linux tips and tricks

prakash0106 · February 4, 2010

Linux Shortcuts and Commands:

Linux Newbie Administrator Guide

This is a practical selection of the commands we use most often. Press <Tab> to see the listing of all available command (on your PATH). On my small home system, it says there are 2595 executables on my PATH. Many of these "commands" can be accessed from your favourite GUI front-end (probably KDE or Gnome) by clicking on the right menu or button. They can all be run from the command line. Programs that require GUI have to be run from a terminal opened under a GUI.

Legend:

<> = single special or function key on the keyboard. For example <Ctrl> indicates the "control" key.

italic = name of the file or variable you probably want to substitute with your own.

fixed width = in-line Linux commands and filenames.

Notes for the UNIX Clueless:

1. LINUX IS CASE-SENSITIVE. For example: Netscape, NETSCAPE and nEtscape are three different commands. Also my_filE, my_file, and my_FILE are three different files. Your user login name and password are also case sensitive. (This goes with the tradition of UNIX and the "c" programming language being case sensitive.)

2. Filenames can be up to 256 characters long and can contain letters, numbers, "." (dot), "_" (underscore), "-" (dash), plus some other not recommended characters.

3. Files with names starting with "." are normally not shown by the ls (list) or dir commands. Think of these files as "hidden". Use ls -a (list with the option "all") to see these files.

4. "/" is an equivalent to DOS "\" (root directory, meaning the parent of all other directories).

5. Under Linux, all directories appear under a single directory tree (there are no DOS-style drive letters).

6. In a configuration file, a line starting with # is a comment.

7.1 Linux essential shortcuts and sanity commands

Switch to the first text terminal. Under Linux you can have several (6 in standard setup) terminals opened at the same time.

<Ctrl><Alt><Fn> (n=1..6)

Switch to the nth text terminal.

tty

Print the name of the terminal in which you are typing this command.

Switch to the first GUI terminal (if X-windows is running on this terminal).

<Ctrl><Alt><Fn> (n=7..12)

Switch to the nth GUI terminal (if a GUI terminal is running on screen n-1). On default, nothing is running on terminals

8 to 12, but you can run another server there.

<Tab>

(In a text terminal) Autocomplete the command if there is only one option, or else show all the available options.

THIS SHORTCUT IS GREAT! It even works at LILO prompt!

Scroll and edit the command history. Press <Enter> to execute.

Scroll terminal output up. Work also at the login prompt, so you can scroll through your bootup messages.

Scroll terminal output down.

(in X-windows) Change to the next X-server resolution (if you set up the X-server to more than one resolution). For multiple resolutions on my standard SVGA card/monitor, I have the following line in the file /etc/X11/XF86Config (the first resolution starts on default, the largest determines the size of the "virtual screen"):

Modes "1024x768" "800x600" "640x480" "512x384" "480x300" "400x300" "1152x864"

(in X-windows) Change to the previous X-server resolution.

(in X-windows) Kill the current X-windows server. Use if the X-windows server crushes and cannot be exited normally.

Shut down the system and reboot. This is the normal shutdown command for a user at the text-mode console. Don't just press the "reset" button for shutdown!

<Ctrl>c

Kill the current process (mostly in the text mode for small applications).

<Ctrl>d

Log out from the current terminal. See also the next command.

<Ctrl>d

Send [End-of-File] to the current process. Don't press it twice else you also log out (see the previous command).

<Ctrl>s

Stop the transfer to the terminal.

<Ctrl>q

Resume the transfer to the terminal. Try if your terminal mysteriously stops responding.

<Ctrl>z

Send the current process to the background.

exit

Logout. I can also use logout for the same effect. (If you have started a second shell, e.g., using bash the second shell will be exited and you will be back in the first shell, not logged out.)

reset

Restore a screwed-up terminal (a terminal showing funny characters) to default setting. Use if you tried to "cat" a binary file. You may not be able to see the command as you type it.

Paste the text which is currently highlighted somewhere else. This is the normal "copy-paste" operation in Linux. (It doesn't work with Netscape and WordPerfect which use the MS Windows-style "copy-paste". It does work in the text terminal if you enabled "gpm" service using "setup".) Best used with a Linux-ready 3-button mouse (Logitech or similar) or else set "3-mouse button emulation").

~

(tilde) My home directory (normally the directory /home/my_login_name). For example, the command cd ~/my_dir will change my working directory to the subdirectory "my_dir" under my home directory. Typing just "cd" alone is an equivalent of the command "cd ~".

.

(dot) Current directory. For example, ./my_program will attempt to execute the file "my_program" located in your current working directory.

..

(two dots) Directory parent to the current one. For example, the command cd .. will change my current working directory one one level up.

7.2 Common Linux commands--system info

pwd

Print working directory, i.e., display the name of my current directory on the screen.

hostname

Print the name of the local host (the machine on which you are working). Use netconf (as root) to change the name of the machine.

whoami

Print my login name.

id username

Print user id (uid) and his/her group id (gid), effective id (if different than the real id) and the supplementary groups.

date

Print or change the operating system date and time. E.g., I could change the date and time to 2000-12-31 23:57 using this command:

date 123123572000

To set the hardware (BIOS) clock from the system (Linux) clock, use the command (as root) setclock

time

Determine the amount of time that it takes for a process to complete + other info. Don't confuse it with the date command. E.g. I can find out how long it takes to display a directory content using:

time ls

who

Determine the users logged on the machine.

rwho -a

(=remote who) Determine all users logged on your network. The rwho service must be enabled for this command to run. If it isn't, run setup as root to enable "rwho".

finger user_name

System info about a user. Try: finger root

last

Show listing of users last logged-in on your system.

history | more

Show the last (1000 or so) commands executed from the command line on the current account. The "| more" causes the display to stop after each screenful.

uptime

Show the amount of time since the last reboot.

ps

(=print status) List the processes currently run by the current user.

ps axu | more

List all the processes currently running, even those without the controlling terminal, together with the name of the user that owns each process.

top

Keep listing the currently running processes, sorted by cpu usage (top users first). In KDE, you can get GUI-based Ktop from "K"menu under "System"-"Task Manager" (or by executing "ktop" in an X-terminal).

uname -a

(= Unix name with option "all") Info on your (local) server. I can also use guname (in X-window terminal) to display the info more nicely.

free

Memory info (in kilobytes).

df -h

(=disk free) Print disk info about all the filesystems (in human-readable form)

du / -bh | more

(=disk usage) Print detailed disk usage for each subdirectory starting at the "/" (root) directory (in human legible form).

cat /proc/cpuinfo

Cpu info--it show the content of the file cpuinfo. Note that the files in the /proc directory are not real files--they are hooks to look at information available to the kernel.

cat /proc/interrupts

List the interrupts in use.

cat /proc/version

Linux version and other info

cat /proc/filesystems

Show the types of filesystems currently in use.

cat /etc/printcap

Show the setup of printers.

lsmod

(As root. Use /sbin/lsmod to execute this command when you are a non-root user.) Show the kernel modules currently loaded.

set|more

Show the current user environment.

echo $PATH

Show the content of the environment variable "PATH". This command can be used to show other environment variables as well. Use "set" to see the full environment.

dmesg | less

Print kernel messages (the content of the so-called kernel ring buffer). Press "q" to quit "less". Use less /var/log/dmesg to see what "dmesg" dumped into this file right after the last system bootup.

7.3 Basic operations

any_command --help |more

Display a brief help on a command (works with most commands). "--help" works similar to DOS "/h" switch. The "more" pipe is needed if the output is longer than one screen.

man topic

Display the contents of the system manual pages (help) on the topic. Try man man first. Press "q" to quit the viewer. The command info topic works similar and may contain more up-to-date information. Manual pages can be hard to read. Try any_command --help for short, easy to digest help on a command. If more info needed, have a look to the directory /usr/doc. To display manual page from a specific section, I may use something like in this example: man 3 exit (this displays an info on the command exit from section 3 of the manual pages).

apropos topic

Give me the list of the commands that have something to to do with my topic.

help command

Display brief info on a bash (shell) build-in command.

ls

List the content of the current directory. Under Linux, the command "dir" is an alias to ls. Many users have "ls" to be an alias to "ls --color".

ls -al |more

List the content of the current directory, all files (also those starting with a dot), and in a long form. Pipe the output through the "more" command, so that the display pauses after each screenful.

cd directory

Change directory. Using "cd" without the directory name will take you to your home directory. "cd -" will take you to your previous directory and is a convenient way to toggle between two directories. "cd .." will take you one directory up.

cp source destination

Copy files. E.g., cp /home/stan/existing_file_name . will copy a file to my current working directory. Use the "-r" option (for recursive) to copy the contents of whole directories, e.g. , cp -r my_existing/dir/ ~ will copy a subdirectory under my current working directory to my home directory.

mcopy source destination

Copy a file from/to a DOS filesystem (no mounting necessary). E.g., mcopy a:\autoexec.bat ~/junk . See man mtools for related commands: mdir, mcd, mren, mmove, mdel, mmd, mrd, mformat ....

mv source destination

Move or rename files. The same command is used for moving and renaming files and directories.

ln source destination

Create a hard link called destination to the file called source. The link appears as a copy of the original files, but in reality only one copy of the file is kept, just two (or more) directory entries point to it. Any changes the file are automatically visible throughout. When one directory entry is removed, the other(s) stay(s) intact. The limitation of the hard links are: the files have to be on the same filesystem, hard links to directories or special files are impossible.

ln -s source destination

Create a symbolic (soft) link called "destination" to the file called "source". The symbolic link just specifies a path where to look for the file. In contradistinction to hard links, the source and destination don't not have to tbe on the same filesystem. In comparison to hard links, the drawback of symbolic links are: if the original file is removed, the link is "broken", symbolic links can also create circular references (like circular references in spreadsheets or databases, e.g., "a" points to "b" and "b" points back to "a").

rm files

Remove (delete) files. You must own the file in order to be able to remove it. On many systems, you will be asked or confirmation of deleation, if you don't want this, use the "-f" (=force) option, e.g., rm -f * will remove all files in my current working directory, no questions asked.

mkdir directory

Make a new directory.

rmdir directory

Remove an empty directory.

rm -r files

(recursive remove) Remove files, directories, and their subdirectories. Careful with this command as root--you can easily remove all files on the system with such a command executed on the top of your directory tree, and there is no undelete in Linux (yet). But if you really wanted to do it (reconsider), here is how (as root): rm -rf /*

cat filename | more

View the content of a text file called "filename", one page a time. The "|" is the "pipe" symbol (on many American keyboards it shares the key with "\") The pipe makes the output stop after each screenful. For long files, it is sometimes convenient to use the commands head and tail that display just the beginning and the end of the file. If you happened to use "cat" a binary file and your terminal displays funny characters afterwards, you can restore it with the command "reset".

less filename

Scroll through a content of a text file. Press q when done. "Less" is roughly equivalent to "more" , the command you know from DOS, although very often "less" is more convenient than "more".

pico filename

Edit a text file using the simple and standard text editor called pico.

pico -w filename

Edit a text file, while disabling the long line wrap. Handy for editing configuration files, e.g. /etc/fstab.

find / -name "filename"

Find the file called "filename" on your filesystem starting the search from the root directory "/". The "filename" may contain wildcards (*,?).

locate filename

Find the file name of which contains the string "filename". Easier and faster than the previous command but depends on a database that normally rebuilds at night.

./program_name

Run an executable in the current directory, which is not on your PATH.

touch filename

Change the date/time stamp of the file filename to the current time. Create an empty file if the file does not exist.

xinit

Start a barebone X-windows server (without a windows manager).

startx

Start an X-windows server and the default windows manager. Works like typing "win" under DOS with Win3.1

startx -- :1

Start another X-windows session on the display 1 (the default is opened on display 0). You can have several GUI terminals running concurrently. Switch between them using <Ctrl><Alt><F7>, <Ctrl><Alt><F8>, etc.

xterm

(in X terminal) Run a simple X-windows terminal. Typing exit will close it. There are other, more advanced "virtual" terminals for X-windows. I like the popular ones: konsole and kvt (both come with kde) and gnome-terminal (comes with gnome). If you need something really fancy-looking, try Eterm.

xboing

(in X terminal). Very nice, old-fashioned game. Many small games/programs are probably installed on your system. I also like xboard (chess).

shutdown -h now

(as root) Shut down the system to a halt. Mostly used for a remote shutdown. Use <Ctrl><Alt><Del> for a shutdown at the console (which can be done by any user).

halt

reboot

(as root, two commands) Halt or reboot the machine. Used for remote shutdown, simpler to type than the previous command.

