Linux System Administration Guide

Postfix

Mail Transport / Script TriggerPostfix can be configured to call script when the mail arrives. To run a particular script when the email arrives, you need to configure two files master.cf and transport.

In transport file, add:

[email protected] transportLabel:domain_of_nexthub

If mail arrives with email address [email protected], the transport script tagged by transportLabel at domain_of_nexthub, which is specified in master.cf, will be called.In master.cf, add an entry to call the script:

transportLabel unix - n n - 1 pipe
flags= user=faxserver argv=/usr/bin/procmail -f-

Login Using SSH Using Public/Private Key Pair Without Password

You may want to login to a ssh server using public/private key pair without password to save much of typing. To do this, you have to configure your SSH server to reconfigure sshd_config using following parameters:

RSAAuthentication yes
PubkeyAuthentication yes
AuthorizedKeysFile .ssh/id_dsa.pub
PasswordAuthentication yes
PermitEmptyPasswords yes

In ssh_config on your client side, set:

IdentityFile ~/.ssh/id_dsa

After that, generate the public and private key:

ssh-keygen -t dsa -b 512 -N “”

A Certificate Authority is a trusted third party, which certifies Public Key's to truly belong to their claimed owners. It is a key part of any Public Key Infrastructure, since it allows users to Trust that a given Public Key is the one they wish to use, either to send a private message to its owner or to verify the signature on a message sent by that owner.

Create a private key file

openssl genrsa -des3 -rand any_filename -out server.key 1024

Remove the password from the key file (optional)

openssl rsa -in server.key -out server.pem

Create self-signed certificate

openssl req -new -x509 -days 365 -key server.key -out server.crt

Configure Apache

SSLCertificateFile /path/to/certs/server.crt
SSLCertificateKeyFile /path/to/certs/server.key

The rpm command is used to manage software applications and system modules.

RPM Command	Description
rpm -qilp program_package-ver.rpm	Query for information on package and list destination of files to be installed by the package.
rpm -Uvh program_package-ver.rpm	Upgrade the system with the RPM package
rpm -ivh program_package-ver.rpm	New Install
rpm -Fvh program_package-ver.rpm	Freshen install. Removes all files of older version.
rpm -q program_package	Query system RPM database (/var/lib/rpm), to see if package is installed.
rpm -qi program_package	Query system RPM database for info/description on package (if installed)
rpm -ql program_package	List all files on the system associated with the package.
rpm -qf file	Identify the package to which this file belongs.
rpm -e program_package	Uninstall package from your system
rpm -qa	List ALL packages on your system. Use this with grep to find families of packages.
RPM Flag	Description
--nodeps	RPM flag to force install even if dependancy requirements are not met.
--force	Overwrite of other packages allowed.
--notriggers	Don't execute scripts which are triggered by the installation of this package.
--root /directory-name	Use the system chrooted at /directory-name. This means the database will be read or modified under /directory-name. (Used by developers to maintain multiple environments)
--ignorearch	Allow installation even if the architectures of the binary RPM and host don't match. This is often required for RPM's which were assembled incorrectly
rpm -K --nogpg *.rpm	Non sure if RPM downloded ok? Verify md5 sum.

Build

Configuring your ~/.rpmmacrosPut something similiar to the following in a file called .rpmmacros in your home directory:

%packager James Lin <[email protected]>
%distribution James Project
%vendor James Project

%_topdir /home/jamesl/rpm

The .rpmmacros file is used by rpmbuild to provide defaults. Creating your build directoriesIn order to build packages as a user, you will also need to create build directories. By default, rpm will expect to find and use the following directories:

%{_topdir}/BUILD
%{_topdir}/RPMS
%{_topdir}/RPMS/i386
%{_topdir}/SOURCES
%{_topdir}/SPECS
%{_topdir}/SRPMS

You will need to manually create the directories.

mkdir /home/jamesl/rpm/BUILD
mkdir /home/jamesl/rpm/RPMS
mkdir /home/jamesl/rpm/RPMS/i386
mkdir /home/jamesl/rpm/SOURCES
mkdir /home/jamesl/rpm/SPECS
mkdir /home/jamesl/rpm/SRPMS

View Content Of A Package In A File

rpm -qlp file.rpm

Using iptables

iptables -A PREROUTING -t nat -i eth0 -d $virtual_www -p tcp --dport 80 -j DNAT --to-destination 192.168.1.1-192.168.1.100

