Happy System Administrator Appreciation Day

Try playing bofhle game.  Each guess must be a valid 5 letter Unix or Linux command. Hit the enter button to submit.

 

Happy Sysadm Day! https://sysarmy.com/bofhle/

Switch Between CLI and GUI

How to change between the cmdline interface and the GUI by editing the boot target.

First, we no longer use the runlevel term. Instead, we refer to boot choices as targets. The 2 primary targets here: multi-user.target (the CLI or runlevel 3 in legacy) and the graphical.target (the GUI or runlevel 5 in legacy).

To identify the current target:

$ sudo systemctl get-defeault

To launch GUI from the multi-user.target:

$ sudo systemctl isolate graphical.target

And to switch back to CLI mode:

$ sudo systemctl usolate multi-user.target

To set a default target

$ sudo systemctl  set-default multi-user.target

To reboot and confirm the appropriate target:

$ sudo systemctl reboot

Target Files

Targets are managed by .target files that simply group units and dependencies into a convenient format. It;s really the .unit files that define exactly what services and other features start when the target is initiated.

$ sudo systemctl enable sshd

$ sudo systemctl disable sshd

 

Links:

• Linux Run Levels
  

Mounting Disk Image File

After we create disk image file with dd, we have two options: restore it, or mount he file directly.

Once we finished cloning from a partition to a disk image file as below:

# dd if=/dev/sdb1 of=/mnt/share/disk_120G.img

We can mount the file with the following instruction to access some of the files without restoring the whole partition to a drive.

# file disk_120G.img

# fdisk -l disk_120G.img

Check what is the start sector. Let say the filesystem starts on sector 63 (from the fdisk output). Each sector is always 512 bytes long, thus we will use an offset of 32256 (63*512) bytes. 

# losetup -f

# losetup --offset 32256 /dev/loop2 disk_120G.img

# mount /dev/loop2 /mnt/point

Links:

• Mounting a raw partition file made with dd or dd_rescue in Linux
• Creating Disk Image and MBR
  

Restrict SSH Users to Run Limited Commands

This is the note to focus on how to restrict SSH users from executing certain commands once they successfully log in to a remote OpenSSH server.

Setup key-based authentication

$ key-keygen

$ ssh-copy-id login@remote-ssh-server

On the remote SSH server, a file called 'authorized_keys' should be created at ~/.ssh. We should see the copied public key.

$ ssh login@remote-ssh-server

$ cd ~/.ssh

$ cat authorized_keys

 

Restrict Execution in 'authorized_keys' file

To restrict a user to execute the 'ls' command on this server, we can modify the authorized_keys file in the following manner:

from="192.168.233.84",command="/usr/bin/ls" ssh-rsa AAAABBB.......

The entry above will point to the IP address and specified the only command to be executed.

Once we login to the remote SSH server, the ls command will execute and the connection will be closed.

We can create a BASH script and restrict the execution to the BASH script which provide limited command only.

Links:

• https://www.linuxshelltips.com/restrict-ssh-user-commands/
  

Creating Disk Image and MBR

Creating disk image or just MBR (master boot record) in Linux is common for backups, copying disks, and recovery. And the 'dd' command is an easy to use tool for making such clones.

To clone an entire hard disk:

# dd if=/dev/sda of=/dev/sdb bs=64K conv=noerror,sync

The cmdline above set the block size to 64k (can be 128k or other value), and continue operation and ignoring all read errors. It also add input blocks with zeroes if there were any read errors, so data offsets stay in sync. Both hard disks (sda and sdb) must be the same size.

To clone a partition and make a disk image:

dd if=/dev/sdb1 of=disk_sdb1.img bs=128K conv=noerror,sync

dd if=/dev/sdb1 conv=sync,noerror bs=128K | gzip -c > disk_sdb1.img.gz

dd if=/dev/sdb1 conv=sync,noerror bs=128K status=progress | gzip -c | ssh xx@remote.ip dd of=disk_sdb1.img.gz

 

To restore system:

# gunzip -c disk_sdb1.img.gz | dd of=/dev/sdb1

To copy MBR:

# dd if=/dev/sda of=/dev/sdb bs=512 count=1

The cmdline above will copy 512 bytes (MBR) from sda to sdb disk. This only work if both disks are identically sized partitions.

# dd if=/dev/sda of=/tmp/mbrsda.bak bs=512 count=1

The cmdline above will copy 512 bytes (MBR) from sda to a disk image for 2 disks with different size partitions.