Network apps

netscape

(in X terminal) Run netscape (requires a separate Netscape installation). The current versions of Netscape (4.x) are known to be big and buggy. They occasionally crash by vanishing (no other harm done). Also, when not connected to the network , Netscape likes to refuse to do anything (looks like it hanged)-it revives when you connect.

netscape -display host:0.0

(in X terminal) Run netscape on the current machine and direct the output to machine named "host" display 0 screen 0. Your current machine must have a permission to display on the machine "host" (typically given by executing the command xhost current_machine_name in the xterminal of the machine host. Other X-windows program can be run remotely the same way.

lynx file.html

View an html file or browse the net from the text mode.

pine

A good text-mode mail reader. Another good and standard one is elm. Your Netscape mail will read the mail from your Internet account. pine will let you read the "local" mail, e.g. the mail your son or a cron process sends to you from a computer on your home network. The command mail could also be used for reading/composing mail, but it would be inconvenient--it is meant to be used in scripts for automation.

elm

A good tex-mode mail reader. See the previous command.

mutt

A really basic but extremally useful and fast mail reader.

mail

A basic operating system tool for e-mail. Look at the previous commands for a better e-mail reader. mail is good if you wanted to send an e-mail from a shell script.

licq

(in X term) An icq "instant messaging" client. Another good one is kxicq. Older distributions don't have an icq client installed, you have to do download one and install it.

talk username1

Talk to another user currently logged on your machine (or use "talk username1@machinename" to talk to a user on a different computer) . To accept the invitation to the conversation, type the command "talk username2". If somebody is trying to talk to you and it disrupts your work, your may use the command "mesg n" to refuse accepting messages. You may want to use "who" or "rwho" to determine the users who are currently logged-in.

mc

Launch the "Midnight Commander" file manager (looks like "Norton Commander" for Linux).

telnet server

Connect to another machine using the TELNET protocol. Use a remote machine name or IP address. You will be prompted for your login name and password--you must have an account on the remote machine to login. Telnet will connect you to another machine and let you operate on it as if you were sitting at its keyboard (almost). Telnet is not very secure--everything you type goes in open text, even your password!

rlogin server

(=remote login) Connect to another machine. The login name/password from your current session is used; if it fails you are prompted for a password.

rsh server

(=remote shell) Yet another way to connect to a remote machine. The login name/password from your current session is used; if it fails you are prompted for a password.

ftp server

Ftp another machine. (There is also ncftp which adds extra features and gftp for GUI .) Ftp is good for copying files to/from a remote machine. Try user "anonymous" if you don't have an account on the remote server. After connection, use "?" to see the list of available ftp commands. The essential ftp command are:ls (see the files on the remote system), ASCII, binary (set the file transfer mode to either text or binary, important that you select the proper one ), get (copy a file from the remote system to the local system), mget (get many files at once), put (copy a file from the local system to the remote system), mput (put many files at once), bye (disconnect). For automation in a script, you may want to use ncftpput and ncftpget, for example:

ncftpput -u my_user_name -p my_password -a remote.host.domain remote_dir *local.html

minicom

Minicom program (looks like "Procomm for Linux").

File (de)compression

tar -zxvf filename.tar.gz

(=tape archiver) Untar a tarred and compressed tarball (*.tar.gz or *.tgz) that you downloaded from the Internet.

tar -xvf filename.tar

Untar a tarred but uncompressed tarball (*.tar).

gunzip filename.gz

Decompress a zipped file (*.gz" or *.z). Use gzip (also zip or compress) if you wanted to compress files to this file format.

bunzip2 filename.bz2

(=big unzip) Decompress a file (*.bz2) zipped with bzip2 compression utility. Used for big files.

unzip filename.zip

Decompress a file (*.zip) zipped with a compression utility compatible with PKZIP for DOS.

unarj e filename.arj

Extract the content of an *.arj archive.

uudecode -o outputfile filename

Decode a file encoded with uuencode. uu-encoded files are typically used for transfer of non-text files in e-mail (uuencode transforms any file into an ASCII file).

7.4 Process control

ps

(=print status) Display the list of currently running processes with their process IDs (PID) numbers. Use ps axu to see all processes currently running on your system (also those of other users or without a controlling terminal), each with the name of the owner. Use "top" to keep listing the processes currently running.

fg PID

Bring a background or stopped process to the foreground.

bg PID

Send the process to the background. Opposite to fg. The same can be accomplished with <Ctrl>z. If you have stopped jobs, you have to type exit twice in row to log out.

any_command&

Run any command in the background (the symbol "&" means "run the proceeding command in the background").

batch any_command

Run any command (usually one that is going to take more time) when the system load is low. I can logout, and the process will keep running.

at 17:00

Execute a command at a specified time. You will be prompted for the command(s) to run, until you press <Ctrl>d.

kill PID

Force a process shutdown. First determine the PID of the process to kill using ps.

killall program_name

Kill program(s) by name.

xkill

(in an xwindow terminal) Kill a GUI-based program with mouse. (Point with your mouse cursor at the window of the process you want to kill and click.)

lpc

(as root) Check and control the printer(s). Type "?" to see the list of available commands.

lpq

Show the content of the printer queue. Under KDE (X-Windows), you may use GUI-based "Printer Queue" available from "K"menu-Utilities.

lprm job_number

Remove a printing job "job_number" from the queue.

nice program_name

Run program_name adjusting its priority. Since the priority is not specified in this example, it will be adjusted by 10 (the process will run slower), from the default value (usually 0). The lower the number (of "niceness" to other users on the system), the higher the priority. The priority value may be in the range -20 to 19. Only root may specify negative values. Use "top" to display the priorities of the running processes.

renice -1 PID

(as root) Change the priority of a running process to -1. Normal users can only adjust processes they own, and only up from the current value (make them run slower).

<Ctrl>c, <Ctrl>z, <Ctrl>s, and <Ctrl>q also belong to this chapter but they were described previously. In short they mean: stop the current command, send the current command to the background, stop the data transfer, resume the data transfer.

7.5 Basic administration commands

printtool

(as root in X-terminal) Configuration tool for your printer(s). Settings go to the file /etc/printcap.

setup

(as root) Configure mouse, soundcard, keyboard, X-windows, system services. There are many distibution-specific configuration utilities, setup is the default on RedHat. Mandrake 7.0 offers very nice DrakConf .

linuxconfig

(as root, either in text or graphical mode). You can access and change hundreds of setting from it. Very powerful--don't change too many things at the same time, and be careful with changing entries you don't understand.

xvidtune

(in X-terminal). Adjust the settings of the graphical display for all resolutions so as to eliminate black bands, shift the display right/left/up/down, etc. (First use the knobs on your monitor to fit your text mode correctly on the screen.) To make the changes permanent, display the frequencies on the screen and transfer them to the setup file /etc/X11/XF86Config.

alias ls="ls --color=tty"

Create an alias for the command "ls" to enhance its format with color. In this example, the alias is also called "ls" and the "color" option is only envoke when the output is done to a terminal (not to files). Put the alias into the file /etc/bashrc if you would like the alias to be always accessible to all users on the system. Type "alias" alone to see the list of aliases on your system.

adduser user_name

Create a new account (you must be root). E.g., adduser barbara Don't forget to set up the password for the new user in the next step. The user home directory is /home/user_name.

useradd user_name

The same as the command " adduser user_name ".

userdel user_name

Remove an account (you must be a root). The user's home directory and the undelivered mail must be dealt with separately (manually because you have to decide what to do with the files).

groupadd group_name

Create a new group on your system. Non-essential but can be handy even on a home machine with a small number of users.

passwd

Change the password on your current account. If you are root, you can change the password for any user using: passwd user_name

chmod perm filename

(=change mode) Change the file access permission for the files you own (unless you are root in which case you can change any file). You can make a file accessible in three modes: read ®, write (w), execute (x) to three classes of users: owner (u), members of the same group as the owner (g), others on the system (o). Check the current access permissions using:

ls -l filename

If the file is accessible to all users in all modes it will show:

rwxrwxrwx

The first triplet shows the file permission for the owner of the file, the second for his/her group, the third for others. A "no" permission is shown as "-".

E.g., this command will add the permission to read the file "junk" to all (=user+group+others):

chmod a+r junk

This command will remove the permission to execute the file junk from others:

chmod o-x junk

Also try here for more info.

You can set the default file permissions for the news files that you create using the command umask (see man umask).

chown new_ownername filename

chgrp new_groupname filename

Change the file owner and group. You should use these two commands after you copy a file for use by somebody else.

su

(=substitute user id) Assume the superuser (=root) identity (you will be prompted for the password). Type "exit" to return you to your previous login. Don't habitually work on your machine as root. The root account is for administration and the su command is to ease your access to the administration account when you require it. You can also use "su" to assume any other user identity, e.g. su barbara will make me "barbara" (password required unless I am a superuser).

kernelcfg

(as root in X terminal). GUI to to add/remove kernel modules. You can do the same from the command line using the command "insmod", but "insmode" is less "newbie-friendly".

lsmod

List currently loaded kernel modules. A module is like a device driver--it provides operating system kernel support for a particular piece of hardware or feature.

modprobe -l |more

List all the modules available for your kernel. The available modules are determined by how your Linux kernel was compliled. Every possible module/feature can be compiled on linux as either "hard wired" (fast, non-removable), "module" (maybe slower, but loaded/removable on demand), or "no" (no support for this feature at all).

insmod parport

insmod ppa

(as root) Insert modules into the kernel (a module is roughly an equivalent of a DOS device driver). This example shows how to insert the modules for support of the external parallel port zip drive (it appears to be a problem to get the external zip drive to work in any other way under RH6.0 ).

rmmod module_name

(as root, not essential). Remove the module module_name from the kernel.

setserial /dev/cua0 port 0x03f8 irq 4

(as root) Set a serial port to a non-standard setting. The example here shows the standard setting for the first serial port (cua0 or ttyS0). The standard PC settings for the second serial port (cua1or ttyS1) are: address of i/o port 0x02f8, irq 3. The third serial port (cua2 or ttyS2): 0x03e8, irq 4. The forth serial port (cua3 or ttyS3): 0x02e8, irq 3. Add your setting to /etc/rc.d/rc.local if you want it to be set at the boot time. See man setserial for good a overview.

fdisk

(as root) Linux hard drive partitioning utility (DOS has a utility with the same name).

cd /usr/src/linux-2.0.36

make xconfig

(as root in X terminal). Nice GUI front-end for configuration of the kernel options in preparation for compilation of your customized kernel. (The directory name contains the version of your Linux kernel so you may need to modify the directory name if your Linux kernel version is different than 2.0.36 used in this example. You also need the "Tk" interpreter and the kernel source code installed. ) The alternatives to "make xconfig" are: "make config" (runs a scripts that asks you questions in the text mode) and "make menuconfig" (runs a text-based menu-driven configuration utility). Try: less /usr/doc/HOWTO/Kernel-HOWTO for more information.

After the configuration, you may choose to proceed with kernel compilation of the new kernel by issuing the following commands:

make dep

make zImage

The last command will take some time to complete (maybe 0.5 h, depending on your hardware). It produces the file "zImage", which is your new Linux kernel. Next:

make modules

make modules_install

Read: /usr/doc/HOWTO/Kernel-HOWTO for information on how to install the new kernel. You will probably also find it useful to read "man depmode". Configuration, compilation and installation of a new kernel is not difficult but it CAN lead to problems if you don't know what you are doing.

