Using system ACL's on Linux

I write this ages ago for a coworker who had never administrated a Linux box and thought I would share it again here since, ACL’s have come up a half dozen times in the last month. While it was written as a fairly basic Linux how to with user management and file manipulation included it is primarily a ACL How-To; so I hope you enjoy :)

Administrators Guide

to

Users, Groups, and ACL Permissions

Note For All Unix Operating Systems: 2

Section 0. Quick Start Command Reference. 2

.....Scenario: 2

.....Required Commands: 2

Section I 3

.....Creating Groups and Users. 3

..........Creating Groups

..........Creating Users

...............Example:

4

..........Setting a users passwd. 5

...............Example:

Section II Using ACL. 6

.....Using ACLs. 6

..........More setfacl Details and Examples

...............Remove Specific Entries from an ACL

...............Remove Entire ACL

...............Using the --set Option

...............Using setfacl Recursively

...............Using ACL Entries from a File:

...............Note on UID, GID, and Permissions

Appendix. 11

.....mkdir 11

..........Options

..........Examples

.....rm.. 12

..........Options

.....useradd. 13

..........Options

.....userdel 16

..........Option

.....usermod. 16

..........Options

.....chpasswd. 18

..........Option

.....passwd. 18

.....sudo. 19

..........Options

.....users. 21

..........Options

.....ls. 21

..........Options

Note For All Unix Operating Systems:

Please remember EVERYTHING in Linux is case sensitive. For example /home/YourFolder is not the same as /home/yourFolder or /home/youRfoldeR as such it is recommended you keep all folder names lowercase and advise users that their ID’s AND passwords are case sensitive. In addition I will be indicating key commands by bolding them, and will refer to the enter/return key as [ret].

Section 0. Quick Start Command Reference

Scenario:

A user who logs into the projects server as ‘even’ wants to create a group called scan and create two users (ted and tod) in that group who’s home folder was DevelopmentTeam.

Required Commands:

[even@projects DevelopmentTeam]# groupadd scan

[even@projects DevelopmentTeam]# useradd -c Ted_is_our_engineering_consultant –d /home/DevelopmentTeam –e 12/31/2005 –g scan ted [ret]

[even@projects DevelopmentTeam]# useradd -c Tod_is_the_citys_plan_reviewr –d /home/DevelopmentTeam –e 12/31/2005 –g scan tod [ret]

[even@projects DevelopmentTeam]# passwd tod [ret]

Changing password for user tod

New UNIX password: ********

BAD PASSWORD: it is based on a dictionary word

Retype new UNIX password: ********

passwd: all authentication tokens updated successfully.

[even@projects DevelopmentTeam]# passwd ted

Changing password for user ted

New UNIX password: ********

BAD PASSWORD: it is based on a dictionary word

Retype new UNIX password: ********

passwd: all authentication tokens updated successfully.

[even@projects DevelopmentTeam]#

Section I Perquisites

Enabling ACL’s

ACL’s or Access Control Lists enable you to provide a more robust set of file permissions. The core benefits com in being able to have more then one group associated with a file and the ability to have tight on non existent upstream permissions for a user or group while giving them total control of the downstream directories and files. The other great advantage is integration of a file server into the active directory of you windows domain. With ACL’s you get much a much closer approximation to NTFS style permission (still limited to just RWX permissions, but there is more flexibility who has those permissions) and your samba server can translate everything for you such that those permissions can be easily, albeit slowly, controlled by your end users on the windows box.

Enabling ACL’s

Technically ACL is not supported in the official kernel by default. You can add it as a module, or use a distribution that compiles it as part of the kernel. Most RedHat based distributions come with support. However we are required to mount the volume with ACL support. To do this in the short term you can just remount “mount / -o remount,acl” or you can edit /etc/fstab and append acl to your partition mount opents “defaults,acl”, “rw,acl” etc.

/dev/VolGroup00/LogVol00 / ext3 defaults,acl 1 1

Creating Groups and Users

Since we already had a lesson on creating groups and users I will keep this brief. What you need to keep in mind is that any user can belong to any group, and indeed any number of groups. As such, with a little planning you can make managing your users and groups very easy. However, without this prior planning, the difficulty of management grows proportionally to the product of the number of users, groups, and project folders/files.

For example, let us say we have three projects, for the most part each project has the same users, and each user will either be either a contributor, a editor, or a reviewer; or some combination their of. Now, let us say that a contributor, is any one who will be posting original material, an editor will be anyone who can change original material, and a reviewer is anyone who can read the material. This way you can assignee the same group level permissions (write, modify, and read respectively) to each file in the project, and then simply add users to the groups, knowing they will then have the appropriate level of permissions to the files.