To restore the MBR to any sdb:

# dd if=/tmp/mrbsda.bak of=/dev/sdb bs=446 count=1

Master Boot Record (MBR) is the 512-byte boot sector that is the first sector of a partitioned data storage device of a hard disk.  MBR is divided into 3 sections:
1. Bootstrap - 446 bytes
2. Partition table - 64 bytes
3. Signature - 2 bytes

For restore MBR, use 446 bytes to overwrite/restore your /dev/sda MBR boot code only, and use 512 bytes to overwrite/restore your /dev/sda full MBR.

To backup and restore the primary and extended partition tables:

# sfdisk -d /dev/sda > /tmp/sda.bak

# sfdisk /dev/sda < /tmp/sda.bak

 

To backup MBR and Extended Partitions schema:

# dd if=/dev/sda of=/tmp/backup-sda.mbr bs=512 count=1

# sfdisk -d /dev/sda > /tmp/backup-sda.sfdisk

 

To restore MBR and Extended Partition schema:

# dd if=/tmp/backup-sda.mbr of=/dev/sda

# sfdisk /dev/sda < /tmp/backup-sda.sfdisk

 

Links:

• https://www.cyberciti.biz/faq/unix-linux-dd-create-make-disk-image-commands/
• https://www.cyberciti.biz/faq/howto-copy-mbr/
  

Linux Run Levels

Linux changes the run-level:

• (Old Linux distro) SysV init uses run-level number from 0 to 6.
• cmdline: init, telinit, who
  
• (New Linux distro) systemd init uses systemd targets.
• cmdline: systemctl 

 

Linux runlevel defines the state of the OS. 

SysV	Systemd targets	Description
0	runlevel0.target poweroff.target	Halt or shutdown the Linux system
1	runlevel1.target rescue.target	Single-user text mode (useful for maintenance mode)
2	runlevel2.target multi-user.target	Not used
3	runlevel3.target multi-user.target	Full multi-user text mode (used on Linux servers)
4	runlevel4.target multi-user.target	Not used
5	runlevel5.target graphical.target	Full multi-user GUI mode. You can use X-based login screen. Useful for Linux desktop
6	runlevel6.target reboot.target	Reboot Linux system

Comparing the cmdline used.

SysV	Systemd	Description
runelvel who -r	systemctl get-default	Show the current runlevel
init 1	systemctl rescue systemctl emergency	Change the runlevel to single user mode for maintenance
init 3	systemctl multi-user-target	Change to multi-user text mode
init 0	systemctl poweroff	Poweroff
init 6	systemctl reboot	Reboot
	systemctl default	Back to default target
init 5	systemctl graphical.target	Change to GUI mode

Links:

• https://www.cyberciti.biz/tips/linux-changing-run-levels.html
  

Securing Docker Socket with SUDO

By default, we can't use docker as non-root user. Have you ever wonder why?

Docker has the ability to change the group ownership of the /run/docker.socket to have group permission of 660, with the group ownership the docker group. This would allow users added to the docker group to be able to run docker containers without having to execute sudo to become root.  🚨

Here's the default permission for docker socket:

ls -l /var/run/docker.sock
srw-rw----. 1 root docker 0 Feb  3 13:02 /var/run/docker.sock

 

Here's a secured docker socket configuration:

ls -l /var/run/docker.sock
srw-rw----. 1 root root 0 Feb  3 13:02 /var/run/docker.sock

Why? Simple: if a user can talk to the docker socket, they can execute the following command to gain full root access to the host system.

docker run -ti --privileged -v /:/host fedora chroot /host

Similarly, the below sudo config will give full root access to the host system to non-root user (xx).

grep xx /etc/sudoers
xx  ALL=(ALL)   NOPASSWD: ALL

This will effectively allow a non-root user to run sudo sh and get the full root access to the host system.

There are 2 ways to secure the host: one with sudo (which provide logging and audit) and one with lock down of docker socket permission (no auditing and events will disappear when docker daemon restarts).