Compilation of a kernel is a good way to test your hardware, because it involves a massive amount of computing. If your hardware is "flaky", you will most likely receive the "signal 11" error (read the beatiful /usr/doc/FAQ/txt/GCC-SIG11-FAQ). See this for details on kernel upgrade.

depmod -a

(as root) Build the module dependency table for the kernel. This can, for example, be useful after installing and booting a new kernel. Use "modprobe -a" to load the modules.

ldconfig

(as root) Re-create the bindings and the cache for the loader of dynamic libraries ("ld"). You may want to run ldconfig after an installation of new dynamically linked libraries on your system. (It is also re-run every time you boot the computer, so if you reboot you don't have to run it manually.)

mknod /dev/fd0 b 2 0

(=make node, as root) Create a device file. This example shows how to create a device file associated with your first floppy drive and could be useful if you happened to accidentally erase it. The options are: b=block mode device (c=character mode device, p=FIFO device, u=unbuffered character mode device). The two integers specify the major and the minor device number.

fdformat /dev/fd0H1440

mkfs -c -t ext2

(=floppy disk format, two commands, as root) Perform a low-level formatting of a floppy in the first floppy drive (/dev/fd0), high density (1440 kB). Then make a Linux filesystem (-t ext2), checking/marking bad blocks (-c ). Making the files system is an equivalent to the high-level format.

badblocks /dev/fd01440 1440

(as root) Check a high-density floppy for bad blocks and display the results on the screen. The parameter "1440" specifies that 1440 blocks are to be checked. This command does not modify the floppy.

fsck -t ext2 /dev/hda2

(=file system check, as root) Check and repair a filesystem. The example uses the partition hda2, filesystem type ext2.

dd if=/dev/fd0H1440 of=floppy_image

dd if=floppy_image of=/dev/fd0H1440

(two commands, dd="data duplicator") Create an image of a floppy to the file called "floppy_image" in the current directory. Then copy floppy_image (file) to another floppy disk. Works like DOS "DISKCOPY".

Program installation

rpm -ivh filename.rpm

(=RedhatPackageManager, install, verbose, hashes displayed to show progress, as root.) Install a content of RedHat rpm package(s) and print info on what happened. Keep reading if you prefer a GUI installation.

rpm -qpi filename.rpm

(=RedhatPackageManager, query, package, list.) Read the info on the content of a yet uninstalled package filename.rpm.

rpm -qpl filename.rpm

(=RedhatPackageManager, query, package, information.) List the files contained in a yet uninstalled package filename.rpm.

rpm -qf filename

(=RedhatPackageManager, query, file.) Find out the name of the *.rpm package to which the file filename (on your hardrive) belongs.

rpm -e packagename

(=RedhatPackageManager, erase=uninstall.) Uninstall a package pagckagename. Packagname is the same as the beginning of the *.rpm package file but without the dash and version number.

kpackage

gnorpm

glint

(in X terminal, as root if you want to be able to install packages) GUI fronts to the Red Hat Package Manager (rpm). "glint" comes with RH5.2, "gnorpm" with RH6.0, "kpackage" comes with RH6.1 or must be installed separately but is the best of the three. Use any of them to view which software packages are installed on your system and the what not-yet-installed packages are available on your RedHat CD, display the info about the packages, and install them if you want (installation must be done as root).

Accessing drives/partitions

mount

See here for details on mounting drives. Examples are shown in the next commands.

mount -t auto /dev/fd0 /mnt/floppy

(as root) Mount the floppy. The directory /mnt/floppy must exist, be empty and NOT be your current directory.

mount -t auto /dev/cdrom /mnt/cdrom

(as root) Mount the CD. You may need to create/modify the /dev/cdrom file depending where your CDROM is. The directory /mnt/cdrom must exist, be empty and NOT be your current directory.

mount /mnt/floppy

(as user or root) Mount a floppy as user. The file /etc/fstab must be set up to do this. The directory /mnt/floppy must not be your current directory.

mount /mnt/cdrom

(as user or root) Mount a CD as user. The file /etc/fstab must be set up to do this. The directory /mnt/cdrom must not be your current directory.

umount /mnt/floppy

Unmount the floppy. The directory /mnt/floppy must not be your (or anybody else's) current working directory. Depending on your setup, you might not be able to unmount a drive that you didn't mount.

7.6 Network administration tools

netconf

(as root) A very good menu-driven setup of your network.

pingmachine_name

Check if you can contact another machine (give the machine's name or IP), press <Ctrl>C when done (it keeps going).

route -n

Show the kernel routing table.

nslookup host_to_find

Query your default domain name server (DNS) for an Internet name (or IP number) host_to_find. This way you can check if your DNS works. You can also find out the name of the host of which you only know the IP number.

traceroute host_to_trace

Have a look how you messages trave to host_to_trace (which is either a host name or IP number).

ipfwadm -F -p m

(for RH5.2, seen next command for RH6.0) Set up the firewall IP forwarding policy to masquerading. (Not very secure but simple.) Purpose: all computers from your home network will appear to the outside world as one very busy machine and, for example, you will be allowed to browse the Internet from all computers at once.

echo 1 > /proc/sys/net/ipv4/ip_forward

ipfwadm-wrapper -F -p deny

ipfwadm-wrapper -F -a m -S xxx.xxx.xxx.0/24 -D 0.0.0.0/0

(three commands, RH6.0). Does the same as the previous command. Substitute the "x"s with digits of your class "C" IP address that you assigned to your home network. See here for more details. In RH6.1, masquarading seems broken to me--I think I will install Mandrake Linux:).

ifconfig

(as root) Display info on the network interfaces currently active (ethernet, ppp, etc). Your first ethernet should show up as eth0, second as eth1, etc, first ppp over modem as ppp0, second as ppp1, etc. The "lo" is the "loopback only" interface which should be always active. Use the options (see ifconfig --help) to configure the interfaces.

ifup interface_name

(/sbin/ifup to it run as a user) Startup a network interface. E.g.:

ifup eth0

ifup ppp0

Users can start up or shutdown the ppp interface only when the right permission was checked during the ppp setup (using netconf ). To start a ppp interface (dial-up connection), I normally use kppp available under kde menu "internet".

ifdown interface_name

(/sbin/ifdown to run it as a user). Shut down the network interface. E.g.: ifdown ppp0 Also, see the previous command.

netstat | more

Displays a lot (too much?) information on the status of your network.

Music-related commands

cdplay play 1

Play the first track from a audio CD.

eject

Get a free coffee cup holder )). (Eject the CD ROM tray).

play my_file.wav

Play a wave file.

mpg123 my_file.mp3

Play an mp3 file.

mpg123 -w my_file.wav my_file.mp3

Create a wave audio file from an mp3 audio file.

knapster

(in X terminal) Start the program to downolad mp3 files that other users of napster have displayed for downloading. Really cool!

cdparanoia -B "1-"

(CD ripper) Read the contents of an audio CD and save it into wavefiles in the current directories, one track per wavefile. The "1-"

means "from track 1 to the last". -B forces putting each track into a separate file.

playmidi my_file.mid

Play a midi file. playmidi -r my_file.mid will display text mode effects on the screen.

sox

(argument not given here) Convert from almost any audio file format to another (but not mp3s). See man sox.

Graphics-related commands

kghostview my_file.ps

Display a postscript file on screen. I can also use the older-looking ghostview or gv for the same end effect.

ps2pdf my_file.ps my_file.pdf

Make a pdf (Adobe portable document format) file from a postscript file.

gimp

(in X terminal) A humble looking but very powerful image processor. Takes some learning to use, but it is great for artists, there is almost nothing you can't do with gimp. Use your mouse right button to get local menus, and learn how to use layers. Save your file in the native gimp file format *.xcf (to preserve layers) and only then flatten it and save as png (or whatever). There is a large user manual /usr/

gphoto

(in X terminal) Powerful photo editor.

giftopnm my_file.giff > my_file.pnm

pnmtopng my_file.pnm > my_file.png

Convert the propriatory giff graphics into a raw, portable pnm file. Then convert the pnm into a png file, which is a newer and better standard for Internet pictures (better technically plus there is no danger of being sued by the owner of giff patents)

regards,

Prakash.M

9840304424

prakash0106 · February 4, 2010

10 Red Hat® Linux™

Tips and Tricks

1-800-COURSES www.globalknowledge.com

Expert Reference Series of White Papers

Written and Provided by

Introduction

Are you looking for a quick and simple reference guide to help you navigate Red Hat® Linux™ systems?

Look no further! Global Knowledge and Red Hat have assembled these 10 Tips and Tricks from Red Hat

Certified Engineers® (RHCEs) to give you an edge on managing these systems.

1.Wiping a Hard Drive

By Dominic Duval, Red Hat Certified Engineer

Have you ever needed to completely wipe out critical data from a hard drive? As we all know, mkfs doesn’t

erase a lot. (You already knew this, right?) mkfs and its variants (e.g., mkfs.ext3 and mke2fs) only get

rid of a few important data structures on the filesystem, but the data is still there! For a SCSI disk connected

as /dev/sdb, a quick

dd if=/dev/sdb | strings

will let anyone recover text data from a supposedly erased hard drive. Binary data is more complicated to

retrieve, but the same basic principle applies: the data was not completely erased.

To make things harder for the bad guys, an old trick was to use the ‘dd’ command as a way to erase a drive.

Note: This command will erase your disk!

dd if=/dev/zero of=/dev/sdb

There’s one problem with this: newer, more advanced, techniques make it possible to retrieve data that were

replaced with a bunch of 0s. To make it more difficult, if not impossible, for the bad guys to read data that was

previously stored on a disk, Red Hat ships the “shred” utility as part of the coreutils RPM package. Launching

“shred” on a disk or a partition will write repeatedly (25 times by default) to all locations on the disk.

Note: Be careful with this one too!

shred /dev/sdb

This is currently known to be a very safe way to delete data from a hard drive before, let’s say, you ship it back

to the manufacturer for repair or before you sell it on eBay!

Compiled by Red Hat Certified Engineers

10 Red Hat® Linux™ Tips and Tricks

2. How To Determine the Manufacturer of a Laptop Battery

By Dominic Duval, Red Hat Certfied Engineer

With all the recent news about laptop batteries suddenly exploding, it might be a good idea to determine the

manufacturer and model number of the battery that’s currently connected to your laptop.

A simple file, included with the 2.6 kernel that runs on Red Hat Enterprise Linux 4, can easily show this information

on any laptop running with ACPI enabled:

cat /proc/acpi/battery/BAT0/info

Look for the “model number” and “OEM info” fields.

3. Sharing a Hot Spare Device in Software RAID

By Forrest Taylor, Red Hat Certified Engineer

Have you ever wondered if you could share a hot spare device between two software RAID arrays? You can

share a hot spare device if you put mdadm in daemon mode and have it poll your RAID arrays.

Let's assume that you have two RAID 1 arrays with one hot spare configured in this manner:

/dev/md0 RAID1

--

/dev/sda1

/dev/sdb1

/dev/md1 RAID1

--

/dev/sdc1

/dev/sdd1

/dev/sde1 (Hot Spare)

This setup shows /dev/md0 with two devices, and /dev/md1 with three devices, with /dev/sde1 as a

hot spare. In this scenario, you want to share /dev/sde1 with /dev/md0 if it should need it. To do that,

you must configure the /etc/mdadm.conf file and define a spare-group name.

In /etc/mdadm.conf, start off by listing all of the devices:

echo "DEVICE /dev/sda1 /dev/sdb1 /dev/sdc1 /dev/sdd1 /dev/sde1"

>> /etc/mdadm.conf

Scan the RAID arrays for the current details, and add it to the file:

mdadm -D -s >> /etc/mdadm.conf

/etc/mdadm.conf should now contain something like the following:

# Caution, the ARRAY and UUID should be on the same line.

DEVICE /dev/sda1 /dev/sdb1 /dev/sdc1 /dev/sdd1

/dev/sde1

ARRAY /dev/md0 level=raid1 num-devices=2

UUID=29bc861f:6f1c72b0:162f7a88:1db03ffe

devices=/dev/sda1,/dev/sdb1

ARRAY /dev/md1 level=raid1 num-devices=2

UUID=aee2ae4c:ec7e4bab:51aefe40:9b54af78

devices=/dev/sdc1,/dev/sdd1,/dev/sde1

At this point, you need to create a spare-group entry for each array. The name does not matter, as long as it is

the same for each array that you want to share the hot spare device(s).

Here, we choose "shared" as the name of the spare-group and add an entry for each ARRAY in the

/etc/mdadm.conf file:

# Caution, the ARRAY and UUID should be on the same line.

DEVICE /dev/sda1 /dev/sdb1 /dev/sdc1 /dev/sdd1 /dev/sde1

ARRAY /dev/md0 level=raid1 num-devices=2

UUID=29bc861f:6f1c72b0:162f7a88:1db03ffe

devices=/dev/sda1,/dev/sdb1

spare-group=shared

ARRAY /dev/md1 level=raid1 num-devices=2

UUID=aee2ae4c:ec7e4bab:51aefe40:9b54af78

devices=/dev/sdc1,/dev/sdd1,/dev/sde1

spare-group=shared

Once the configuration file is ready, mdadm can run in daemon mode and poll the devices. If mdadm determines

that a device has failed, it will look for an array in the same spare-group that contains all of the standard

devices plus a hot spare device. If it finds any, it will move the hot spare to the array that needs it. In our

case, if /dev/md0 were to lose a device, it would look at /dev/md1 and find the two devices of the array

plus a hot spare, and it will move the hot spare device to /dev/md0 and begin the rebuild process.

