Updated: 2014-04-02 05:32 EDT
sudoers
grouproot
loginstar
archive backup and listingDo not print this assignment on paper!
- On paper, you will miss updates, corrections, and hints added to the online version.
- On paper, you cannot follow any of the hyperlink URLs that lead you to hints and course notes relevant to answering a question.
- On paper, scrolling text boxes will be cut off and not print properly.
23h59 (11:59pm) Saturday March 29, 2014 (end of Week 11)
Do not print this assignment on paper! On paper, you cannot follow any of the hyperlink URLs that lead you to hints and course notes relevant to answering a question.
This assignment is based on your weekly Class Notes.
This is an overview of how you are expected to complete this assignment. Read all the words before you start working.
Do not print this assignment on paper. On paper, you cannot follow any of the hyperlink URLs that lead you to hints and course notes relevant to answering a question.
You will create file system structure in your CLS home directory containing various directories and files. You will also make changes in your own Linux Virtual Machine running Centos 6.5. You can use the Checking Program to check your work as you do the tasks. You can check your work with the checking program as often as you like before you submit your final mark. Some task sections below require you to finish the whole section before running the checking program; you may not always be able to run the checking program successfully after every single task step.
When you are finished the tasks, leave the files and directories in place on both the CLS and your own Linux Virtual Machine as part of your deliverables. Do not delete any assignment work until after the term is over! Assignments may be re-marked at any time on the CLS; you must have your term work available on the CLS right until term end.
Since I also do manual marking of student assignments, your final mark may not be the same as the mark submitted using the current version of the Checking Program. I do not guarantee that any version of the Checking Program will find all the errors in your work. Complete your assignments according to the specifications, not according to the incomplete set of mistakes detected by the Checking Program.
The previous term’s course notes are available on the Internet here: CST8207 GNU/Linux Operating Systems I. All the notes files are also on the CLS. You can learn about how to read and search these files using the command line on the CLS under the heading Copies of the CST8207 course notes near the bottom of the page Course Linux Server. The current CST8177 term notes are searchable there, too!
All references to the “Source Directory” below are to the CLS directory ~idallen/cst8177/14w/assignment09/
and that name starts with a tilde character followed by a userid with no intervening slash. The leading tilde indicates to the shell that the pathname starts with the HOME directory of the account idallen
(seven letters).
You do not have permission to list the names of all the files in the Source Directory, but you can access any files whose names you already know.
Review your work from CST8207 GNU/Linux Operating Systems I:
passwd, useradd, userdel, groupadd, gpasswd, usermod, chown, chgrp, chmod, chsh
Do a Remote Login to the Course Linux Server (CLS) from any existing computer, using the host name appropriate for whether you are on-campus or off-campus.
Create the CLS directory ~/CST8177-14W/Assignments/assignment09
Create the check
symbolic link needed to run the Checking Program, as described in the section Part II - Check and Submit below.
Run Part II - Check and Submit to verify your work so far.
sudoers
groupWe will create a special
sudoers
group. Thesudo
command will be configured to permit any account in this group to become theroot
user and run any command with full privileges.
Login to your CentOS Virtual Machine as the root
user (the only user).
sudo
command, as follows:
man groupadd
manual page:
-r
system group option.login.defs
file mentioned there is in the /etc/
directory.man
page are not actually defined in the file – looks like a bug in CentOS.gid
field for a system group will be less than the value of GID_MIN
found in the file. Look up the value.sudoers
gid
field less than GID_MIN
?gid
field less than GID_MIN
?sudo
to use the new sudoers
group, as follows:
/etc/sudoers
(for example, /etc/sudoers.bak
)
sudoers
file with the visudo
command (which will use the Small vi
editor, not vim
.
vi
with this command: EDITOR=vim visudo
# %wheel ALL=(ALL) ALL
wheel
, create a new line (and a comment above it) that allows anyone in the sudoers
group to run all commands. (You will yank and put two lines and edit one of the two lines you put.)#
at the front of the line from the previous step. The line must start with %
followed by the new group name (not wheel
)./etc/sudoers
file and quit the editor./etc/sudoers.bak
and the new /etc/sudoers
file. Make sure that the only changes you see are the ones you intended to make. If not, restore the file (or restore a previous snapshot) and make the changes again.
