin/cat, /etc/passwd, /etc/shadow
3. Create a directory ~/pets and enter it.
4. Create files wolf.txt and cat.txt
5. Rename cat.txt to unicorn.txt
6. Copy unicorn.txt in dragon.txt
7. Remove all *.txt files in ~/pets folder

COMMAND LINE

WORKING WITH FILES CONTENT

head

Use head to display the first ten lines of a file.

tail

Use tail to display the last ten lines of a file.

cat

Use cat to display a file on the screen.

tac

Use tac to display a file (backwards) on the screen.

🚀 HANDS-ON

1. Display the first 12 lines of /etc/services.
2. Display the last line of /etc/passwd.
3. Use more to display /etc/services.
4. Use ls to find the biggest file in /etc.
5. Display /var/log/ files based on last modified time (in reverse order)

COMMAND LINE

THE LINUX FILE TREE

THE ROOT DIRECTORY /

All Linux systems have a directory structure that starts at the root directory. The root directory is represented by a forward slash, like this: /.

BINARY DIRECTORIES

Binaries are file that contains compiled code (or machine code). Binaries can be executed on the computer. Sometimes binaries are called executables.

/opt

The purpose of /opt is to store optional software. In many cases this is software from outside the distribution repository. You may find an empty /opt directory on many systems.

CONFIGURATION DIRECTORIES

The /boot directory contains all files needed to boot the computer. These files don't change very often.

/etc: contains (almost) all of the machine-specific configuration files.

DATA DIRECTORIES

IN-MEMORY DIRECTORIES

/usr UNIX SYSTEM RESOURCES

The /usr hierarchy should contain shareable, read only data.

/var VARIABLE DATA

Files that are unpredictable in size, such as log, cache shoud be located in /var.

🚀 HANDS-ON

1. Does the file /bin/cat exist ? What about /bin/dd and /bin/echo ? What is the type of these files ?
2. Use cat to display /etc/hosts and /etc/resolv.conf. What is your idea about the purpose of these files ?
3. Are there any files in /etc/skel ? Check also hidden files
4. Display /proc/cpuinfo. On what architecture is your Linux running ?
5. Is /var/log a file or a directory ? What about /var/spool ?

SHELL EXPANSION

SHELL EXPANSION

COMMANDS AND ARGUMENTS

Commands and arguments

The command line interface or shell used on most Linux systems is called bash, which stands for Bourne again shell.

The bash shell incorporates features from sh (the original Bourne shell), csh (the C shell) and ksh (the Korn shell).

echo

Display each argument it receives from the shell

type

To find out whether a command given to the shell will be executed as an external command or as a builtin command.

which

To search for binaries in the $PATH environment variable.

alias

Alias are often used to create an easier to remember name for an existing command.

🚀 HANDS-ON

1. Is tac a shell builtin command ?
2. Is there an existing alias for rm ?
3. Execute: alias rm='rm -i'. Test you alias with a test file. Does this work as expected ?
4. Read the man page of rm, make sure you understand the -i option of rm. Create and remove a file to test the -i option.
5. List all current aliases.

SHELL EXPANSION

CONTROL OPERATORS

; semicolon

Put two or more commands on the same line separated by ;

& ampersand

When a line ends with an ampersand &, the shell will not wait for the command to finish.

&& double ampersand

Shell interprets && as a logical AND

|| double vertical bar

|| represents a logical OR.

combining && and ||

MISCELLANEOUS

🚀 HANDS-ON

1. When you type passwd, which file is executed ? What kind of file is that ?
2. Execute ls after cd /etc, but only if cd /etc did not error.
3. Execute cd /etc after cd etc, but only if cd etc fails.
4. Echo it worked when touch test42 works, and echo it failed when the touch failed. All on one command line. Test it in your home directory and in /bin/.
5. Execute sleep 6, what is this command doing ?

SHELL EXPANSION

SHELL VARIABLES

$ dollar sign

The shell will look for an environment variable named like the string following the dollar sign and replace it with the value.

creating variables

set / unset

Use the set command to display a list of environment variables.

Use the unset command to remove a variable from your shell environment.