Run mdadm in daemon mode and have it monitor and scan the arrays:

mdadm -F -s -m root@localhost -f

The default poll time is 60 seconds, but can be changed using the -d option (e.g., -d 300 would poll every 5

minutes).

Now test out this feature by failing and removing a device from /dev/md0:

mdadm /dev/md0 -f /dev/sda1 -r /dev/sda1

The next time that mdadm polls the devices, it should determine that /dev/md1 has a spare device, and it

should move /dev/sde1 to /dev/md0 and rebuild the array. You can then add in /dev/sda1 and it

will become your hot spare device:

mdadm /dev/md0 -a /dev/sda1

4. USB when the Drivers Aren't Available

By Dominic Duval, Red Hat Certfied Engineer

As a way to save a few valuable pennies on newer PCs, manufacturers are increasingly getting rid of the good

old PS/2 keyboard and mouse interfaces. As a result, some recent systems only ship with USB ports to which

we need to connect a USB keyboard and mouse.

USB is all well and good, but what if the driver for your USB controller is not loaded? In practice, this is not a

problem, as Red Hat loads the ehci- hcd and uhci-hcd drivers automatically at boot time.

There are situations, namely in emergency mode, where the USB drivers won't be available. So you won't even

be able to enter a command. This is due to the fact that in emergency mode all drivers need to be provided in

the initrd file under /boot, and USB is not there by default. The trick is to add those drivers, so that they will be

available earlier. The 'mkinitrd' command can do precisely that with the '--with' argument (this only

works under RHEL4):

mkinitrd --with=ehci-hcd --with=uhci-hcd /boot/newinitrd-`uname -

r`.img

`uname -r`

Add a new entry in your grub.conf file (always do backups!) that points to this new initrd image, and you're

done! Your USB keyboard now works in emergency mode.

5. Using Proc

By Steve Bonneville, Red Hat Certfied Engineer

In /proc, there are subdirectories for each process running on the system, named based on the PID number

of the process. In each of these directories, there is a fd/ subdirectory that contains files that represent the

file descriptors the process currently has open. These files are actually symlinks that point to the actual device,

socket, or other file the process currently has open and mapped to that file descriptor.

If you have a program that can read input from a file but not from standard input, or that can write to a file

but not to standard output, you may be able to cheat by taking advantage of these special files:

/proc/self/fd/0 is standard input of the current process

/proc/self/fd/1 is standard output of the current process

/proc/self/fd/2 is standard error of the current process

For example if 'myfilter' can only read from a file, which it takes as its first argument, you can make it

read from standard input instead with:

'myfilter /proc/self/fd/0'

Another example: 'cat filename > /proc/self/fd/2' sends the contents of filename out standard

error instead of standard output.

Whether these tricks will behave in a sane manner will depend on how the process actually handles the file it

opens.

6. Growing the Devices in a RAID Array

By Forrest Taylor, Red Hat Certfied Engineer

As hard disk space is ever increasing, you may get replacement drives that are significantly larger than the

original devices that they replace, so this tip will show how to increase the size of a RAID array using larger

partitions to replace smaller partitions in the original RAID array.

We will assume that you have a RAID 5 array using three partitions (/dev/sdb1, /dev/sdc1, and

/dev/sdd1) on /dev/md0. These partitions are 1 GB each, giving you about 2 GB of usable space. You

add new disks and create three partitions (/dev/sde1, /dev/sdf1, and /dev/sdg1) of 5 GB in size.

By the end, you should have about 10 GB of usable space.

After you have created the partitions and set the partitions type to 0xfd, you can add these devices to the

array. They will become hot spares:

mdadm /dev/md0 -a /dev/sde1 /dev/sdf1 /dev/sdg1

Fail the original devices one at a time, ensuring that the array rebuilds after each failed device.

Note: Do not fail more than one of the original devices without verifying that the array has finished rebuilding.

If you fail two devices in a RAID 5 array, you may destroy data!

First, fail and remove the first device, and verify that the array has finished rebuilding:

mdadm /dev/md0 -f /dev/sdb1 -r /dev/sdb1

watch cat /proc/mdstat

Once it has finished rebuilding, fail the second device:

mdadm /dev/md0 -f /dev/sdc1 -r /dev/sdc1

watch cat /proc/mdstat

Once it has finished rebuilding, fail the third device:

mdadm /dev/md0 -f /dev/sdd1 -r /dev/sdd1

watch cat /proc/mdstat

After it has finished rebuilding, you have replaced all of the 1 GB original devices with the new 5 GB devices.

However, we are not finished yet.We have two problems: the RAID array is still only using 1 GB of my 5 GB

devices, and the filesystem is still 2 GB.

First, grow the RAID array. mdadm can grow the RAID array to a certain size, using the -G and -z options.

The -z option can take a currently undocumented argument of max, which will resize the array to the maximum

available space:

mdadm -G /dev/md0 -z max

`cat /proc/mdstat` and `mdadm -D /dev/md0` should show that the array is now using a 5

GB device size.

Second, we need to enlarge the filesystem to match. Assuming that you have an ext3 filesystem on /dev/md0,

and that you have mounted it, you can increase the size of the filesystem by using ext2online:

ext2online /dev/md0

After that command completes, you should see about 10 GB of usable space.

7. Installing Third-Party RPMs

By Doug Bunger, Red Hat Certified Engineer

After rebuilding a system, it may be necessary to add several additional RPMs. These could be third-party

applications or vendor-specific patches. Trying to do an RPM -i or -U with an *.rpm would fail if the

process encountered an error. Since the list of RPMs might include packages that were not included with the

Red Hat distribution, a -F might not work. In such a case, the following could help:

find /start/dir -name "*.rpm" \

-exec rpm -Uvh --aid {} \;

The first line of the command would get a list of the RPMs available in the directory (/start/dir, in the

example). The second line would install each RPM in turn. Depending on the nature of the RPMs, it may be

necessary to issue the command twice, though the --aid option should attempt to resolve dependencies.

8. Partprobe

By Richard Keech, Red Hat Certified Engineer

Many system administrators may be in the habit of re-booting their systems to make partition changes visible

to the kernel. With Red Hat Enterprise Linux, this is not usually necessary. The partprobe command, from

the parted package, informs the kernel about changes to partitions. After all, anything that can help you avoid

a re-boot has to be a good thing!

For example:

# cat /proc/partitions

major minor #blocks name

3 0 58605120 hda

3 1 200781 hda1

3 2 2040255 hda2

3 3 56364052 hda3

8 01018880 sda

8 110224 sda1

# partprobe

# cat /proc/partitions

major minor #blocks name

3 0 58605120 hda

3 1 200781 hda1

3 2 2040255 hda2

3 3 56364052 hda3

8 0 1018880 sda

8 1 10224 sda1

8 2 1008640 sda2

9. Pyshell

By Brad Smith, Red Hat Certified Engineer

Python developers: You probably know that the python interpreter can be run in interactive mode, allowing

you to quickly try out an approach or prototype a script. Fedora includes an even more powerful version of this

tool from an unlikely source. The wxPython-common-gtk2-unicode package provides files related to

the wxWindows widget set and, more-or-less unrelated to the rest of the package's contents, a tool

called pyshell.

Pyshell performs the same basic function as the interactive-mode python interpreter, but with a lot of great

bells and whistles. Try importing a module, such as "os" and then referencing an element of the module:

>>> import os

>>> os.

When "." is typed, up pops a list of every property and method within the "os" module. You can use the

mouse or arrow keys (plus tab-completion) to select what you want. If you select a method, begining the argument

list with "(" pops up a list of the method's accepted arguments and its pydoc string, where applicable.

The best part is that, since pyshell reads the pydoc information for each module as it is loaded, this

works for any module, including those you've written yourself.

Moving around within pyshell can take some getting used to. The up arrow moves you up line by line

instead of moving through the interpreter's history like it does in the basic interpreter. Ctrl+Up moves

through the history. However, the history is in blocks, not lines. So, for example, if you'd defined a class earlier

on and then pressed Ctrl+Up, when you reached the class in your history, its whole definition would come

up. You could then use the arrow keys to move around the definition, making changes. Ctrl+Enter even

allows you to insert new lines into the definition. When you're done, press Enter and the class is re-defined

according to your revised code.

Pyshell makes it even easier than before to write and test small applications “on the fly.” Once you've got

the hang of it, try out the even fancier alternative, pycrust, which integrates a number of tools for browsing

structures within the interpreter's memory, viewing output, etc into pyshell.Want more? Try pyalamode,

which has all the features of pycrust, plus an integrated version of the pyalacarte text editor,

for all your cut-and-pasting needs (cutting and pasting into any other editor works fine too).

10. Un-killable Processes

By Johnathan Kupferer, Red Hat Certified Engineer

Before Red Hat Enterprise Linux 4, there really wasn't a good way to handle processes that had entered an

uninterruptible sleep waiting on an unresponsive NFS server. This was particularly frustrating because the

umount man page promises that “-f” will "Force unmount.” This allows an NFS-mounted filesystem to be

unmounted if the NFS server is “unreachable." That was how it was supposed to work, with the caveat that

the filesystem must have originally been mounted with "soft" or "intr" options.Well, no more. Though the

man page doesn't say so, umount -f now comes to the rescue and will unmount hard and uninterruptible

mounts.

Learn More

Learn more about how you can improve productivity, enhance efficiency, and sharpen your competitive edge.

Check out our complete Red Hat Linux curriculum at www.globalknowledge.com/redhat.

For more information or to register, visit www.globalknowledge.com or call 1-800-COURSES to speak with a

sales representative.

Through expert instruction, you will understand key concepts and how to apply them to your specific work situation.

Choose from more than 700 courses, delivered through Classrooms, e-Learning, and On-site sessions, to

meet your IT and management training needs.

regards,

Prakash.M

9840304424

prakash0106 · February 4, 2010

THE ONE PAGE LINUX MANUAL

A summary of useful Linux commands

Version 3.0 May 1999 squadron@powerup.com.au

Starting & Stopping

shutdown -h now Shutdown the system now and do not

reboot

halt Stop all processes - same as above

shutdown -r 5 Shutdown the system in 5 minutes and

reboot

shutdown -r now Shutdown the system now and reboot

reboot Stop all processes and then reboot - same

as above

startx Start the X system

Accessing & mounting file systems

mount -t iso9660 /dev/cdrom

/mnt/cdrom

Mount the device cdrom

and call it cdrom under the

/mnt directory

mount -t msdos /dev/hdd

/mnt/ddrive

Mount hard disk “d” as a

msdos file system and call

it ddrive under the /mnt

archive

./configure Execute the script preparing the

installed files for compiling

User Administration

adduser accountname Create a new user call accountname

passwd accountname Give accountname a new password

su Log in as superuser from current login

exit Stop being superuser and revert to

normal user

Little known tips and tricks

ifconfig List ip addresses for all devices on

the machine

apropos subject List manual pages for subject

usermount Executes graphical application for

mounting and unmounting file

systems

/sbin/e2fsck hda5 Execute the filesystem check utility

on partition hda5

fdformat /dev/fd0H1440 Format the floppy disk in device fd0

tar -cMf /dev/fd0 Backup the contents of the current

directory and subdirectories to

multiple floppy disks

tail -f /var/log/messages Display the last 10 lines of the system

log.

cat /var/log/dmesg Display the file containing the boot

time messages - useful for locating

problems. Alternatively, use the

dmesg command.

* wildcard - represents everything. eg.

cp from/* to will copy all files in the

from directory to the to directory

? Single character wildcard. eg.

cp config.? /configs will copy all files

beginning with the name config. in

the current directory to the directory

named configs.

[xyz] Choice of character wildcards. eg.

ls [xyz]* will list all files in the current

directory starting with the letter x, y,

or z.

linux single At the lilo prompt, start in single user

mode. This is useful if you have

forgotten your password. Boot in

single user mode, then run the

passwd command.

ps List current processes

kill 123 Kill a specific process eg. kill 123

Configuration files and what they do

/etc/profile System wide environment variables for

all users.

/etc/fstab List of devices and their associated mount

points. Edit this file to add cdroms, DOS

partitions and floppy drives at startup.

/etc/motd Message of the day broadcast to all users

at login.

etc/rc.d/rc.local Bash script that is executed at the end of

login process. Similar to autoexec.bat in

DOS.