Email Handler / Filter

Sample Procmail Configuration

Filtering Spam Mail

:0 i
* ^Subject: Spam messages
/dev/null

Send Carbon Copy

:0 c
! [email protected]

Setup Server

Add NISDOMAIN to /etc/sysconfig/network or run domainname command to set domain for your NIS:Set

NISDOMAIN=<your domain>

Or run

domainname <your domain>

Create map / database file for your system, which will include host, passwd, group and ....:

cd /var/yp
make

Star the ypserv:

service ypserv start

Mounting Windows Network Place Or Network Neightborhood Using Samba

If you want to mount Windows Network Place or Network Neightborhood via Samba, use smbmount command. The following command works for Samba 2.2.7a version.

smbmount //servername/folder /mnt/mount-point -o “username=NT-Login, password=NT-pwd, workgroup=workgroupname, ip=192.168.1.1, uid=unix-login, gid=unixgid”

The following Makefile script is used by me to perform both full and incremental backup. It is very use.

BKSRC = /root /home/user /home/cvsroot
EXCLUDE = --exclude *.tmp --exclude *.bak
TIMESTAMP = /etc/backup/fullbackup
BKDEV = /win/Backup
BKLOG = /etc/backup/logs
BKFILE = linuxbackup
CLEANOBJ = -name "*~"
CLEANPATH = /home /root
DELETE = /home/user/.openoffice

all:

clean:
find $(CLEANPATH) $(CLEANOBJ) -exec rm -f {} \;
rm -rf $(DELETE)

inc:
echo "Inc. backup begin : `date` " >> $(BKLOG) ; \
echo >> $(BKLOG) ; \
tar -c -p $(EXCLUDE) --newer-mtime="`cat $(TIMESTAMP)`" \
-B -f $(BKDEV)/$(BKFILE)-inc.tar $(BKSRC) ;\

echo "Inc. backup end : `date` " >> $(BKLOG) ; \
ls -l $(BKDEV)/$(BKFILE)-inc.tar >> $(BKLOG)

fullbk:
date > $(TIMESTAMP) ; \
echo "Full backup begin : `date` " >> $(BKLOG) ; \
echo >> $(BKLOG) ; \
tar -c -p $(EXCLUDE) -B -f $(BKDEV)/$(BKFILE).tar $(BKSRC) ; \
echo "Full backup end : `date` " >> $(BKLOG) ; \
echo >> $(BKLOG)

Create initial CVS deposit directory on server side:

cvs -d /home/cvsroot init

Create a user called cvs on the server and make sure /home/cvsroot has cvs ownership.If you want to use CVS server mode, in RedHat 8.0+, edit the file /etc/xinetd.d/cvspserver to include the following:

service cvspserver
{

disable = no
port = 2401
socket_type = stream
protocol = tcp
user = root
wait = no
type = UNLISTED
server = /usr/bin/cvs
server_args = -f --allow-root /home/cvsroot pserver

}

Restart the xinetd service:

service xinetd restart

Creating a new desposit for your file by goto the directory where you want to put everthing inside in the CVS. Let's say that directory is call 'data'.Issue:

cvs -d :pserver:cvs:pwd@localhost:/home/cvsroot import -m “Description” data version release

Delete the 'data' directory and check out the data from the CVS:

cvs -d :pserver:cvs:pwd@localhost:/home/cvsroot co data

If you want to leave out the argument '-d' and the directory path that follows, set the environment variable CVSROOT to:

export CVSROOT=:pserver:cvs:pwd@localhost:/home/cvsroot

You can create a name for your branch version of work. To do so use 'tag' command:

cvs tag -b data-1-2

If you create a branch and want to merge the revision of a branch with main trunk, check out the main/trunk version first and update with the branch version using '-r' option followed by the version label.You can merge the branch and the main trunk and store it in another directory called newdata:

cvs co -j branch-version -d newdata data

Server

To specify what file system to export and to what hosts through /etc/exports file:

file-system host( options )

For example:

/home unisys01(rw)
/exports unisys*(rw)

Then issue 'exportfs' command to export the file system:

exportfs -a

Client

Automount maps configuration.

The master map, /etc/auto.master:
# access directory indirect map file timeout in sec.
/mnt/home /etc/auto.home --timeout 60
/mnt/docs /etc/auto.docs

A client request to access a directory tree whose root is listed in the master map (such as cd /mnt/docs) will cause the automounter to search the specified map for a server to satisfy the request.