 

Setting up sudo

Add an entry like the following to /etc/sudoers.

grep xx  /etc/sudoers
xx        ALL=(ALL)       NOPASSWD: /usr/bin/docker

This will allow the specified user (xx) to run docker as root, without a password. Nest setup an alias for running the docker command:

alias docker="sudo /usr/bin/docker"

Now whne the user executes the docker command as non-root, it will be allowed and get proper logging.

docker run -ti --privileged -v /:/host fedora chroot /host

And loog at the journal or /var/log/messages.

journalctl -b | grep docker.*privileged
Feb 04 09:02:56 dhcp-10-19-62-196.boston.devel.redhat.com sudo[23422]:   xx : TTY=pts/3 ; PWD=/home/xx/docker ; USER=root ; COMMAND=/usr/bin/docker run -ti --privileged -v /:/host fedora chroot /host

Links:

• https://projectatomic.io/blog/2015/08/why-we-dont-let-non-root-users-run-docker-in-centos-fedora-or-rhel/
  

Security Screen Saver

Seldom I come across any screen saver for security. Today, when I clean up some of my old files, I discovered an old screen saver I downloaded from Microsoft, "The 10 Immutable Laws of Security Administration". 

• Law #1: Nobody believes anything bad can happen to them, until it does 
  
• Law #2: Security only works if the secure way also happens to be the easy way 
  
• Law #3: If you don't keep up with security fixes, your network won't be yours for long 
  
• Law #4: It doesn't do much good to install security fixes on a computer that was never secured to begin with 
  
• Law #5: Eternal vigilance is the price of security 
  
• Law #6: There really is someone out there trying to guess your passwords 
  
• Law #7: The most secure network is a well-administered one 
  
• Law #8: The difficulty of defending a network is directly proportional to its complexity 
  
• Law #9: Security isn't about risk avoidance; it's about risk management 
  
• Law #10: Technology is not a panacea 
  

If I remember correctly, the screen saver was released in December 2000 (8 years back). You can download it from Microsoft Security Screen Saver.

Reset root's Password (with GRUB)

If you lost your root's password, but you have GRUB boot loader installed. Here's the list of steps to reset it:

• Power up your machine and press ESC while GRUB menu starts.
• If there is a 'recovery mode' option, select it and press 'b' to boot into single user mode.
• Press 'e' (to edit) to the default menu option.
• Highlight the line with 'kernel' and press 'e' again.
• Append 'single' at the end of the line.
• Press 'b' to boot into single-user mode.

With this, you should end up getting a shell with root privilege (#).

Note, some distribution might require you to re-mount the partition (with /etc inside) with read-write:

mount -o rw,remount /dev/hda1 /

Another way is to reset password with Live CD.

• Boot the machine with a LiveCD.
• Search the partition that hold the /etc/passwd file: sudo fdisk -l
  
• Make a directory mount point: sudo mkdir /media/sda1
• Mount the partition with the mount point: sudo mount /dev/sda1 /media/sda1
• Change root to the mount point: sudo chroot /media/sda1
• Change the password: passwd root
  

Avoid Re-activation of Windows XP (on same machine)

This tip is useful if you plan to reinstall your machine (XP) without reactivate it.

1. Backup the file called "WPA.DBL", located in %systemroot%\system32 folder.
2. Reinstall your XP, but decline the activation.
3. Restore the WPA.DBL file to the same location.

>>> http://www.online-tech-tips.com/computer-tips/how-to-reactivate-windows/

WiFi Vs. WiMax

Wireless Compared

	WiFi	WiMax
Recommended Uses	Short-range, LAN-centric	Long-range, MAN-centric
Spectrum	Unlicensed spectrum 802.11b/g – 2.4 GHz 802.11n – 2.4 GHz, 5 GHz	Unlicensed or licensed spectrum between 2-66 GHz US: 2.4 GHz International: 2.3 GHz, 3.5 GHz
Quality of Service	Minimal - QoS is relative only between packets/flows	Guaranteed - QoS is assured using scheduling algorithms at MAC layer
Cell Footprint	< 300 meters maximum Most implementations about 30 meters	Up to 10 kilometers Most implementations about 3 km
Bandwidth	802.11b: 11 Mbps max 802.11g: 54 Mbps max 802.11n: at least 100 MbpsAll bandwidth is at short range	Up to 70 Mbps theoretical max Up to 40 dedicated subscriber channels Expect 15 Mbps at 3 km range

A comparison of typical WiFi and WiMax performance characteristics

Windows Vista(R) Performance and Tuning

Overview

Windows Vista and SP1 focus on delivering greater performance and overall system responsiveness. By striking a balance between speed and responsiveness, Windows Vista and SP1 deliver a level of performance that has the greatest positive impact on the system's usability.This guide looks at the following areas of performance improvement:

• Making configuration changes that help a computer feel more responsive when you use it.
• Using hardware to boost the actual physical speed of a computer.
• Making configuration changes that help a computer to start faster.
• Making the computer more reliable may help increase performance.
• Monitoring performance occasionally so that you can stop problems before they get too big.