/etc/HOSTNAME Conatins full hostname including domain.

/etc/cron.* There are 4 directories that automatically

execute all scripts within the directory at

intervals of hour, day, week or month.

/etc/hosts A list of all know host names and IP

addresses on the machine.

/etc/httpd/conf Paramters for the Apache web server

/etc/inittab Specifies the run level that the machine

should boot into.

/etc/resolv.conf Defines IP addresses of DNS servers.

/etc/smb.conf Config file for the SAMBA server. Allows

file and print sharing with Microsoft

clients.

/etc/X11/XF86Confi

g

Config file for X-Windows.

~/.xinitrc Defines the windows manager loaded by

X. ~ refers to user’s home directory.

File permissions

If the command ls -l is given, a long list of file names is

displayed. The first column in this list details the permissions

applying to the file. If a permission is missing for a owner,

group of other, it is represented by - eg. drwxr-x—x

Read = 4

Write = 2

Execute = 1

File permissions are altered by giving the

chmod command and the appropriate

octal code for each user type. eg

chmod 7 6 4 filename will make the file

called filename R+W+X for the owner,

R+W for the group and R for others.

chmod 7 5 5 Full permission for the owner, read and

execute access for the group and others.

chmod +x filename Make the file called filename executable

to all users.

X Shortcuts - (mainly for Redhat)

Control|Alt + or - Increase or decrease the screen

resolution. eg. from 640x480 to

800x600

Alt | escape Display list of active windows

Shift|Control F8 Resize the selected window

Right click on desktop

background

Display menu

Shift|Control Altr Refresh the screen

Shift|Control Altx Start an xterm session

Printing

/etc/rc.d/init.d/lpd start Start the print daemon

/etc/rc.d/init.d/lpd stop Stop the print daemon

/etc/rc.d/init.d/lpd

status

Display status of the print daemon

lpq Display jobs in print queue

lprm Remove jobs from queue

lpr Print a file

lpc Printer control tool

man subject | lpr Print the manual page called subject

as plain text

man -t subject | lpr Print the manual page called subject

as Postscript output

printtool Start X printer setup interface

~/.Xdefaults Define configuration for some Xapplications.

~ refers to user’s home

directory.

Get your own Official Linux Pocket Protector - includes

handy command summary. Visit:

www.powerup.com.au/~squadron

prakash0106 · February 4, 2010

securing linux

Securing Linux

These instructions are probably specific to RedHat Linux 6.x. If you are running some other distribution you should be familiar with Linux and system management and be able to adapt these instructions.

Decide what services you need to provide with this machine. If it is your desktop machine and noone else needs access to it over the network, then you do not need to provide any services to the internet. In that case do not even start up inetd at all. The best way to do this is to just delete /etc/inetd.conf

Edit /etc/inetd.conf to stop services that are not needed. Here is what your /etc/inetd.conf file should look like:

ftp stream tcp nowait root /usr/sbin/tcpd in.ftpd -l -a

telnet stream tcp nowait root /usr/sbin/tcpd in.telnetd

shell stream tcp nowait root /usr/sbin/tcpd in.rshd

login stream tcp nowait root /usr/sbin/tcpd in.rlogind

talk dgram udp wait root /usr/sbin/tcpd in.talkd

ntalk dgram udp wait root /usr/sbin/tcpd in.ntalkd

time stream tcp nowait nobody /usr/sbin/tcpd in.timed

time dgram udp wait nobody /usr/sbin/tcpd in.timed

auth stream tcp nowait nobody /usr/sbin/in.identd in.identd -l -e -o

Restrict the services that are staying open to specific machines through the use of tcp wrappers. Tcp wrappers are installed by default on RedHat 5.x machines, but they are not doing anything other than logging. Tcp wrappers use the files /etc/hosts.deny and /etc/hosts.allow to determine which users and domainnames are allowed to connect to services on your machine. Here is /etc/hosts.deny:

#

# hosts.deny This file describes the names of the hosts which are

# *not* allowed to use the local INET services, as decided

# by the '/usr/sbin/tcpd' server.

#

# The portmap line is redundant, but it is left to remind you that

# the new secure portmap uses hosts.deny and hosts.allow. In particular

# you should know that NFS uses portmap!

ALL: ALL

portmap: ALL

and here is /etc/hosts.allow:

#

# hosts.allow This file describes the names of the hosts which are

# allowed to use the local INET services, as decided

# by the '/usr/sbin/tcpd' server.

#

ALL: 127.0.0.1, 128.227.64.XXX

portmap: 128.227.64.0/255.255.255.0

portmap: 255.255.255.255 0.0.0.0

XXX identifies a particular machine that you want to allow access to. For example you might have the ip number of your office PC if the Linux machine is in your lab and you want to be able to telnet in.

After making the above changes send a HUP to the inetd process

Test your setup:

make sure finger is not answering: finger @localhost

check to see if telnet works from the hosts which are allowed:

telnet yourhostname from the local machine

telnet yourhostname from a machine not listed in /etc/hosts.allow

telnet yourhostname from a machine listed in /etc/hosts.allow

Next cut back on the daemons started at boot time. To see some of what is being started type /sbin/chkconfig --list. This will tell you which daemons are being started in what runlevels. If you see something like this:

atd 0:off 1:off 2:off 3:on 4:on 5:on 6:off

gpm 0:off 1:off 2:on 3:on 4:on 5:on 6:off

network 0:off 1:off 2:on 3:on 4:on 5:on 6:off

nfsfs 0:off 1:off 2:off 3:on 4:on 5:on 6:off

random 0:off 1:on 2:on 3:on 4:on 5:on 6:off

keytable 0:off 1:off 2:on 3:on 4:on 5:on 6:off

pcmcia 0:off 1:off 2:on 3:on 4:on 5:on 6:off

linuxconf 0:off 1:off 2:on 3:on 4:on 5:on 6:off

lpd 0:off 1:off 2:on 3:on 4:on 5:on 6:off

kerneld 0:off 1:on 2:on 3:on 4:on 5:on 6:off

inet 0:off 1:off 2:off 3:on 4:on 5:on 6:off

portmap 0:off 1:off 2:off 3:on 4:on 5:on 6:off

routed 0:off 1:off 2:off 3:on 4:on 5:on 6:off

sound 0:off 1:off 2:off 3:on 4:on 5:on 6:off

sendmail 0:off 1:off 2:on 3:on 4:on 5:on 6:off

syslog 0:off 1:off 2:on 3:on 4:on 5:on 6:off

crond 0:off 1:off 2:on 3:on 4:on 5:on 6:off

You can start turning things off. For example, routed is being started in run levels three, four, and five. It should not be started, so I type /sbin/chkconfig --del routed

Turn off services that are not chkconfig compliant. To do this I like to remove the link from /etc/rc.d/init.d/whatever to /etc/rc.d/rc?.d/SnnWhatever. Basically the way things work is you have startup/shutdown scripts in /etc/rc.d/init.d which are linked to from the different runlevel directories. If you remove the link then the scripts are never called. I don't remove the original script in case I need it later. For example, suppose inetd is being started and the script is not chkconfig compliant. I look for the link by doing:

cd /etc/rc.d

find . -print | grep inet

Here is the output:

./init.d/inet

./rc0.d/K50inet

./rc1.d/K50inet

./rc2.d/K50inet

./rc3.d/S50inet

./rc4.d/S50inet

./rc5.d/S50inet

./rc6.d/K50inet

This tells me that inetd is being started in runlevels 3, 4 and 5. I remove the links and then reboot and there are no longer any of the inetd controlled services to worry about.

Configure sendmail for queuing only:

edit /etc/sysconfig/sendmail and change DAEMON=yes to no

create a /etc/sendmail.cf file that forwards to the mail server for Physics. To do this use the clientproto.mc file which comes with sendmail and specify phys.ufl.edu as the mail server. Or you can use the file which I have already made for sendmail 8.9.3. To use this file just backup /etc/mail/sendmail.cf and replace it with mine. If phys.ufl.edu is not your smtp server please look through the cf file and specify your smtp server and domain name. Please remember to edit /etc/aliases and specify that mail destined for "root" goes to the appropriate person. If that person is you then just look for the line in the file with root on the left hand side and put your email address on the right hand side. On current RedHat distributions this line is commented out and the mail goes to "marc."

Edit /etc/rc.d/rc.local to stop telling people what kernel you are running and the OS. Just put a welcome message, or some kind of warning in /etc/issue rather than the output of uname. People will telnet to every machine in a subnet looking for a particular revision of RedHat which they know has a security problem.

Have the machine scanned for known problems, contact us to schedule this.

Restrict the machines that can get an XDM session from you (unless you are serving Xterminals or PC full screen sessions). The file to edit is /etc/X11/xdm/Xaccess. You will want to comment out two lines in this file which allow any machine to be served XDM and also the chooser which responds to broadcasts:

#* #any host can get a login window

#* CHOOSER BROADCAST #any indirect host can get a chooser

Not really related to security, but this is useful info. To have X startup in 16bpp mode rather than 8bpp edit the file /etc/X11/xdm/Xservers and set the line for the local display (screen :0) like so:

:0 local /usr/X11R6/bin/X -bpp 16

Once you are sure that X is working fine you can make the machine boot in X by default. To do this edit /etc/inittab and change the default runlevel:

# Default runlevel. The runlevels used by RHS are:

# 0 - halt (Do NOT set initdefault to this)

# 1 - Single user mode

# 2 - Multiuser, without NFS (The same as 3, if you do not have networking)

# 3 - Full multiuser mode

# 4 - unused

# 5 - X11

# 6 - reboot (Do NOT set initdefault to this)

#

id:5:initdefault:

Reconfigure rsh and install ssh.

rsh needs to be moved out of the users path so that it is only used if ssh fails and the user is warned that they are using an insecure protocol. Remove the rsh binary by typing

rpm -e rsh

Now grab the rpm source file from the ftp site and install it (rpm -i) into /usr/src/redhat/SOURCES the tar file you need is netkit-rsh*.tar.gz Unpack it and configure

./configure --prefix=/usr/notinpath --disable-pam --disable-shadow

This only sets the install path for rsh though, edit the file pathnames.h in the rcp and rsh dir to change the path from:

#define _PATH_RSH "/usr/bin/rsh"

to:

#define _PATH_RSH "/usr/notinpath/bin/rsh"

When you actually install the programs you will have to make the directories as the Makefile does not do it.

Configure ssh to fall back to the rsh binary just installed:

./configure --with-x --with-rsh=/usr/notinpath/bin/rsh \

--program-transform-name='s/^s/r/' --with-libwrap \

--with-etcdir=/etc/ssh --with-rsaref

Refer to our general ssh page for more info. Here is what your /etc/inetd.conf should now look like:

ftp stream tcp nowait root /usr/sbin/tcpd in.ftpd -l -a

auth stream tcp nowait nobody /usr/sbin/in.identd in.identd -l -e -o

Turn off anonymous ftp access (if you have to have ftp at all) by editing /etc/ftpaccess You will see a line :

class all real,guest,anonymous *

Just remove the words guest and anonymous from the line.

prakash0106 · February 4, 2010

vpn=linux

Chapter 2. Theory

2.1. What is a VPN?

VPN stands for Virtual Private Network. A VPN uses the Internet as it's

transport mechanism, while maintaining the security of the data on the VPN.

-----------------------------------------------------------------------------

2.2. But really, what IS a VPN?

There are several answers to that question. It really depends on your

network layout. The most common configuration is to have a single main

internal network with remote nodes using VPN to gain full access to the

central net. The remote nodes are commonly remote offices or employees

working from home. You can also link two small (or large) networks to form an

even larger single network.

-----------------------------------------------------------------------------

2.3. So how does it work?

Put simply, to make a VPN, you create a secure tunnel between the two

networks and route IP through it. If I've lost you already, you should read

[http://www.tldp.org/HOWTO/'>http://www.tldp.org/HOWTO/Networking-Overview-HOWTO.html]'>http://www.tldp.org/HOWTO/Networking-Overview-HOWTO.html] The Linux

Networking Overview HOWTO to learn more about networking with Linux.