$PATH

The $PATH variable is determines where the shell is looking for commands to execute (unless the command is builtin or aliased). This variable contains a list of directories, separated by colons.

env

env commands without options will display a list of exported variables.

set lists all variables, including those not exported to child shells.

env can also be used to start a clean shell. 

export

You can export shell variables to other shells with the export command.

🚀 HANDS-ON

1. Use echo to display Hello followed by your username.
2. Create a variable answer with a value of 42.
3. Copy the value of $LANG to $MyLANG.
4. List all current shell variables.
5. List all exported shell variables.
6. Do the env and set commands displays your variable ?
7. Destroy your answer variable.
8. Create two variables, and export one of them.
9. Display the exported variable in an interactive child shell.

SHELL EXPANSION

SHELL EMBEDDING AND OPTIONS

shell embedding

backticks

backticks or single quotes

shell options

🚀 HANDS-ON

1. Find the list of shell options in the man page of bash. What is the difference btw set -u and set -o nounset ?
2. Activate nounset in your shell. Test that it shows an error message when using non-existing variables.
3. Desactive nounset.
4. Execute cd /var and ls in an embedded shell
5. Create the variable embvar in an embedded shell and echo it. Does the variable exists in your current shell now ?
6. Explain what "set -x" does. Can this be useful ?

SHELL EXPANSION

SHELL HISTORY

repeating the XX command(s)

To repeat the last command in bash, type !!.

history

To see older commands, use history.

$HIST...

$HISTSIZE: number of commands that will be remembered

$HISTFILE: file that contains your history.

$HISTFILESIZE: number of commands kept in your history file

🚀 HANDS-ON

1. Issue the command echo The answer to the meaning of life, the universe and everything is 42.
2. Repeat the previous command using two characters (there are two solutions!).
3. Display at least 5 commands you typed.
4. How many commands can be kept in memory for your current shell session ?

SHELL EXPANSION

FILE GLOBBING

* asterisk

? question mark

[] square brackets

[ is interpreted by the shell as a sign to generate filenames, matching any of the characters between [ and the first subsequent ].

a-z and 0-9 ranges

The bash shell will also understand ranges of characters between brackets.

preventing file globbing

🚀 HANDS-ON

1. Create a test directory and enter in it.
2. Create the following files : file1, file10, file11, file2, File2, File3, file33, fileAB, filea, fileA, fileAAA, file(, file 2.
3. List (with ls) all files starting with :
   • file
   • File
   • file and ending in a number
   • File and having a digit as fifth character
4. List all files that have exactly five characters.
5. List all files that do not start with the letter F.

PIPES AND COMMANDS

PIPES AND COMMANDS

I/O redirection

stdin, stdout and stderr

output redirection

error redirection

input redirection

🚀 HANDS-ON

1. Make sure you have two shells open on the same computer. Create an empty tailing.txt file. Then type tail -f tailing.txt. Use the second shell to append a line of text to that file. Verify that the first shell displays this line.
2. Create a file that contains the names of five people. Use cat and output redirection to create the file and use a here document to end the input.

PIPES AND COMMANDS

FILTERS

cat

When between two pipes, the cat command does nothing (except putting stdin on stdout).

tee

Puts stdin on stdout and also into a file. Useful on long pipes to store intermediate results.

grep

The most well-known filter! 

cut

Filter can select columns from files, depending on a delimiter.

tr

Used for translating characters.

wc

Counting words, lines and characters.

sort

uniq

sed

The stream editor sed can perform editing functions in the stream.

pipe examples

🚀 HANDS-ON

1. Put a sorted list of all bash users in bashusers.txt
2. Put a sorted list of all logged on users in onlineusers.txt
3. Make a list of all filenames in /etc that contain the string conf in their filename.
4. Make a sorted like of all files in /etc that contain the case insensitive string conf in their filename
5. Look at the output of /sbin/ifconfig. Write a line that displays only ip address and the subnet mask.
6. Write a line that removes all non-letters from a stream.
7. Write a line that receives a text file, and outputs all words on a separate line.