>>> http://www.microsoft.com/downloads/details.aspx?familyid=ab377598-a637-432c-a3c8-1607ab629201&displaylang=en

Keep IPv6 Out of Windows Vista and Windows Server 2008

Not many people are familiar with IPv6 address scheme today. Sometimes, network troubleshooting in Windows Vista and Windows Server 2008 can be cumbersome. These OSs at times tend to give an IPv6 response to a network request instead of the IPv4 answer we're used to seeing. Two things you can do to keep IPv6 out of the picture for now.

Firstly, forces ping to use IPv4 for the request:

ping -4 hostname.domain.net

Secondly, disable IPv6 functionality entirely (via registry). Set the data for this value to 0xffffffff to disable all IPv6 components (except for the IPv6 loopback interface). This setting also configures the computer to prefer IPv4 over IPv6. Restart the computer for the setting to take effect.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters\

DisabledComponents (DWORD): 0xffffffff

The Only True Drop-in MS-Exchange Alternative

Just come across this solution from the web, which claims to provide plugin-free interoperability with Microsoft Exchange server. This PostPath Server is a Linux-based enterprise-class email and collaboration server. It is the only drop-in, natively interoperable alternative to Microsoft Exchange.

From the documentation, it seems impressive. It has 4 lines of product:

1. PostPath Server
2. PostPath Webmail
3. PostPath Vmware Edition
4. PostPath Archive Edition
   

The PostPath Server™ incorporates code from several open source projects. They do make modifications to that open source code and is available for download. If you are interested in downloading these modifications, give it a try at PPSD Open Source Modifications, ftp://ftp.postpath.com/pub/OpenSource/.

Attributes in NTFS

How many attributes do you know in NTFS?

Normally we will used to a few common attributes: Readonly, Archive, System, and Hidden. There are more than these actually. According to the documentation, we can have the following attributes for a file in NTFS: RASHCNETO.

• Readonly:

• For a file, applications can read the file, but cannot write to it or delete it.Applications can read the file but cannot write to it or delete it. For a directory, applications cannot delete it. * See here for more detail.

• Archive:

• The file or directory is an archive file. Applications use this attribute to mark files for backup or removal.

• System:

• The file or directory is part of the operating system, or is used exclusively by the operating system.

• Hidden:

• The file or directory is hidden. It is not included in an ordinary directory listing.

• Compress:
  

• The file or directory is compressed. For a file, this means that all of the data in the file is compressed. For a directory, this means that compression is the default for newly created files and subdirectories.

• Not content indexed:

• The file or directory is not to be indexed by the content indexing service.

• Encrypted:

• The file or directory is encrypted. For a file, this means that all data in the file is encrypted.For a directory, this means that encryption is the default for newly created files and subdirectories.

• Temporary:

• The file is being used for temporary storage. File systems avoid writing data back to mass storage if sufficient cache memory is available, because often the application deletes the temporary file shortly after the handle is closed. In that case, the system can entirely avoid writing the data. Otherwise, the data is written after the handle is closed.

• Offline:

• The data of the file is not immediately available. This attribute indicates that the file data has been physically moved to offline storage. This attribute is used by Remote Storage, the hierarchical storage management software. Applications should not arbitrarily change this attribute.

You can check all these from here and here. See also Potential issues involved in updating Windows NT IFS drivers to Windows 2000.

FILE_ATTRIBUTE_OFFLINE

When this new attribute is set on a file, the network timeout on the file is extended from 45 seconds to 1000 seconds. (This new default value can in turn be changed via the registry setting System\CurrentControlSet\Services\LanmanWorkStation\Parameters\ OffLineFileTimeoutInterval.) This new attribute is supported in the Windows 2000 redirector (RDR). It may also be backported to a Windows NT 4.0 service pack at some point (it is not in SP4), and possibly a Windows 98 service pack. It is intended for use by devices with high latencies, such as tape or optical disk libraries.

Use and interpretation of FILE_ATTRIBUTE_OFFLINE is optional, except for filter drivers that perform volume scans. Such drivers should ignore offline files by default, although they may offer advanced users the option of including offline files in the scan.

System Administrator Appreciation Day

Do you know that today is the 9th Annual of System Administrator Appreciation Day (Last Friday Of July)?

If you can read this, thanks to your sysadmin. If you want to know more what have your System Administrator do, click here.