Here are some diagrams to illustrate this concept:

\ \

-------- / / --------

Remote ______| Client |______\ Internet \_____| Server |______ Private

Network | Router | / / | Router | Network

-------- \ \ --------

/ /

Client Router

----------------------------------------------------

| /-> 10.0.0.0/255.0.0.0 \ |

Remote | |--> 172.16.0.0/255.240.0.0 |--> Tunnel >---\ |

Network >---|--|--> 192.168.0.0/255.255.0.0 / |--|----> Internet

192.168.12.0 | | | |

| \-----> 0.0.0.0/0.0.0.0 --> IP Masquerade >--/ |

----------------------------------------------------

Server Router

----------------------------------------------------

| /-> 10.0.0.0/255.0.0.0 \ |

| /--> Tunnel >--|--> 172.16.0.0/255.240.0.0 |--|----> Private

Internet >--|--| \--> 192.168.0.0/255.255.0.0 / | Network

| | | 172.16.0.0/12

| \-----> 0.0.0.0/0.0.0.0 -----> /dev/null | 192.168.0.0/16

----------------------------------------------------

The above diagram shows how the network might be set up. If you don't know

what IP Masquerading is, you should probably read the The Linux Networking

Overview HOWTO and come back once you understand how it works.

The Client Router is a Linux box acting as the gateway/firewall for the

remote network. The remote network uses the local IP address 192.168.12.0.

For the sake of a simple diagram, I left out the local routing information on

the routers. The basic idea is to route traffic for all of the private

networks (10.0.0.0, 172.16.0.0, and 192.168.0.0) through the tunnel. The

setup shown here is one way. That is, while the remote network can see the

private network, the private network cannot necessarily see the remote

network. In order for that to happen, you must specify that the routes are

bidirectional.

From the diagram you should also note that all of the traffic coming out of

the client router appears to be from the client router, that is, all from one

IP address. You could route real numbers from inside your network but that

brings all sorts of security problems with it.

-----------------------------------------------------------------------------

2.4. SSH and PPP

The system that I describe to implement VPN uses SSH and PPP. Basically I

use ssh to create a tunnel connection, and then use pppd to run TCP/IP

traffic though it. That's what makes up the tunnel.

The real trick to getting ssh and pppd to play well together is the utility

written by Arpad Magosanyi that allows the redirection of standard in and

standard out to a pseudo tty. This allows pppd to talk through ssh as if it

were a serial line. On the server side, pppd is run as the users shell in the

ssh session, completing the link. After that, all you need to do is the

routing.

-----------------------------------------------------------------------------

2.5. Alternative VPN Systems

There are of course other ways of setting up a VPN. Here are a couple of

other systems:

-----------------------------------------------------------------------------

2.5.1. PPTP

PPTP is a Microsoft protocol for VPN. It is supported under Linux, but is

known to have serious security issues. I do not describe how to use it here

since it is covered by the [http://www.tldp.org/HOWTO/

VPN-Masquerade-HOWTO.html] Linux VPN Masquerade HOWTO.

-----------------------------------------------------------------------------

2.5.2. IP Sec

IP Sec is a different set of protocols from SSH. I don't actually know all

that much about it, so if someone wants to help me out with a description,

I'd be most appreciative. Again, I do not describe how to use it here since

it is covered by the [http://www.tldp.org/HOWTO/VPN-Masquerade-HOWTO.html]

Linux VPN Masquerade HOWTO.

-----------------------------------------------------------------------------

2.5.3. CIPE

CIPE is a kernel level network encryption system that may be better suited

to enterprise setups. You can find out more about it at [http://sites.inka.de

/sites/bigred/devel/cipe.html] the CIPE homepage.

-----------------------------------------------------------------------------

Chapter 3. Server

This section tells you how to set up the server side of things. I figured

that this should go first since without a server, your client is kind of

useless.

-----------------------------------------------------------------------------

3.1. Security - keeping people out

Security is very important for a VPN. That's why you're building one in the

first place, isn't it? You need to keep a few things in mind while setting up

your server.

-----------------------------------------------------------------------------

3.1.1. Trim your daemons

Since this server is going to be on both sides of your firewall, and set up

to forward traffic into your network, it's a good idea to secure the box as

well as you possibly can. You can read up more on Linux security in the [/

HOWTO/Security-HOWTO.html] Linux Security HOWTO. In this case I killed

everything but sshd and a Roxen Web server. I use the web server to download

a couple of files (my scripts, etc) for setting up new machines to access the

VPN. I don't use an FTP server since it's harder to configure one to be

secure than it is to just make a few files available with a web server. Plus,

I only need to be able to download files. If you really want to run different

servers on your gateway, you might want to think about restricting access to

them to only those machines on your private network.

-----------------------------------------------------------------------------

3.1.2. Don't allow passwords

Yes, it sounds kind of silly, but it got your attention, didn't it? No, you

don't use passwords, you disable them completely. All authentication on this

machine should be done via ssh's public key authentication system. This way,

only those with keys can get in, and it's pretty much impossible to remember

a binary key that's 530 characters long.

So how do you do that? It requires editing the /etc/passwd file. The second

field contains either the password hash, or alternatively 'x' telling the

authentication system to look in the /etc/shadow file. What you do is change

that field to read "*" instead. This tells the authentication system that

there is no password, and that none should be allowed.

Here's how a typical /etc/passwd file looks:

...

nobody:x:65534:100:nobody:/dev/null:

mwilson:x:1000:100:Matthew Wilson,,,:/home/mwilson:/bin/bash

joe:*:504:101:Joe Mode (home),,,:/home/vpn-users:/usr/sbin/pppd

bill:*:504:101:Bill Smith (home),,,:/home/vpn-users:/usr/sbin/pppd

frank:*:504:101:Frank Jones (home),,,:/home/vpn-users:/usr/sbin/pppd

...

Note that I've done more than just editing the second field. I'll explain

the other fields later on.

-----------------------------------------------------------------------------

3.2. User Access - letting people in

User access is done via ssh's authentication scheme. As stated above, this

is how users get access to the system, while maintaining a high level of

security. If you're not familiar with ssh, check out [http://www.ssh.org/]

http://www.ssh.org/. Note that I am using ssh version 1, not version 2. There

is a big difference, notably that version 1 is free, and 2 isn't.

-----------------------------------------------------------------------------

3.2.1. Configuring sshd

You'll need to configure sshd. The idea is to disable password

authentication and rhosts authentication. The following options should be

present in your /etc/sshd_config file.

PermitRootLogin yes

IgnoreRhosts yes

StrictModes yes

QuietMode no

CheckMail no

IdleTimeout 3d

X11Forwarding no

PrintMotd no

KeepAlive yes

RhostsAuthentication no

RhostsRSAAuthentication no

RSAAuthentication yes

PasswordAuthentication no

PermitEmptyPasswords no

UseLogin no

-----------------------------------------------------------------------------

3.3. Restricting Users

Now that you're keeping the bad people out, and only letting the good people

in, you may need to make sure that the good people behave themselves. This is

most easily done by not letting them do anything except run pppd. This may or

may not be necessary. I restrict users because the system that I maintain is

dedicated to VPN, so users have no business doing anything else on it.

-----------------------------------------------------------------------------

3.3.1. sudo or not sudo

There is this neat little program called sudo that allows the admin on a

Unix system to grant certain users the ability to run certain programs as

root. This is necessary in this case since pppd must be run as root. You'll

need to use this method if you want to allow users shell access. Read up on

how to setup and use sudo in the sudo man page. Using sudo is best on

multi-use systems that typically host a small number of trusted users.

If you decide to not allow users to have shell access, then the best way to

keep them from gaining it is to make their shell pppd. This is done in the /

etc/passwd file. You can see /etc/passwd file that I did this for the last

three users. The last field of the /etc/passwd file is the user's shell. You

needn't do anything special to pppd in order to make it work. It gets

executed as root when the user connects. This is certainly the simplest setup

to be had, as well as the most secure, and ideal for large scale and

corporate systems. I describe exactly what all needs to be done later in this

document. You can Section 5.7 if you like.

-----------------------------------------------------------------------------

3.4. Networking

Now that your users have access to the system, we need to make sure that

they have access to the network. We do that by using the Linux kernel's

firewalling rules and routing tables. Using the route and ipfwadm commands,

we can set up the kernel to handle network traffic in the appropriate ways.

For more info on ipfwadm, ipchains and route see the [http://www.tldp.org/

HOWTO/Linux-Networking-HOWTO.html] Linux Networking HOWTO.

-----------------------------------------------------------------------------

3.4.1. The Kernel

In order for any of this to work, you must have your kernel configured

correctly. If you don't know how to build your own kernel, then you should

read the [http://www.tldp.org/HOWTO/Kernel-HOWTO.html] Kernel HOWTO. You'll

need to make sure that the following kernel options are turned on in addition

to basic networking. I use a 2.0.38 kernel in my system.

For 2.0 kernels:

* CONFIG_FIREWALL

* CONFIG_IP_FORWARD

* CONFIG_IP_FIREWALL

* CONFIG_IP_ROUTER

* CONFIG_IP_MASQUERADE (optional)

* CONFIG_IP_MASQUERADE_ICMP (optional)

* CONFIG_PPP

For 2.2 kernels:

* CONFIG_FIREWALL

* CONFIG_IP_ADVANCED_ROUTER

* CONFIG_IP_FIREWALL

* CONFIG_IP_ROUTER

* CONFIG_IP_MASQUERADE (optional)

* CONFIG_IP_MASQUERADE_ICMP (optional)

* CONFIG_PPP

-----------------------------------------------------------------------------

3.4.2. Filter Rules

First, we write firewall filter rules that allow our users to access our

internal nets, while restricting them from accessing the outside internet.

This sounds strange, but since the users already have access to the internet,

why let them use the tunnel to access the net? It wastes both bandwidth and

processor resources.

The filter rules that we use depend upon which internal nets we use, but

translate to: "Allow traffic coming from our VPNs that is destined for our

internal nets to go there." So how do we do that? As always, it depends. If

you are running a 2.0 kernel, you use the tool called ipfwadm, but if you are

using a 2.2 kernel, you use the utility called ipchains.

To set the rules with ipfwadm, run it with options similar to the following:

# /sbin/ipfwadm -F -f

# /sbin/ipfwadm -F -p deny

# /sbin/ipfwadm -F -a accept -S 192.168.13.0/24 -D 172.16.0.0/12

To set the rules with ipchains, run it with options similar to the

following:

# /sbin/ipchains -F forward

# /sbin/ipchains -P forward DENY

# /sbin/ipchains -A forward -j ACCEPT -s 192.168.13.0/24 -d 172.16.0.0/12

For those using 2.2 kernels, please read Section 6.1.3.

-----------------------------------------------------------------------------

3.4.3. Routing

Now that users are allowed to access our nets, we need to tell the kernel

where to send the packets. On my system, I have two ethernet cards, one is on

the external network, while the other is on the internal network. This helps

keep things secure, as outbound traffic is masqueraded by the gateway, and

any incoming traffic is filtered and routed by the Cisco Router. For most

setups, the routing should be simple.

Next, route all traffic destined for the private networks out the internal

interface, and all other traffic out the external interface. The specific

routing commands depend on which internal nets you are using. Below is an

example of what they might look like. These lines are of course in addition

to your basic routes for your local nets. I also doubt that you are using all

3 groups of internal numbers:

Assuming that 172.16.254.254 is the internal gateway:

# /sbin/route add -net 10.0.0.0 netmask 255.0.0.0 gw 172.16.254.254 dev eth1

# /sbin/route add -net 172.16.0.0 netmask 255.240.0.0 gw 172.16.254.254 dev eth1

# /sbin/route add -net 192.168.0.0 netmask 255.255.0.0 gw 172.16.254.254 dev eth1

One additional note on routing. If you are using two way routing for say, a

remote office, then you will need to do one more thing. You need to set up

routes on the server that point back to the client. The easiest way to

accomplish this is to run a cron job every minute that quietly sets back

routes. If the client is not connected, route will just spit out an error

(that you've conveniently sent to /dev/null.)

-----------------------------------------------------------------------------

Chapter 4. Client

Now we examine the client end. In practice, when used to allow access to a

remote network, this box can easily serve as a Samba (Windows Networking)

server, DHCP server, and even an internal web server. The important thing to

remember is that this box should be as secure as possible, as it runs your

whole remote network.

-----------------------------------------------------------------------------

4.1. The Kernel

First things first, you must have ppp available in your kernel. If you are

going to allow multiple machines to use the tunnel, then you need to have

firewalling and forwarding available too. If the client is going to be a

single machine, ppp is enough.