The indirect map files.

/etc/auto.docs:
doc1 server1:/usr/share/doc/doc1

/etc/auto.home:
* server1:/export/home/&

pstree	Processes and parent-child relarionships
top	Show top processes
ps -auxw	process status
vmstat	Monitor virtual memory
free	Display amount of free and used memory in the system. (Also: cat /proc/meminfo)
pmap	Display/examine memory map and libraries (so). Usage: pmap pid
cat /proc/sys/vm/freepages	Display virtual memory "free pages". One may increase/decrease this limit: echo 300 400 500 > /proc/sys/vm/freepages
uname -a	print system information
cat /proc/version	Display Linux kernel version in use.
cat /etc/redhat-release	Display Red Hat Linux Release. (also /etc/issue)
uptime	Tell how long the system has been running. Also number of users and system's load average.
w	Show who is logged on and what they are doing.
/sbin/lsmod	List all currently loaded kernel modules. Same as cat /proc/modules
/sbin/runlevel	Displays the system's current runlevel.
hostname	Displays/changes the system's node name. (Must also manually change hostname setting in /etc/sysconfig/network. Command will change entry in /etc/hosts)
service	Display status of system services. Example: service --status-all Help: service --help

GUI/Graphical:

gkrellm	Graphical system monitor. (Additional package)
GLcpu	networked load meter. Very cool 3-D graphics.

List of tools:

• tools for finding the status of your system

At some point you will be required to administer the installation of PERL modules.
Installation can be done:

• Manually:
  • Un-zip/Un-tar module: tar xzf yourmodule.tar.gz
  • Build with PERL makefile:
    • perl Makefile.PL
    • make
  • Install: make install

  See: CPAN module install page

• Automatically: (preferred)

       # perl -MCPAN -e shell          - First time through it will ask a bunch of questions. Answer "no" to the first question for autoconfigure.
       ...
       ..
  
       cpan> install URI
       ...
       ..
  
       cpan> i /PerlMagick/            - Inquire about module. (Search by keyword)
       Distribution    J/JC/JCRISTY/PerlMagick-5.36.tar.gz
       Module          Image::Magick   (J/JC/JCRISTY/PerlMagick-5.36.tar.gz)
  
       cpan> install Image::Magick
       ...
  
       cpan> install Image::Info
       ...
  
       cpan> install IO::String
       IO::String is up to date.
  
       cpan> help
       

  This method rocks! It connects to a CPAN server and ftp's a gzipped tarball and installs it. First time through it will ask a bunch of questions. (Answer "no" to the first question for autoconfigure.) Defaults were good for me. The only reason to manually configure this is if you are using a proxy. It then asks for your location (i.e. North America) and country. I entered a number for the first CPAN server but after that the actual URL was cut and pasted in whole.

  If it fails, you must load the appropriate RPMs and retry using "force install module-name"

PERL update: perl -MCPAN -e 'install Perl'

 

Managing Time

Set System Time:

• Print the time returned by the remote host: rdate -p hostname
• Set the system time to the returned time: rdate -s hostname

Try: rdate -p time.ucla.edu

See List of public NTP Time Servers

Note: Typically many web servers set their time to GMT due to the world wide nature of their service. Internally UNIX systems use Coordinated Universal Time (UTC) which is the number of seconds since Jan 1, 1970 0 hrs. "Calendar Time" is then calculated based on your time zone and whether you are on Standard or Daylight Savings time.

Sync System Time:

The timed (time server daemon) allows one to synchronizes the host's time with the time of another host. This is a master - slave configuration. See the timed and timedc man pages.

Freshmeat list of time daemon software

Shell environment variables:

• TZ: Time Zone
  • i.e.: export TZ=PST8PDT
  • Zone format: [time standard] [offset] [dst]
  • See directory: /usr/share/zoneinfo/
  • File: /usr/share/zoneinfo/PST8PDT not viewable.
  • See file: /usr/share/zoneinfo/zone.tab
  • See tzset, tzselect man pages.
• TIMEFORMAT:
  For more info see the man page for your shell. (i.e. man bash)

Find man page

Form of command: find path operators

Examples:

• Search and list all files from current directory and down for the string ABC:
  find ./ -name "*" -exec grep -H ABC {} \;
• Find all files of a given type from current directory on down:
  find ./ -name "*.conf" -print
• Find all user files larger than 5Mb:
  find /home -size +5000000c -print
• Find all files owned by a user (defined by user id number. see /etc/passwd) on the system: (could take a very long time)
  find / -user 501 -print
• Find all files created or updated in the last five minutes: (Great for finding effects of make install)
  find / -cmin -5
• Find all users in group 20 and change them to group 102: (execute as root)
  find / -group 20 -exec chown :102 {} \;
• Find all suid and setgid executables:
  find / \( -perm -4000 -o -perm -2000 \) -type f -exec ls -ldb {} \;
  find / -type f -perm +6000 -ls

  Note: suid executable binaries are programs which switch to root privaleges to perform their tasks. These are created by applying a "stickey" bit: chmod +s. These programs should be watched as they are often the first point of entry for hackers. Thus it is prudent to run this command and remove the "stickey" bits from executables which either won't be used or are not required by users. chmod -s filename

• Find all world writable directories:
  find / -perm -0002 -type d -print
• Find all world writable files:
  find / -perm -0002 -type f -print
  find / -perm -2 ! -type l -ls
• Find files with no user:
  find / -nouser -o -nogroup -print
• Find files modified in the last two days:
  find / -mtime 2 -o -ctime 2
• Compare two drives to see if all files are identical:
  find / -path /proc -prune -o -path /new-disk -prune -o -xtype f -exec cmp {} /new-disk{} \;

Partial list of find directives:

Directive	Description
-name	Find files whose name matches given pattern
-print	Display path of matching files
-user	Searches for files belonging to a specific user
-exec command {} \;	Execute Unix/Linux command for each matching file.
-atime (+t,-t,t)	Find files accessed more that +t days ago, less than -t or precisely t days ago.
-ctime (+t,-t,t)	Find files changed ...
-perm	Find files set with specified permissions.
-type	Locate files of a specified type: c: character device files b: blocked device d: directories p: pipes l: symbolic links s: sockets f: regular files
-size n	Find file size is larger than "n" 512-byte blocks (default) or specify a different measurement by using the specified letter following "n": nb: bytes nc: bytes nk: kilobytes nw: 2-byte words

Also see:

• gFind - GUI front-end to the GNU find utility

Many system and server application programs such as Apache, generate log files. If left unchecked they would grow large enough to burden the system and application. The logrotate program will periodically backup the log file by renameing it. The program will also allow the system administrator to set the limit for the number of logs or their size. There is also the option to compress the backed up files.

Configuration file: /etc/logrotate.conf
Directory for logrotate configuration scripts: /etc/logrotate.d/

Example logrotate configuration script: /etc/logrotate.d/process-name

    /var/log/process-name.log {
        rotate 12
        monthly
        errors root@localhost
        missingok
        postrotate
            /usr/bin/killall -HUP process-name 2> /dev/null || true
        endscript
    }

The at command will schedule single jobs. (cron is for re-occuring jobs) The daemon /usr/sbin/atd will run jobs scheduled with the at command. Access control to the command is controlled using the files /etc/at.allow (list of user id's permitted to use the at command) and /etc/at.deny.

Time is specified before the date:

• at HH:MM month-name day with an optional year
• at midnight MMDDYY
• at HH PM today
• at noon DD.MM.YY
• at 14:30 19.03.06
• at noon tomorrow

The at command will respont with it's "at>" prompt upon which you enter the command you wish to execute folowed by "Enter". More commands may be entered. When done enter "control-d".

Input at commands from a file: at midnight today < job-list-file

List jobs with the command atq

    [prompt]$ atq
    1	2002-03-07 12:00 a user-id

Delete job with the command atrm

    [prompt]$ atrm 1

Man pages:

• at - schedule job at a specified time
• atq - lists the user's pending jobs or all if root
• atrm - deletes jobs, identified by their job number
• batch - executes commands when system load levels permit (based on a specified system load)
• atrun - for backward compatability. Functionality built into at

The command rdist helps the system administrator install software or update files accross many machines. The process is launched from one computer.