PIPES AND COMMANDS

BASIC UNIX TOOLS

find

Can be very useful at the start of a pipe to search for files.

Add 2>/dev/null to avoid cluttering your screen with errors.

locate

The locate tool is very different from find in that it uses an index to locate files.

This is faster than traversing all the directories but it also means that it's always outdated. If the index does not exist yet, then you have to create it (as root on RHEL).

date

To display date, time, time zone and more

cal

sleep

Sometimes used in scripts to wait a number of seconds.

time

Can display how long it takes to execute a command.

gzip - gunzip - zcat - zmore 

Users never have enough disk space so compression comes in handy.

bzip2 - bunzip2 - bzcat - bzmore

🚀 HANDS-ON

1. Explain the difference between these two commands
   a) find /data -name "*.txt"
   b) find /data -name *.txt
2. Write a find command that finds all files created after January 30th 2010.
3. Count the number of *.conf files in /etc and all its subdirs.
4. Create a file called loctest.txt. Can you find this file with locate ? Why not ? How do you make locate find this file ?
5. Use find and -exec to rename all .htm files to .html.

vi

Introduction to vi

The vi editor is installed on almost every Unix.

Linux will very often install vim (vi improved) which is similar.

EVERY SYSTEM ADMINISTRATOR SHOULD KNOW VI(M) BECAUSE IT IS AN EASY TOOL TO SOLVE PROBLEMS.

• http://www.openvim.com/
• https://vim-adventures.com/

vi cheat sheet

• http://www.atmos.albany.edu/daes/atmclasses/atm350/vi_cheat_sheet.pdf

SCRIPTING

SCRIPTING

SCRIPTING INTRODUCTION

hello world

she-bang

#! is called a she-bang.

Used because you can never be sure which shell a user is running.

comment

variables

sourcing a script

Luckily, you can force a script to run in the same shell; this is called sourcing a script.

🚀 HANDS-ON

Give each script a different name, keep them for later!

1. Write a script that outputs the name of a city.
2. Make sure the script runs in the bash shell.
3. Makes sure the script runs in the Korn shell.
4. Create a script that defines two variables, and outputs their value.
5. The previous script does not influence your current shell. Now run the script so that it influences your current shell.
6. Is there a shorter way to source the script ?
7. Comment your scripts so that you know what they're doing.

SCRIPTING

SCRIPTING LOOPS

test []

The test command can test whether something is true or false.

if then else

If a certain condition is met, then execute something, else execute something else.

if then elif

You can nest a new if inside an else with elif.

for loop

while loop

until loop

🚀 HANDS-ON

1. Write a script that uses
   • A for loop to count from 3 to 7.
   • A while loop to count from 1 to 17000.
   • An until loop to count down from 8 to 4.
2. Write a script that counts the number of file ending in .txt in the current directory.
3. Wrap an if statement around the script so it is also correct when there are zero files ending in .txt.

SCRIPTING

SCRIPTING PARAMETERS

script parameters

runtime input

You can ask the user for input.

sourcing a config file

The source can be used to source a config file.

get script options with getopts

🚀 HANDS-ON

1. Write a script that receives four parameters, and outputs them in reverse order.
2. Write a script that receives two parameters (two filenames) and outputs whether those files exist.
3. Write a script that asks for a filename. Verify existence of the file, then verify that you own the file, and whether it is writable. If not, then make it writable.
4. Make a configuration file for the previous script. Put a logging switch in the config file, logging means writing detailed output of everything the script does to a log file in /tmp.

SCRIPTING

SCRIPTING PARAMETERS

eval

eval reads arguments as input to the shell. Allows using the value of a variable as a variable.

(( ))

The (( )) allows for evaluation of numerical expressions.

let

The let built-in shell function instructs the shell to perform an evaluation of aritmetic expressions.

case

shell functions

🚀 HANDS-ON

1. Write a script that asks for two numbers, and outputs the sum and product.
2. Improve the previous script to test that the numbers are between 1 and 100, exit with an error if necessary.
3. Improve the previous script to congratulate the user is the sum is equals to the product.