-----------------------------------------------------------------------------

4.2. Bring up the link

The link is created by running pppd through a pseudo terminal that is

created by pty-redir and connected to ssh. This is done with something

similar to the following sequence of commands:

# /usr/sbin/pty-redir /usr/bin/ssh -t -e none -o 'Batchmode yes' -c blowfish -i /root/.ssh/identity.vpn -l joe > /tmp/vpn-device

# sleep 10

# /usr/sbin/pppd `cat /tmp/vpn-device`

# sleep 15

# /sbin/route add -net 172.16.0.0 gw vpn-internal.mycompany.com netmask 255.240.0.0

# /sbin/route add -net 192.168.0.0 gw vpn-internal.mycompany.com netmask 255.255.0.0

What this does is run ssh, redirecting the input and output to pppd. The

options passed to ssh configure it to run without escape characters (-e),

using the blowfish crypto algorithm (-c), using the identity file specified

(-i), in terminal mode (-t), with the options 'Batchmode yes' (-o). The sleep

commands are used to space out the executions of the commands so that each

can complete their startup before the next is run.

-----------------------------------------------------------------------------

4.3. Scripting

If you don't want to have to type those commands in every time that you want

to get the tunnel running, I've written a set of bash scripts that keep the

tunnel up and running. You can download the package from [http://

www.shinythings.com/vpnd/vpnd.tar.gz] here. Just download and uncompress it

into /usr/local/vpn. Inside you'll find three files:

* vpnd: The script that controls the tunnel connection.

* check-vpnd: a script to be run by cron to check that vpnd is still up.

* pty-redir: a small executable needed to initialize the tunnel.

You'll need to edit the vpnd script to set things like the client's username

and the server's names. You may also need to modify the starttunnel section

of the script to specify which networks you are using. Below is a copy of the

script for your reading enjoyment. You'll note that you could put the script

in a different directory, you just need to change the VPN_DIR variable.

#! /bin/bash

#

# vpnd: Monitor the tunnel, bring it up and down as necessary

#

USERNAME=vpn-username

IDENTITY=/root/.ssh/identity.vpn

VPN_DIR=/usr/local/vpn

LOCK_DIR=/var/run

VPN_EXTERNAL=vpn.mycompany.com

VPN_INTERNAL=vpn-internal.mycompany.com

PTY_REDIR=${VPN_DIR}/pty-redir

SSH=${VPN_DIR}/${VPN_EXTERNAL}

PPPD=/usr/sbin/pppd

ROUTE=/sbin/route

CRYPTO=blowfish

PPP_OPTIONS="noipdefault ipcp-accept-local ipcp-accept-remote local noauth nocrtscts lock nodefaultroute"

ORIG_SSH=/usr/bin/ssh

starttunnel () {

$PTY_REDIR $SSH -t -e none -o 'Batchmode yes' -c $CRYPTO -i $IDENTITY -l $USERNAME > /tmp/vpn-device

sleep 15

$PPPD `cat /tmp/vpn-device` $PPP_OPTIONS

sleep 15

# Add routes (modify these lines as necessary)

/sbin/route add -net 10.0.0.0 gw $VPN_INTERNAL netmask 255.0.0.0

/sbin/route add -net 172.16.0.0 gw $VPN_INTERNAL netmask 255.240.0.0

/sbin/route add -net 192.168.0.0 gw $VPN_INTERNAL netmask 255.255.0.0

}

stoptunnel () {

kill `ps ax | grep $SSH | grep -v grep | awk '{print $1}'`

}

resettunnel () {

echo "reseting tunnel."

date >> ${VPN_DIR}/restart.log

eval stoptunnel

sleep 5

eval starttunnel

}

checktunnel () {

ping -c 4 $VPN_EXTERNAL 2>/dev/null 1>/dev/null

if [ $? -eq 0 ]; then

ping -c 4 $VPN_INTERNAL 2>/dev/null 1>/dev/null

if [ $? -ne 0 ]; then

eval resettunnel

fi

}

settraps () {

trap "eval stoptunnel; exit 0" INT TERM

trap "eval resettunnel" HUP

trap "eval checktunnel" USR1

}

runchecks () {

if [ -f ${LOCK_DIR}/tunnel.pid ]; then

OLD_PID=`cat ${LOCK_DIR}/vpnd.pid`

if [ -d /proc/${OLD_PID} ]; then

echo "vpnd is already running on process ${OLD_PID}."

exit 1

else

echo "removing stale pid file."

rm -rf ${LOCK_DIR}/vpnd.pid

echo $$ > ${LOCK_DIR}/vpnd.pid

echo "checking tunnel state."

eval checktunnel

fi

else

echo $$ > ${LOCK_DIR}/vpnd.pid

eval starttunnel

fi

}

case $1 in

check) if [ -d /proc/`cat ${LOCK_DIR}/vpnd.pid` ]; then

kill -USR1 `cat ${LOCK_DIR}/vpnd.pid`

exit 0

else

echo "vpnd is not running."

exit 1

fi ;;

reset) if [ -d /proc/`cat ${LOCK_DIR}/vpnd.pid` ]; then

kill -HUP `cat ${LOCK_DIR}/vpnd.pid`

exit 0

else

echo "vpnd is not running."

exit 1

fi ;;

--help | -h)

echo "Usage: vpnd [ check | reset ]"

echo "Options:"

echo " check Sends running vpnd a USR1 signal, telling it to check"

echo " the tunnel state, and restart if neccesary."

echo " reset Sends running vpnd a HUP signal, telling it to reset"

echo " it's tunnel connection." ;;

esac

ln -sf $ORIG_SSH $SSH

settraps

runchecks

while true; do

i=0

while [ $i -lt 600 ]; do

i=((i+1))

sleep 1

done

eval checktunnel

done

-----------------------------------------------------------------------------

4.4. LRP - Linux Router Project

I actually run this setup on Pentium 90's running the LRP distribution of

Linux. LRP is a distribution of Linux that fits in, and boots off of a single

floppy disk. You can learn more about it at [http://www.linuxrouter.org/]

http://www.linuxrouter.org/ You can download my LRP package for the VPN

client from [http://www.shinythings.com/vpnd/vpnd.lrp] here. You will also

need both the ppp and ssh packages from the LRP site.

-----------------------------------------------------------------------------

Chapter 5. Implementation

In this section, I explain step by step how to set up your VPN system. I'll

start with the server, and then move on to the client. For the purposes of an

example, I will invent a situation that would require a couple of different

kinds of VPN set up.

-----------------------------------------------------------------------------

5.1. Planning

Let's imagine that we have a company, called mycompany.com. At our head

office, we are using the 192.168.0.0 reserved network, breaking the class B

into 256 class C networks to allow routing. We have just set up two small

remote offices, and want to add them to our network. We also want to allow

employees who work from home to be able to use their DSL and cable modem

connections instead of making them use dialup. To start, we need to plan

things out a little.

I decide that I want to give each remote office a class C network range to

allow them to expand as necessary. So, I reserve the 192.168.10.0 and

192.168.11.0 nets. I also decide that for home users, I've got enough numbers

that I don't need to masquerade them on the VPN server side. Each client gets

it's own internal IP. So, I need to reserve another class C for that, say

192.168.40.0. The only thing that I must now do is to add these ranges to my

router. Let's imagine that our company owns a small Cisco (192.168.254.254)

that handles all of the traffic through our OC1. Just set routes on the Cisco

such that traffic headed to these reserved nets goes to our VPN server

(192.168.40.254). I put the VPN server into the home user's net for reasons

that should become clear later. We'll name the external interface of the

server vpn.mycompany.com, and the internal vpn-internal.mycompany.com.

As for external numbers, we don't need to know them explicitly. You should

have your own numbers, supplied by your ISP.

-----------------------------------------------------------------------------

5.2. Gather the tools

We will need a few pieces of software. Get the following packages, and

install them where specified.

-----------------------------------------------------------------------------

5.2.1. For the Server:

* pppd (version 2.3 or greater)

* ssh (version 1.2.26 or better)

-----------------------------------------------------------------------------

5.2.2. For the Client:

* pppd (same version as server)

* ssh

* [ftp://ftp.vein.hu/ssa/contrib/mag/pty-redir-0.1.tar.gz] pty-redir

-----------------------------------------------------------------------------

5.3. Server: Build the kernel

To start, you probably need to rebuild your kernel for the server. You need

to make sure that the following kernel options are turned on in addition to

basic networking and everything else that you might need. If you've never

built your own kernel before, read the [/HOWTO/Kernel-HOWTO.html] Kernel

HOWTO.

For 2.0 kernels:

* CONFIG_FIREWALL

* CONFIG_IP_FORWARD

* CONFIG_IP_FIREWALL

* CONFIG_IP_ROUTER

* CONFIG_PPP

For 2.2 kernels:

* CONFIG_FIREWALL

* CONFIG_IP_ADVANCED_ROUTER

* CONFIG_IP_FIREWALL

* CONFIG_IP_ROUTER

* CONFIG_PPP

-----------------------------------------------------------------------------

5.4. Server: Configure Networking

If you are building a server that has only one network card, I suggest that

you think about buying another, and rewiring your network. The best way to

keep your network private is to keep it on it's own wires. So if you do have

two network cards, you'll need to know how to configure both of them. We'll

use eth0 for the external interface, and eth1 for the internal interface.

-----------------------------------------------------------------------------

5.4.1. Configuring the interfaces

We first should configure the external interface of the server. You should

already know how to do this, and probably already have it done. If you don't,

then do so now. If you don't know how, go back and read the [/HOWTO/

NET3-4-HOWTO.html] Networking HOWTO

Now we bring up the internal interface. According to the numbers that we've

chosen, the internal interface of the server is 192.168.40.254. so we have to

configure that interface.

For 2.0 kernels, use the following:

# /sbin/ifconfig eth1 192.168.40.254 netmask 255.255.255.0 broadcast 192.168.40.255

# /sbin/route add -net 192.168.40.0 netmask 255.255.255.0 dev eth1

For 2.2 kernels, use the following:

# /sbin/ifconfig eth1 192.168.40.254 netmask 255.255.255.0 broadcast 192.168.40.255

That gets our basic interfaces up. You can now talk to machines on both

local networks that are attached to the server.

-----------------------------------------------------------------------------

5.4.2. Setting routes

We can now talk to machines on our local nets, but we can't get to the rest

of our internal network. That requires a few more lines of code. In order to

reach the other machines on other subnets, we need have a route that tells

traffic to go to the Cisco router. Here's that line:

# /sbin/route add -net 192.168.0.0 gw 192.168.254.254 netmask 255.255.0.0 dev eth1

That line tells the kernel that any traffic destined for the 192.168.0.0

network should go out eth1, and that it should be handed off to the Cisco.

Traffic for our local net still gets where it is supposed to because the

routing tables are ordered by the size of the netmask. If we were to have

other internal nets in our network, we would have a line like the above for

each net.

-----------------------------------------------------------------------------

5.4.3. Making filter rules

Now that we can reach every machine that we could need to, we need to write

the firewall filtering rules that allow or deny access through the VPN

server.

To set the rules with ipfwadm, run it like so:

# /sbin/ipfwadm -F -f

# /sbin/ipfwadm -F -p deny

# /sbin/ipfwadm -F -a accept -S 192.168.40.0/24 -D 192.168.0.0/16

# /sbin/ipfwadm -F -a accept -b -S 192.168.10.0/24 -D 192.168.0.0/16

# /sbin/ipfwadm -F -a accept -b -S 192.168.11.0/24 -D 192.168.0.0/16

To set the rules with ipchains, run it like so:

# /sbin/ipchains -F forward

# /sbin/ipchains -P forward DENY

# /sbin/ipchains -A forward -j ACCEPT -s 192.168.40.0/24 -d 192.168.0.0/16

# /sbin/ipchains -A forward -j ACCEPT -b -s 192.168.10.0/24 -d 192.168.0.0/16

# /sbin/ipchains -A forward -j ACCEPT -b -s 192.168.11.0/24 -d 192.168.0.0/16

This tells the kernel to deny all traffic except for the traffic that is

coming from the 192.168.40.0/24 network and destined for the 192.168.0.0/16

network. It also tells the kernel that traffic going between the 192.168.10.0

/24 and 192.168.0.0/16 nets is allowed, and the same for the 192.168.11.0

net. These last two are bidirectional rules, this is important for getting

the routing to work going both ways.