Command: rdist -f instruction-file

Instruction file:

files=(
/fully-qualified-path-and-file-name
/next-fully-qualified-path-and-file-name
)
dest = ( computer-node-name )

${files} -> ${dest}

install /fully-qualified-directory-name-of-destination;

For more info see the rdist man page

Also see the rsync man page to migrate file changes.

vi Editor

Controlling The Screen Display of Your Session

Repaint the current screen {ctrl-l}
Display line #, # of lines, etc.. {ctrl-g}

Moving the Cursor

Beginning of current line 0 or ^
Beginning of first screen line H
Beginning of last screen line L
Beginning of middle screen line M
Down one line j, {return}, +
End of current line $
Left one character h, {ctrl-h}
Left to beggining of word b, B
Right one character l, {space}
Right to end of word e, E
Right to beginning of word w, W
Up one line k, -
Beginning of next sentence )
Beginning of previous sentence (

Paging Through Text

Back one screen {ctrl-b}
Down half a screen {ctrl-d}
Down one screen {ctrl-f}
Forware to end of file G
Move cursor to specified line line no. G
Up half a screen {ctrl-j}

Special Pattern Characters

Beginning of line ^
End of line $
Any character except newline .
Any number of the preceding character *
Any set of characters (except newline) .*

Searching Through Text

Backward for pattern ?pattern
Forward for pattern /pattern
Repeat previous search n
Reverse direction of previous search N

Show *all* lines containing pattern :beg,endg/pattern/p
:1,$g/compiler/p Will print all lines with the pattern compiler.

Substitute patt2 for all patt1 found. :beg,ends/patt1/patt2/g
:%s/notfound/found/g Will change all occurences of notfound to found.

Creating Text

Append text after cursor a
Append text after end of line A
Insert text before cursor i
Insert text at beginning of line I
Open new line after current line o
Open new line before current line O
Take next character literally
(i.e. control characters...)
and display it {ctrl-v}

Modifying Text

Change current word cw, cW
Change current line (cursor to end) C
Delete character (cursor forward) x
Delete character (before cursor) X
Delete word dw, dW
Delete line dd
Delete text to end of line D
Duplicate text (use yank and put)
Join current line with next line J
Move text (use delete and put)
Put buffer text after/below cursor p
Put buffer text before/above cursor P
Repeat last modification command .
Replace current character r
Replace text to end of line R
Substitute text for character s
Undo your previous command u
Transpose characters xp
Yank (copy) word into buffer yw
Yank (copy) current line into buffer Y

Making Corrections During Text Insertions

Overwrite last character {delete}
Overwrite last word {ctrl-w}

Ending Your Editing Sessions

Quit (no changes made) :q
Quit and save changes ZZ, :wq
Quit and discard changes :q!

Using ex Commands From Within vi

Copy specified lines :co, t
Display line numbers :set nu
Disable display of line numbers :set nonu
Move lines after specified line :m
Read file in after specified line :r filename
Review current editor options :set
Review editor options :set all
Set new editor option :set option
Write changes to original file :w
Write to specified file :w filename
Force write to a file :w! filename

Some useful set options for your ~/.exrc file:

:set all Display all Set options
:set autoindent Automagically indent following lines to the indentation
of previous line.
:set ignorecase Ignore case during pattern matching.
:set list Show special characters in the file.
:set number Display line numbers.
:set shiftwidth=n Width for shifting operators << and >>
:set showmode Display mode when in Insert, Append, or Replace mode.
:set wrapmargin=n Set right margin 80-n for autowrapping lines
(inserting newlines). 0 turns it off.

When running on the Linux 2.2 kernel, each process is limited by default to 1,024 file descriptors.

To increase the maximum file descriptors per process to 4,096 (from 1,024) and the maximum tasks per user to 4,090 (from 256) on Linux 2.2, do the following steps.

Change the following C header files.
In /usr/include/linux/tasks.h, change:

NR_TASKS 512 -> 4090
MAX_TASKS_PER_USER (NR_TASKS/2) -> NR_TASKS

In /usr/include/linux/limits.h, change:

NR_OPEN 1024 -> 4096
OPEN_MAX 256 -> 4096

In /usr/include/linux/posix_types.h, change:

__FD_SETSIZE 1024 -> 4096

In /usr/include/bits/types.h, change:

__FD_SETSIZE 1024 -> 4096

To allow users to increase their file descriptor limits, change the following configuration files:
In /etc/security/limits.conf, add the lines:

* soft nofile 1024
* hard nofile 4096

In /etc/pam.d/login, add:

session required /lib/security/pam_limits.so

To increase the system-wide file descriptor limit, add the following three lines to the /etc/rc.d/rc.local startup script:

# Increase system-wide file descriptor limit.
echo 8192 > /proc/sys/fs/file-max
echo 24576 > /proc/sys/fs/inode-max