LOCAL USER MANAGEMENT

LOCAL USER MANAGEMENT

INTRODUCTION TO USERS

whoami

Tells you your username.

who - who am i

Give you information about who is logged on the system.

w

Shows you who is logged on and what they are doing

id

Give you your user id, primary group id, and a list of the groups that you belong to

su

Allow a user to run a shell as another user

run a program as another user

• The sudo program allows a user to start a program with the credentials of another user.
• Before this works, the system admin has to set up the /etc/sudoers file.
• This can be useful to delegate administrative tasks to another user.

visudo

Check the man page of visudo before playing with the /etc/sudoers file !

sudo logging

Using sudo without autorization will result in a severe warning

Check /var/log/secure ;-)

🚀 HANDS-ON

1. Run a command that displays only your currently logged on user name.
2. Display a list of all logged users.
3. Display your user name and your unique user identification (userid).
4. Use su to switch to another user account and get back to the previous account.
5. Now use su - to switch to another user and notice the differences.

LOCAL USER MANAGEMENT

USER MANAGEMENT

/etc/passwd

The local user database on Linux (and most Unixes).

The columns contain the username, an x, the user id, the primary group id, a description, the name of the home directory, and the login shell.

root

The root user always has userid 0 (regardless of the name of the account).

useradd - userdel

Add users with the useradd command.

The user named alexis received userid 529 and primary group id 529.

usermod

Modify properties of a user with the usermod command.

creating home directories

• Easiest way : add -m option with useradd
• Less easy way :

/etc/skel

When useradd the -m option is used, the /etc/skel directory is copied to the newly created home directory.

/etc/skel contains somes usually files that contain profil settings and default values for applications.

deleting home directories

-r option of userdel will make sure that the home directory is deleted.

chsh

Users can change their login shell with the chsh command.

🚀 HANDS-ON

1. Create a user account names serena, including a home directory and a description tha reads Serena Williams. Do all this in one single command.
2. Create a user named venus, including home directory, bash shell, a description that reads Venus Williams all in one single command.
3. Verify that both users have correct entriers in /etc/passwd, /etc/shadow and /etc/group.
4. Verify that their home directory was created.
5. Create a user named einstime with /bin/date as default logon shell. What happens when you log on ?

LOCAL USER MANAGEMENT

USER PASSWORDS

passwd

Update users passwords.

shadow file

User passwords are encrypted and kept in /etc/shadow.

/etc/login.defs

Contains some default settings for user passwords.

chage

Set an expiration date for a user account ( -E ), minimum ( -m ) and maximum ( -M ) password age ...

disabling a password

Locking, disabling or suspending a user account.

🚀 HANDS-ON

1. Set the password for serena to hunter2.
2. Also set a password for venus and then lock the venus user account with usermod. Verify the locking in /etc/shadow before and after you lock it.
3. Use passwd -d to disable the serena password. Verify the serena line in /etc/shadow before and after disabling.
4. What is the difference between locking a user account and disabling a user account's password like we just did with usermod -L and passwd -d ?
5. Make sure serena has to change her password in 10 days.

LOCAL USER MANAGEMENT

USER PROFILES

system profile

Both the bash and the ksh shell will verify the existence of /etc/profile and source it if it exists.

~/.bash_profile

When this file exists in home directory, then bash will source it.

~/.profile

When neither ~/.bash_profile and ~/.bash_login exist, then bash will verify the existence of ~/.profile and execute it.

~/.bashrc

Leaves room for custom aliases and functions.

~/.bash_logout

When exiting bash, it can execute ~/.bash_logout.

RHEL overview

🚀 HANDS-ON

1. Make a list of all the profile files on your system.
2. Read the contents of each of these, often they source extra scripts.
3. Put a unique variable, alias and function in each of those files.
4. When an application depends on a setting in $HOME/.profile, does it matter whether $HOME/.bash_profile exists or not ?

LOCAL USER MANAGEMENT

GROUPS

groupadd

Groups can be created with the groupadd command.

group file

Users can be a member of several groups. Group membership is defined by the /etc/group file.