By the same token, it could be that 98% of all your users will require access to read, write, and modify files; in which case you would create a single ‘power user’ group. In this way you have cut your work down by 66%, simply by knowing the nature of your users and how they will interact with the files. To further simplify your permission settings, since users will very rarely, if ever, actually modify a file on the server, you real concern is simply if the have the proper permissions to add and remove files and modify folders. This is because to the file server the process of modifying the file is completely removed onto a different system. As such if some one is to download a file they need read access. If they are to upload a different file they need add permissions to the folder and to up load and replace the same file (is essence modifying it) they need permission to remove the old file and add the new one.

If this seems a bit complicated don’t worry it is really very simple once you start to play with the permissions a bit. And while there are a few caveats about how certain permission setting interact with other permission settings, they system will display all effective permissions and I can help track down any conflicts. On that note, let us start with the commands needed to add groups and users.

Creating Groups

Creating groups could not be easier, all you need do is issue the command groupadd groupName. For example if the name of your group was name planReviewers the you would issue the command:

groupadd planReviewers [ret]

Creating Users

useradd [options] [user]

• where the [options] you will use are
• -c For user comment. For example –c iPlan’s employee account to download and print plans.
• -d For the users home directory. This will always be your root folder, which will also be the highest level of access your users will ever get (at least once the chroot fences are constructed) Please remember everything is relative to YOUR root, so you will need to put /home/ in front of your folders name. Much like, if you wanted to give access to the Projects folder in the Shared Documents folder on the C:\ drive of a windows system you would have to address it as C:\Shared Documents\Projects,. Linux however makes no reference to drives in its file system, so it would just be \Shared\ Documents\Projects. Note the \, this is because a space is used to separate commands and thus requires the \ to tell the system to take the space as a literal character. If this is confusing, just avoid spaces in your folder names.
• -e is the date you want the account to expire, it is always good to have the account go inactive after a certain time. You can use any date you wish in a MM/DD/YYYY format. I would recommend it be no more then two years out. Really, you should just think of what the useful life of this account will be and ensure it expires sometime after that.
• -g For group. Please assignee your users to the group that you created and feel best fits their role. For example –g landscapeArchitects This will be their primary group. Other role based groups can be assigned as well.
• -G For supplementary groups. These secondary groups are given by name or number in a comma-separated list with no white space. Such as reviewer,contributer,suprovisor
• [user] is just the name/ID of the user, but please avoid uppercase characters, white space, and punctuation marks. That is to say Evan, or evan Schube, or evanSchube or evan.schube would all be bad usernames, but evan, or eschube, or evan_schube or evan-schube would be good usernames. Personally I would stick with first letter of there fist name and their last name; like boneal or eschube.

Exmaple:

[yourUserID@fc4 projectBox]# useradd -c Association_with_CompanyX –d /home/WhatEverYourRootFolderIs –e 12/31/2005 –g groupName [ret]

Or, if say you were using the server projects.companyx.com and wanted to create a group called scan and create two users (ted and tod) in that group who’s home folder was DevelopmentTeam then you would issue the following commands.

[even@projects DevelopmentTeam]# groupadd scan

[even@projects DevelopmentTeam]# useradd -c Ted.Smith_is_our_engineering_consultant –d /home/DevelopmentTeam –e 12/31/2005 –g scan ted [ret]

[even@projects DevelopmentTeam]# useradd -c Tod.Jones_is_the_citys_plan_reviewr –d /home/DevelopmentTeam –e 12/31/2005 –g scan tod [ret]

Setting a users passwd

passwd [user]

The password command is simple and must be used in order to set an initial password. This way users can login and change their own password. Please not, as the users administrator you are the only one who will ever use the [user] option; being that to change your own password specifying you as the user is incredibly redundant.

Example:

[even@projects DevelopmentTeam]# groupadd scan

[even@projects DevelopmentTeam]# useradd -c Ted.Smith_is_our_engineering_consultant –d /home/DevelopmentTeam –e 12/31/2005 –g scan ted [ret]

[even@projects DevelopmentTeam]# useradd -c Tod.Jones_is_the_citys_plan_reviewr –d /home/DevelopmentTeam –e 12/31/2005 –g scan tod [ret]

[even@projects DevelopmentTeam]# passwd tod [ret]

Changing password for user tod

New UNIX password: ********

BAD PASSWORD: it is based on a dictionary word

Retype new UNIX password: ********

passwd: all authentication tokens updated successfully.

[even@projects DevelopmentTeam]# passwd ted

Changing password for user ted

New UNIX password: ********

BAD PASSWORD: it is based on a dictionary word

Retype new UNIX password: ********

passwd: all authentication tokens updated successfully.

NOTE: the warning that what ever password you type is a bad password is quite common. Unless you speak a language that was not loaded onto the system, or you use a password that is neither a name, phrase, or dictionary word, and you password contains upper and lowercase characters, and numbers or special characters, and it rather long, it will give you a warning… Which most of us promptly ignore. Although, this is an excellent time to learn Gallic, or memorize Shakespearean plays backwards, or know every number in PI from the 29 decimal place all the way up, or even the name to every angle in the quire… also backwards. Then again, you could also just ignore the warning and trust your own judgment on what is a secure enough password.