/etc/sudoers
grep '^%sudoers' /etc/sudoers
Run the Fetch and Checking Program to verify your work so far.
In this section you will create your own system administration account on your CentOS VM. This personal account can be customized for you. All work is done on your CentOS Virtual Machine.
Do not add extensive customization to the
root
account on a system, since such customization may not suit allroot
users of the system and may break automated programs that need to become theroot
user.Leave the
root
account on your CentOS Virtual Machine alone.References to man pages below will be to CentOS man pages, not CLS man pages. Since CentOS Linux and Ubuntu Linux are different distributions, they sometimes have different documentation and programs.
Review Users and Groups:
The CentOS useradd
command creates a new account, storing information about the account in the /etc/passwd
file and about the account groups in the /etc/group
file. It also creates a HOME directory for the account and places standard start-up files into it.
The passwd
command sets a password for an account, storing the password in the shadow password file named /etc/shadow
. An account cannot be used until a password has been set. Group passwords (rarely used) are stored in the shadow group file /etc/gshadow
.
If necessary, login to your CentOS Virtual Machine as the root
user (the only user).
sudoers
group in the previous section.
sudoers
group name in the system group file.man useradd
manual page:
SYNOPSIS
and note where the LOGIN name must be used on the useradd
command line.--comment
option and following argument used to define your full name. The (quoted) full name argument must immediately follow the option on the command line. See below.-r
system account option and how using it will require you to use the -m
option as well. Remember that.-m
option. You must use this, too.man
page under -r
are not actually defined in the given file – looks like a bug in CentOS.uid
field for a system account will be less than the value of UID_MIN
found in the file. Look up the value.useradd
man page, add a new system account with the following settings:
/etc/passwd
on the CLS:
/etc/passwd
is called the GECOS field or user’s name or comment field.Firstname
Lastname
- CST8177-14W-4NN
” where Firstname
and Lastname
are your name and 4NN
is your own three-digit lab section number.--comment
option.useradd
, verify it:
UID_MIN
.id abcd0001
where abcd0001
is your new account name.
uid
and gid
are less than UID_MIN
, indicating a system account./etc/skel/
. As system admin, you can put custom files in this directory that will be given to all accounts crated using useradd
.uid
field, you may restore your snapshot and try again, or delete the account using userdel -r
and try again.man passwd
.root
account password. RTFMWarning: If you do not type the username argument to the password command, you are changing the password of the account that you are signed in with (i.e. the root
account!). Do not change your root
password! Change the password of your new non-root account.
sudo
for the new account, as follows:
man gpasswd
manual page.sudoers
group. (Do not edit the group file! Use the correct system command.)id abcd0001
where abcd0001
is your account name.
sudoers
group listed.sudo
, as follows. (You can do this on the VMware console or via an SSH login.)
root
account.man sudo
, or search the course notes, for how to “gain root
privileges” when you are a sudoer.root
privileges using the sudo
command to start a root
privilege shell:
-i
option to set a correct root
PATH
that includes system administration paths such as /sbin
.$
to include the #
character that indicates root
privileges.root
’s) when prompted by the sudo
command? Use your own password with sudo
.root
) user in the sudoers
group?/etc/sudoers
file that allows anyone in the sudoers
group to run all commands? (Check your work.)sudo
works, type whoami
or id
to confirm that you are the root
user and are in the root
group.pwd
. If you are still in your sysadmin HOME directory, you didn’t use the correct sudo
option to do a full login. Try again. Using the right option will have you change to root
and also change to the HOME directory of root
(that is not under /home
).root
shell privileges as your sysadmin (non-root
) user, because you are about to disallow root
logins./etc/sudoers.bak
if everything is working correctly.Run the Fetch and Checking Program to verify your work so far.
root
loginsMany systems increase security by making it impossible to become the
root
user directly using aroot
account password, forcing people to first login with their own account name and only then usesudo
to execute privileged commands.
root
shell privileges using the sudo
command, if necessary.
$
to include the #
character that indicates root
privileges.root
PATH
that includes /sbin
Type whoami
or id
to confirm that you are the root
user.