Group name ; group's (encrypted) password ; group identification ; list of members

groups

A user can type the groups command to see a list of groups where the user belongs to.

usermod

Group membership can be modified with the useradd or usermod command

groupmod

You can change the group name with groupmod command.

groupdel

You can permanently remove a group with the groupdel command.

🚀 HANDS-ON

1. Create the groups tennis, football and sports.
2. In one command, make venus a member of tennis and sports.
3. Rename the football group to foot.
4. Use vi to add serena to the tennis group.
5. Use the id command to verify that serena is a member of tennis.

FILE SECURITY

FILE SECURITY

STANDARD FILE PERMISSIONS

user & group owner

Every file has a user owner and a group owner.

listing user accounts

You can use the following command to list all local user accounts.

chgrp

You can change the group owner of a file using the chgrp command.

chown

The user owner of a file can be changed with chown command.

list of special files

When you use ls -l, the first character tells us the type of file.

permissions

The nine characters following the file type denote the permissions in three triplets.

three sets of rwx

chmod

Permissions can be changed with chmod.

setting octal permissions

🚀 HANDS-ON

1. As normal user, create a directory ~/permissions. Create a file owned by yourself in there.
2. Copy a file owned by root from /etc/  to your permissions dir, who owns this file now ?
3. As root, create a file in the users ~/permissions directory.
4. As normal user, look at who owns this file created by root.
5. Change the ownership of all files in ~/permissions to yourself.
6. Make sure you have all rights to these files, and others can only read.

FILE SECURITY

ADVANCED FILE PERMISSIONS

sticky bit on directory

Prevent users from removing files that they do not own as a user owner.

You typically find the sticky bit on the /tmp directory.

setgid bit on directory

To make sure that all files inside the directory are owned by the group owner of the directory.

set(u/g)id bit on regular file

These two permissions cause an executable file to be executed with the permissions of the file owner instead of the executing owner.

In most case, setting the setuid bit on executables is sufficient. Setting the setgid bit will result in these programs to run with the credentials of their group owner.

🚀 HANDS-ON

1. Set up a directory, owned by the group sports.
2. Members of the sports group should be able to create files in this directory.
3. All files created in this directory should be group-owned by the sports group.
4. Users should be able to delete only their own user-owned files.
5. Test that this works!

FILE SECURITY

ACCESS CONTROL LISTS

acl in /etc/fstab

File systems that support access control lists have to be mounted with the acl option listed in /etc/fstab.

getfacl

Reading acls can be done with /usr/bin/getfacl.

setfacl

Writing or changing acls can be done with /usr/bin/setfacl.

remove an acl entry

FILE SECURITY

FILE LINKS

inode contents

An inode is a data structure that contains metadata about a file. When the FS stores a new file on the HD, it stores not only the contents of the file but also extra properties (name, creation date, its permissions, owner ...).

inode table

The inode table contains all of the inodes and is created when you create the FS (with mkfs).

inode number

Each inode has a unique number (the inode number). You can see the inode numbers with the ls -li command.

All the information you see with this ls command resides in the inode, except for the filename (contained in the directory).

inode and file contents

Let's put some data in one of the files.

The data that is displayed by the cat command is not in the inode, but somewhere else on the disk. The inode contains a pointer to that data.

a directory is a table

A directory is a special kind of file that contains a table which maps filenames to inodes.

hard links

Create a hard link to a file with ln.

Both files have the same inode => same permissions, owner, content.

Both file are equal, meaning you can safely remove the original file, the hardlinked file will remain.

symbolic links

Sometimes called soft links, they are not linked to inodes.

Permissions on a symbolic link have no meaning, since the permissions of the target apply.

Hard link are limited to their own partition, symbolic links can link anywhere.

🚀 HANDS-ON

1. Create two files named winter.txt and summer.txt, put some text in them.
2. Create a hard link to winter.txt named hlwinter.txt.
3. Display the inode numbers of these three files.
4. Use the find command to list the two hardlinked files.
5. Everything about a file is in the inode, except two things : name them!
6. Create a symbolic link to summer.txt called slsummer.txt.
7. Find all files with inode number 2. What does this information tell you ?