-----------------------------------------------------------------------------

5.4.4. Routing

For home users, everything will work fine to here. However for the remote

offices, we need to do some routing. First of all, we need to tell the main

router, or Cisco, that the remote offices are behind the VPN server. So

specify routes on the Cisco that tell it to send traffic destined for the

remote offices to the VPN server. Now that that is taken care of, we must

tell the VPN server what to do with the traffic destined for the remote

offices. To do this, we run the route command on the server. The only problem

is that in order for the route command to work, the link must be up, and if

it goes down, the route will be lost. The solution is to add the routes when

the clients connects, or more simply, to run the route command frequently as

it's not a problem to run it more than is necessary. So, create a script and

add it to your crontab to be run every few minutes, in the script, put the

following:

/sbin/route add -net 192.168.11.0 gw 192.168.10.253 netmask 255.255.255.0

/sbin/route add -net 192.168.10.0 gw 192.168.11.253 netmask 255.255.255.0

-----------------------------------------------------------------------------

5.5. Server: Configure pppd

Now we will configure pppd on the server to handle VPN connections. If you

are already using this server to handle dialup users or even dialing out

yourself, then you should note that these changes may affect those services.

I go over how to avoid conflicts at the end of this section.

-----------------------------------------------------------------------------

5.5.1. /etc/ppp/

This directory may contain a number of files. You probably already have a

file called options. This file holds all of the global options for pppd.

These options cannot be overridden by pppd on the command line.

-----------------------------------------------------------------------------

5.5.2. /etc/ppp/options

Your options file should contain at least the following:

ipcp-accept-local

ipcp-accept-remote

proxyarp

noauth

The first two lines tell pppd to accept what the other end specifies for IP

addresses. This is necessary when hooking up remote offices, but can be

disabled if you are only connecting home users. It's okay to leave it on, as

it does not prevent the server from assigning addresses, it only says it that

it's okay to accept what the client asks for.

The third line is very important. From the pppd man page:

proxyarp

Add an entry to this system's ARP [Address Resolu-

tion Protocol] table with the IP address of the

peer and the Ethernet address of this system. This

will have the effect of making the peer appear to

other systems to be on the local ethernet.

This is important because if it is not done, local traffic will not be able

to get back through the tunnel.

The last line is just as important. This tells pppd to allow connections

without username and password. This is safe since authentication is already

handled by sshd.

-----------------------------------------------------------------------------

5.5.3. Avoiding conflicts

If you are handling other services with pppd, you should consider that the

configurations for these other services may not be the same as what the VPN

system needs. pppd is designed such that the options in the main options file

/etc/ppp/options cannot be overridden by options specified at runtime. This

is done for security reasons. In order to avoid conflict, determine which

options cause the conflict, and move them from the main file into a separate

options file that is loaded when the appropriate application of pppd is run.

-----------------------------------------------------------------------------

5.6. Server: Configure sshd

The following is what my /etc/sshd_config file looks like. Yours should look

the same or similar:

# This is the ssh server system wide configuration file.

Port 22

ListenAddress 0.0.0.0

HostKey /etc/ssh_host_key

RandomSeed /etc/ssh_random_seed

ServerKeyBits 768

LoginGraceTime 600

KeyRegenerationInterval 3600

PermitRootLogin yes

IgnoreRhosts yes

StrictModes yes

QuietMode no

FascistLogging yes

CheckMail no

IdleTimeout 3d

X11Forwarding no

PrintMotd no

KeepAlive yes

SyslogFacility DAEMON

RhostsAuthentication no

RhostsRSAAuthentication no

RSAAuthentication yes

PasswordAuthentication no

PermitEmptyPasswords no

UseLogin no

The important points to note are that password authentication is disabled as

are all of the "R" services. I have also turned off mail checking and the

message of the day as they can confuse pppd on the client side. I still allow

root login, but as this can only be done with a key, it is adequately safe.

-----------------------------------------------------------------------------

5.7. Server: Set up user accounts

Now we'll set up the user accounts.

-----------------------------------------------------------------------------

5.8. Add vpn-users group

just run:

# /usr/sbin/groupadd vpn-users

Now cat the /etc/group file and look at the last line. It should be the

entry for the vpn-users group. Note the third field. This is the group ID

(GID). Write it down, as we'll need it in a minute. For this example, the GID

is 101.

-----------------------------------------------------------------------------

5.9. create the vpn-users home directory

We're going to use a single home directory for all of the users. So just

run:

# mkdir /home/vpn-users

-----------------------------------------------------------------------------

5.10. The .ssh directory

Now create the .ssh directory in the vpn-users home directory.

# mkdir /home/vpn-users/.ssh

-----------------------------------------------------------------------------

5.11. Adding users

Now comes the fun part. We're going to edit the /etc/passwd file by hand.

Normally you let the system handle this file, but for an unusual setup like

this, it is easier to do it yourself. To start, open the /etc/passwd file and

see what's in there. Here's an example of what you might find:

...

nobody:x:65534:100:nobody:/dev/null:

mwilson:x:1000:100:Matthew Wilson,,,:/home/mwilson:/bin/bash

joe:*:1020:101:Joe Mode (home),,,:/home/vpn-users:/usr/sbin/pppd

bill:*:1020:101:Bill Smith (home),,,:/home/vpn-users:/usr/sbin/pppd

frank:*:1020:101:Frank Jones (home),,,:/home/vpn-users:/usr/sbin/pppd

...

You'll find the first user on most any system. The second one is me. After

that are a few made up vpn-users. The first field is the username, and the

second is the password field. The third is user ID (UID) and the fourth is

the group ID (GID). After that comes some info on who the people are in the

fifth field. The sixth field is the user's home directory, and the last is

their shell. As you can see, each field is separated by a colon. Look at the

last three lines. The only difference between them is the username in the

first field, and the user info in the fifth field. What we want to do is

create lines like this for each user. Don't just use one user for all of the

connections, you'll never be able to tell them apart if you do. So copy the

last line of this file and edit it so that it looks something like the above.

Make sure that the second field has an asterisk (*). The second field should

be unique to all the other IDs in the file. I used 1020. You should use a

number above 1000, since those below are typically reserved for system use.

The fourth field should be the group ID for vpn-users. I told you to write it

down, now is the time that you need it. So put the group ID in there. Lastly,

change the home directory to /home/vpn-users, and the shell to /usr/sbin/

pppd. Now copy that line to make more users. Just edit the first the fifth

fields and you're set.

-----------------------------------------------------------------------------

5.12. Server: Administration

One of the advantages to using this system for user accounts is that you can

take advantage of the UNIX user administration commands. Since each client is

logged in as a user, you can use standard methods to get user statistics. The

following are a few commands that I like to use to see what all is going on.

who

Prints the users currently logged in, as well as when they logged in,

from where (name or IP), and on which port.

w

This command prints a more extensive listing of who is currently logged

in. It also tells you uptime and load averages for the system. It also

lists the user's current process (which should be -pppd for VPN clients)

as well as idle time, and current CPU usage for all processes as well as

the current process. Read the w man page for more info.

last [username]

This lists the login history for the specified user, or for all users if

a username is not provided. It's most useful for finding out how well the

tunnels are running as it prints the length of time that the user was

logged in, or states that the user is still logged in. I should warn you

that on a system that has been up a long time, this list can grow

extremely long. Pipe is through grep or head to find out exactly what you

want to know.

You can also control which users are allowed to connect by modifying the /

home/vpn-users/.ssh/authorized_keys file. If you remove the user's public key

line from this file, they won't be able to log in.

-----------------------------------------------------------------------------

5.13. Client: Build the kernel

Now we move onto the client. First we must rebuild the kernel so that it can

support all of the functions that we need. The minimum requirement is to have

ppp in the kernel. You will need forwarding, a firewall, and a gateway only

if you are going to allow other machines access to the tunnel. For this

example, I will setup one of the remote office machines in my example layout.

Add the following options to your kernel. Again, if you've never built a

kernel before, read the [/HOWTO/Kernel-HOWTO.html] Kernel HOWTO.

For 2.0 kernels:

* CONFIG_PPP

* CONFIG_FIREWALL

* CONFIG_IP_FORWARD

* CONFIG_IP_FIREWALL

* CONFIG_IP_ROUTER

* CONFIG_IP_MASQUERADE

* CONFIG_IP_MASQUERADE_ICMP

For 2.2 kernels:

* CONFIG_PPP

* CONFIG_FIREWALL

* CONFIG_IP_ADVANCED_ROUTER

* CONFIG_IP_FIREWALL

* CONFIG_IP_ROUTER

* CONFIG_IP_MASQUERADE

* CONFIG_IP_MASQUERADE_ICMP

-----------------------------------------------------------------------------

5.14. Client: Configure Networking

Now we should setup the networking on our client box. Let's assume that

we've configured the external network and that it works. Now we will

configure the internal interface of the client to service our intranet.

-----------------------------------------------------------------------------

5.14.1. Interface

We need to first bring up the internal network interface. To do this, add

the following to your /etc/rc.d/rc.inet1 (or equivalent) file:

For 2.0 Kernels:

/sbin/ifconfig eth1 192.168.10.253 broadcast 192.168.10.255 netmask 255.255.255.0

/sbin/route add -net 192.168.10.0 netmask 255.255.255.0 dev eth1

For 2.2 Kernels:

/sbin/ifconfig eth1 192.168.10.253 broadcast 192.168.10.255 netmask 255.255.255.0

-----------------------------------------------------------------------------

5.14.2. Filter rules

To set up the remote office, we will want to set up our filter rules that

allow traffic to go both directions through the tunnel. Add the following

lines to your /etc/rc.d/rc.inet1 (or equivalent) file:

For 2.0 kernels:

/sbin/ipfwadm -F -f

/sbin/ipfwadm -F -p deny

/sbin/ipfwadm -F -a accept -b -S 192.168.10.0/24 -D 192.168.0.0/16

For 2.2 kernels:

/sbin/ipchains -F forward

/sbin/ipchains -P forward DENY

/sbin/ipchains -A forward -j ACCEPT -b -s 192.168.10.0/24 -d 192.168.0.0/16

You may have noticed that these lines look like what we have on the server.

That's because they are the same. These rules just say where traffic is

allowed to go between these two networks.

-----------------------------------------------------------------------------

5.14.3. Routing

The only extra routes that are needed are created by the script that bring

the tunnel up.

-----------------------------------------------------------------------------

5.15. Client: Configure pppd

You may not need to edit the client's /etc/ppp/options file at all. You will

if the "auth" option is present, or some of the other priveledged options.

Try it, and if it fails, a black /etc/ppp/options will work. just keep adding

the options from the old file to figure out which one broke it (if it's not

obvious) and see if you can get around that. Maybe you don't need them at

all. You probably don't if you don't use pppd for anything else.

-----------------------------------------------------------------------------

5.16. Client: Configure ssh

As root on the client, run the following lines:

# mkdir /root/.ssh

# ssh-keygen -f /root/.ssh/identity.vpn -P ""

This will create two files, identity.vpn and identity.vpn.pub in the .ssh

directory. The first is your private key, and should be kept such. Never send

this over the net unless it is via an encrypted session. The second file is

your public key, and you can send this anywhere you want, it only serves to

allow you access to other systems, and cannot be used to get into your own.

It is a text file with one line in it that is your actual key. At the end of

the line is the comment field which you may change without fear of breaking

the key. an example key looks something like this:

1024 35 1430723736674162619588314275167.......250872101150654839 root@vpn-client.mycompany.com

It's actually a lot longer than that, but it wouldn't fit on the page if I

showed the whole thing. Copy your key into the /home/vpn-users/.ssh/

authorized_keys file on the server. Make sure that there is only one key per

line, and that each key is not broken onto multiple lines. You may alter the

comment field all that you like in order to help you remember which line goes

with which user. I highly recommend doing so.

-----------------------------------------------------------------------------

5.17. Client: Bring up the connection

Now we'll try to actually make the connection to the VPN server. First we'll

need to make a single connection to set up the ssh known_hosts file. Run

this:

# ssh vpn.mycompany.com

Answer "yes" when it asks you if you want to continue connecting. The server

will tell you "permission denied", but that's okay. It's important that you

use the same name for the server that you are using in your connection

scripts. Now run the following lines. You will obviously need to change the

options to suit your setup.

# /usr/sbin/pty-redir /usr/bin/ssh -t -e none -o 'Batchmode yes' -c blowfish -i /root/.ssh/identity.vpn -l vpn-user vpn.mycompany.com > /tmp/vpn-device

Sign In

linux tips and tricks

Recommended Posts

prakash0106 0

Share this post

Link to post

prakash0106 0

Share this post

Link to post

prakash0106 0

Share this post

Link to post

prakash0106 0

Share this post

Link to post

prakash0106 0

Share this post

Link to post

Please sign in to comment

Browse

Activity