Lock the root
account password using the correct option of the passwd
command.
Confirm that the password field for the root
account in the shadow file now has an exclamation mark !
at the beginning, locking it.
Exit your current shell to release root
privileges, so that you return to your system admin account and see a regular prompt (no #
character).
Verify that you cannot use su
to become root
any more using the locked root
account password.
You must now always log in as your sysadmin account and use sudo
to become root
.
Run the Fetch and Checking Program to verify your work so far.
Your new system admin account is missing the shell prompt, options, and aliases of your account on the CLS. Let’s bring some selected files from the CLS to your CentOS sysadmin account.
root
shell, if you are running as root
.whoami
or id
to confirm that you are not running as root
.
.bashrc
and .bash_profile
from your account on the CLS (the remote machine) to the HOME directory of your account on your CentOS VM (the local machine) with scp
, as follows:
scp
command in Unix/Linux SCP Command.scp
command.scp
command name.
cp
command.Log out of CentOS and log back in as your sysadmin account to make your shell environment the same as it would be on the CLS. All the options and aliases should be the same on both machines now.
Move your CST8177-14W
directory from the root
HOME directory to your own account HOME directory and recursively set its owner and group to be your userid and group. Do not leave root
-owned files in your account.
Advanced users can use
find
to find files with the wrong owner and send those pathnames intosudo
runningxargs
withchown
. See Find and Xargs.
Run the Fetch and Checking Program to verify your work so far.
You will use the standard account management tools to create a few ordinary (non-admin) accounts, just as you did last term. You will force password expiry so that the users must change their passwords when they first log in.
root
shell privileges using the sudo
command, if necessary.
$
to include the #
character that indicates root
privileges.root
PATH
that includes /sbin
Type whoami
or id
to confirm that you are the root
user.
user001
, user002
, user003
User One
, User Two
, User Three
/etc/skel/
directory.Set different, good initial passwords for the three users.
Run the Fetch and Checking Program to verify your work so far.
Few organizations create users manually. The batch
newusers
command (RTFM) can read a text file and create user accounts in bulk. In this section, you will be creating a text file suitable for input to thenewusers
command, then usingnewusers
to quickly create almost a hundred new accounts.
root
shell, if you are running as root
.Type whoami
or id
to confirm that you are not running as root
.
On CentOS, make your own directory ~/CST8177-14W/Assignments/assignment09
, in which you will create the files and scripts resulting from the following tasks. (You already did this on the CLS; now do it here on CentOS.)
userlist.csv
from the Source Directory on the CLS to the above assignment09
directory in your account on your CentOS machine.
Imagine that the userlist.csv
file was given to you from the Human Resources department by someone who created it with a spreadsheet.
Examine this file, and notice that it is in Colon-Separated-Value format. It is 98 lines: a header line and a username and a real name for each of 97 new users that need an account on your system.
The file contains five fields, separated by colons (:
). Read the header line to know what the five fields are. (A real spreadsheet export would be separated by commas, but we’re making it easier for you.)
We need to create a text file suitable for batch input to the newusers
command. Every line in the file we give to newusers
must have the correct format: it must have the userid at the start and the seven colon-separated fields described at the top of the newusers
man page.
The file given to us only has five fields, and it has a poor password set for all the accounts. We need to fix this file before we can feed it to the newsers
command.
Note: If you read all the words in this section before you start working, you will save yourself some file copying by using one command pipeline (no temporary files needed) instead.
userlist.newusers
based on userlist.csv
, but make the following changes.
userlist.csv
file into the new file userlist.newusers
.userlist.csv
is a header line, not a user to be created; the first line must be deleted. Use a command to read the file, remove the first (header) line, and write a temporary output file. The temporary output file should be only 97 lines long. (Hint: What command shows the last 97 lines of a file? [Double Hint: That same command has a syntax to “print beginning with the Kth item from the start of each file” which allows you to skip the first line without knowing how many lines are in the file.])userlist.newusers
file.
Use sed
to read the new file and on every line insert the two colon characters that correspond to the location of the missing pw_uid
and pw_gid
fields needed by newusers
, and write a temporary output file. For example, use sed
to change this line:
user066:password:User 066:/home/user066:/bin/bash
to this line with two more colon characters in the right place:
user066:password:::User 066:/home/user066:/bin/bash
on all 97 lines. (This is a one-expression sed
substitution.) (Hint: You can’t simply change a colon to three colons. Use some fixed context around your expression, to select the correct colon to change.)userlist.newusers
file.
pw_passwd
field that currently contains password
, which is not a good default password for all these accounts. RTFM to see how the pw_passwd
field is used by newusers
.
sed
to read the new file and on every line change the pw_passwd
field from the dummy value password
to a single, common password that all of these new users will get. You choose the new password. (This is not very secure, but it’s the best you can do without writing a more complex script.)password
.sed
command to read this file and change the word password
to the password that you made up, redirecting the output of the sed
command to a temporary output file.userlist.newusers
file.password
field.
pw_passwd
field position.userlist.csv
file, and makes each of the above three changes using filters. With a pipeline, no temporary files are needed.
Write this three-command pipeline and when it is working, put it in a script named convert_userlist.sh
. The script should read standard input and write standard output, so that you can type:
$ <userlist.csv ./convert_userlist.sh >userlist.newusers
The script file will contain two or three commands (which might inclue tail
and sed
and maybe another sed
) separated by pipe characters. (If you RTFM, you can combine the two sed
commands into one sed
command with two expressions, or perhaps even into one single expression that does both edits at the same time.) No file names are mentioned in the script, so that the script reads standard input and writes to standard output.
Verify that the userlist.newusers
file contains 97 lines, seven fields per line, with good passwords.
Use sudo
to run the newusers
command with this file to create all of these 97 new users.
user001
through user100
/etc/skel/
in them. Only useradd
copies these files.This reviews the account management commands you learned above and in your previous term. Links to previous term notes and worksheets are given above under Review of CST8207 account management. None of the items below require you to text-edit any system files using a text editor. Actions can be performed using the correct account management commands. Most account management commands will require
root
permissions to run.
Make sure you have correctly followed all the above steps, including using the newusers
command to create 97 accounts. Verify that you have created all the users and HOME directories for accounts user001
through user100
before continuing.
common
.
User 004
and User 005
to the common
group.
Create a directory called /home/common
owned by your sysadmin user, and group-owned by the new common
group.
Change the permissions on /home/common
so that your sysadmin user can read/write/search, members of the common
group can read/write/search, and it is not accessible in any way to other users.
User 004
without using a password (using your sysadmin powers) and as that user, create a group-writeable file in the common
group called /home/common/README
containing the text This common directory is for members of the common group
.
user004
shell to revert back to your superuser-self.User 005
, and ensure that as user005
you can edit the file /home/common/README
and change the text “for members
” to “for all members
”.
user005
shell to revert back to your superuser-self.User 006
and ensure that as user006
you have no access to the /home/common/
directory.
user006
shell to revert back to your superuser-self.User 005
to: CommonUser 005
User 006
and User 007
.
User 008
and User 009
to /bin/sh
.
User 010
and User 011
without deleting their HOME directories.
ls
tells you about the file owner now!)user010
and user011
groups, if they are still present on your machine.
newusers
command did not create shadow group entries. Ignore the error – the groups don’t exist in the group shadow file.User 012
and User 013
using the option that also deletes the HOME directory at the same time.
None of the items above require you to text-edit any system files using a text editor. Actions can be performed using the correct account management commands. Most account management commands will require
root
permissions to run. Do not text-edit the system files!
Run the Fetch and Checking Program to verify your work so far.
tar
archive backup and listingReview the common uses of the tar
command in Package Management from last term.
Assignments
directory, create a compressed tar
archive of your assignment09
directory named assignment09_
YYYYMMDD.tgz
(no spaces), where YYYYMMDD is the date you created the archive backup.
tar
file must not include any parent directories of the assignment09
directory you were asked to save.Move the archive you just created into your assignment09
directory.
Generate a verbose listing of your tar
archive file, showing the contents of the archive including all the owners and date/time stamps, into file tar_tvzf.txt
under your assignment09
directory.
Optional: Read the mouse-over text in this tar
-related comic from the XKCD webcomic.
Run the Fetch and Checking Program to verify your work so far.
That is all the tasks you need to do.
Check your work a final time using the Fetch and Checking Program and save the output as described below. Submit your mark following the directions below.
Optional: Keeping your base CentOS Virtual Machine snapshot, remove any intermediate snapshots you no longer require, to free up disk space. - Be careful not to remove your current work!
Summary: Do some tasks, then run the Fetch and checking program to verify your work as you go. You can run the Fetch and checking program as often as you want. When you have the best mark, upload the marks file to Blackboard.
Since I also do manual marking of student assignments, your final mark may not be the same as the mark submitted using the current version of the Checking Program. I do not guarantee that any version of the Checking Program will find all the errors in your work. Complete your assignments according to the specifications, not according to the incomplete set of the mistakes detected by the Checking Program.
The checking program resides on the Course Linux Server, but your work is on your CentOS Virtual Machine. There is a Fetch program that you must download and use on your CentOS Virtual Machine to copy information from your CentOS Virtual Machine to your account on the CLS so that the checking program can check it on the CLS.
Once the Fetch program has fetched these files from your Virtual Machine to the CLS, you can run the checking program on the CLS to check what is saved in the files. When you make changes on your CentOS Virtual Machine, you need to run the Fetch program again on CentOS to update the saved files on the CLS.
Simply running the checking program on the CLS will not update the saved files on the CLS. You must run the Fetch program on your CentOS VM when you make changes on your CentOS Virtual Machine.
Do all the following steps on your CentOS Virtual Machine. Read through the whole list before you start typing anything. An example of what to type is given below the descriptions that follow.
Failure to read all the words will lock your account out of the CLS.
root
account (same userid as Blackboard) if you have created it, otherwise use the root
account.CST8177-14W/Assignments/assignment09
(use the same directory hierarchy as you already have in your own account on the CLS). If you have created your own sysadmin account already, create the above directory in the HOME of your sysadmin account, otherwise create it in the HOME directory of the root
account. (This assignment will have you move it from the root
account to your own sysadmin account anyway.)assignment09
directory (on CentOS!).curl
to get a copy of the Fetch program from the given URL into a file named do.sh
. Make sure you have a file named do.sh
in your assignment09
directory. You only need to download this once per assignment.curl
program.[assignment09]$ url=http://teaching.idallen.com/cst8177/14w/notes/data/assignment09do.sh
[assignment09]$ curl -A mozilla "$url" >do.sh
[... make sure you scroll right to read the full web URL above ...]
[... various download statistics print here ...]
[assignment09]$ fgrep -i 'error' do.sh # make sure no errors (no output)
[assignment09]$ head -n1 do.sh # make sure it's a shell script
#!/bin/sh -u
root
user (if not already root
) and, as shown below, use sh
to run the do.sh
script you just downloaded to CentOS as the root
user with the USER
environment variable set to your own CLS account userid. (Do not use abcd0001
; use your own.) Make sure you run the script as the root
user.USER
variable. It will copy files from CentOS to your assignment09
directory on the CLS. It will then run the checking program on the CLS to check your work. You will need to answer one question about your IP address, and then wait and type in your CLS password, as shown below.Your actions will look something like the following, running as the root
user, but put your own userid in the USER
variable not abcd0001
:
[root@abcd0001 assignment09]# whoami
root # must be root
[root@abcd0001 assignment09]# USER=abcd0001 sh do.sh # use your *own* userid *not* abcd0001
---------------------------------------------------------------------------
abcd0001: FETCH version 3. Connecting to CLS as USER='abcd0001' using ssh
---------------------------------------------------------------------------
abcd0001: Use local Algonquin IP cst8177-alg.idallen.ca [y/N/?]? n
abcd0001: Please wait; using ssh to connect to user 'abcd0001' on cst8177.idallen.ca ...
*** COURSE LINUX SERVER ***
abcd0001@cst8177.idallen.ca's password: # enter your CLS password
---------------------------------------------------------------------------
idallen-ubuntu assignment09fetch_server.sh version 6 run by abcd0001.
Please wait; collecting info from abcd0001 Virtual Machine
---------------------------------------------------------------------------
VM files collected into CST8177-14W/Assignments/assignment09/abcd0001.tar.bz on CLS.
Now running checking program for abcd0001 on CLS:
[... checking program output appears here ...]
tar
archive in your account under assignment09
on the CLS and then runs the checking program on the CLS. If you only run the checking program on the CLS, it won’t update the files from your CentOS VM and it will just check the existing files saved under assignment09
on the CLS..bashrc
file or world-writable files on the CLS). These errors are on the CLS, not on your CentOS machine.When you are done with your assignment, you need to run the checking program one last time on the CLS (not from CentOS) and submit the output file, as follows:
Do all this on the Course Linux Server when you are ready to submit:
There is a Checking Program named assignment09check
in the Source Directory on the CLS. Create a Symbolic Link to this program named check
under your new assignment09
directory on the CLS so that you can easily run the program to check your work and assign your work a mark on the CLS. Note: You can create a symbolic link to this executable program but you do not have permission to read or copy the program file.
Execute the above “check” program on the CLS using its symbolic link. (Review the Search Path notes if you forget how to run a program by pathname from the command line.) This program will check your fetched CentOS work, assign you a mark, and display the output on your screen. (You may want to paginate the long output so you can read all of it.)
Remember: The checking program does not fetch new files to the CLS from your CentOS VM. You must run the Fetch program on your CentOS VM to update the fetched files on the CLS so that the checking program can mark them on the CLS.
You may run the “check” program as many times as you wish, to correct mistakes and get the best mark. Some task sections require you to finish the whole section before running the checking program at the end; you may not always be able to run the checking program successfully after every single task step.
assignment09.txt
under your assignment09
directory on the CLS. Use the exact name assignment09.txt
in your assignment09
directory. Case (upper/lower case letters) matters. Be absolutely accurate, as if your marks depended on it. Do not edit the file.
YOUR MARK for
assignment09.txt
file from the CLS to your local computer and verify that the file still contains all the output from the checking program. Do not edit this file! No empty files, please! Edited or damaged files will not be marked. You may want to refer to your File Transfer notes.
YOUR MARK for
Upload the assignment09.txt
file under the correct Assignment area on Blackboard (with the exact correct name) before the due date. Upload the file via the assignment09 “Upload Assignment” facility in Blackboard: click on the underlined assignment09 link in Blackboard. Use “Attach File” and “Submit” to upload your plain text file.
No word-processor documents. Do not send email. Use only “Attach File”. Do not enter any text into the Submission or Comments boxes on Blackboard; I do not read them. Use only the “Attach File” section followed by the Submit button. If you need to comment on any assignment submission, send me email.
You can upload the file more than once; I only look at the most recent. You must upload the file with the correct name; you cannot correct the name as you upload it to Blackboard.
You will also see the Review Submission History page any time you already have an assignment attempt uploaded and you click on the underlined assignment09 link.
You cannot delete an assignment attempt, but you can always upload a new version. I only mark the latest version.
Your instructor may also mark files in your directory in your CLS account after the due date. Leave everything there on the CLS. Do not delete any assignment work from the CLS until after the term is over!
I do not accept any assignment submissions by email. Use only the Blackboard Attach File. No word processor documents. Plain Text only.
Use the exact file name given above. Upload only one single file of Linux-format plain text, not HTML, not RTF, not MSWord. No fonts, no word-processing. Linux plain text only.
NO EMAIL, WORD PROCESSOR, PDF, RTF, or HTML DOCUMENTS ACCEPTED.
No marks are awarded for submitting under the wrong assignment number or for using the wrong file name. Use the exact 16-character, lower-case name given above.
WARNING: Some inattentive students don’t read all these words. Don’t make that mistake! Be exact.
READ ALL THE WORDS. OH PLEASE, PLEASE, PLEASE READ ALL THE WORDS!
Author:
| Todd Kelley and
| Ian! D. Allen - idallen@idallen.ca - Ottawa, Ontario, Canada
| Home Page: http://idallen.com/ Contact Improv: http://contactimprov.ca/
| College professor (Free/Libre GNU+Linux) at: http://teaching.idallen.com/
| Defend digital freedom: http://eff.org/ and have fun: http://fools.ca/
Plain Text - plain text version of this page in Pandoc Markdown format
Author Ian! D. Allen