Section II Using ACL

Using ACLs

Now, we can actually start using ACLs. The basic commands that we are interested in are:

• getfacl
• setfacl

We will first look at the getfacl command. The owner of the directory we will be working with is "tristan", and the guest user will be "axel" and the guest group will be "lensmen". First, create a test file, then look at the permissions and the ACL:

[yourUserID@fc4 projectBox]#cd /home/tristan

[yourUserID@fc4 projectBox]#cp /etc/services pizza

Note the use of the command ls (lower case LS). This stands for list, and is similar to the doss command dir, in that is gives you a list of all files and folders in a directory.

[yourUserID@fc4 projectBox]#ls -l pizza

-rw-r--r-- 1 tristan tristan 19936 May 28 16:59 pizza

[yourUserID@fc4 projectBox]#getfacl pizza

# file: pizza

# owner: tristan

# group: tristan

user::rw-

group::r--

other::r--

So far, there is nothing very exciting to see. Now, let's change the ACL so that user "axel" can read and write to the file:

[yourUserID@fc4 projectBox]#setfacl -m u:axel:rw- pizza

[yourUserID@fc4 projectBox]#getfacl pizza

# file: pizza

# owner: tristan

# group: tristan

user::rw-

user:axel:rw-

group::r--

mask::rw-

other::r--

[yourUserID@fc4 projectBox]#ls -l pizza

-rw-rw-r--+ 1 tristan tristan 19936 May 28 16:59 pizza

You will notice that there is now an extra user entry in the ACL, and there is a "+" next to the file in the output from the ls command. The "+" indicates that an ACL has been applied to the file or directory. Now, let's add a group ("lensmen") and another user ("tippy") to the ACL for pizza:

[root@fc2 tristan]# setfacl -m u:tippy:r--,g:lensmen:r-- pizza

[root@fc2 tristan]# getfacl pizza

# file: pizza

# owner: tristan

# group: tristan

user::rw-

user:axel:rw-

user:tippy:r--

group::r--

group:lensmen:r--

mask::rw-

other::r--

Hmmm...what's the mask entry? This is the effective rights mask. This entry limits the effective rights granted to all ACL groups and ACL users. The traditional Unix User, Group, and Other entries are not affected. If the mask is more restrictive than the ACL permissions that you grant, then the mask takes precedence. For example, let's change the mask to "r--" and give user "tippy" and group "lensmen" the permissions rwx, and see what happens:

[yourUserID@fc4 projectBox]#setfacl -m u:tippy:rwx,g:lensmen:rwx pizza

[yourUserID@fc4 projectBox]#setfacl -m mask::r-- pizza

[yourUserID@fc4 projectBox]#getfacl --omit-header pizza

user::rw-

user:axel:rw- #effective:r--

user:tippy:rwx #effective:r--

group::r--

group:lensmen:rwx #effective:r--

mask::r--

other::r--

The ACL now shows an "effective" rights mask. Even though "tippy" has been given rwx permissions, he actually only has r-- permissions because of the mask.

In most cases, I want the effective mask to allow whatever permissions I granted to named users and groups, so my mask will be rw- or rwx. I will reset it like this:

[yourUserID@fc4 projectBox]#setfacl -m m::rw- pizza

[yourUserID@fc4 projectBox]#getfacl --omit pizza

user::rw-

user:axel:rw-

user:tippy:rw-

group::r--

group:lensmen:rwx #effective:rw-

mask::rw-

other::r--

What about using the setfacl command to change normal User, Group, and Other permissions? No problem! This can be used instead of chmod:

[yourUserID@fc4 projectBox]#setfacl -m u::rwx,g::rwx,o:rwx pizza

[yourUserID@fc4 projectBox]#ls -l pizza

-rwxrwxrwx+ 1 tristan tristan 19965 May 29 09:31 pizza

[yourUserID@fc4 projectBox]#getfacl --omit pizza

user::rwx

user:axel:rw-

user:tippy:rw-

group::rwx

group:lensmen:rwx

mask::rwx

other::rwx

Note that the mask changed! Whenever you change the permissions of a user or a group with setfacl, the mask is changed to match. Therefore, if you want a restrictive mask, it must be applied after the user and group permissions are modified.

Another thing to keep in mind is that the chmod command does not alter the file's ACL...the ACL information will remain intact, except that the mask entry can change as described above.

More setfacl Details and Examples

The setfacl command has many options. In this section, we will look at some of the more useful ones.

Remove Specific Entries from an ACL

You can remove specific ACL entries with the -x option. In this example, we will remove the entry for user "tippy" and user "axel" but leave the other entries alone:

[yourUserID@fc4 projectBox]#getfacl --omit pizza

user::rwx

user:axel:rw-

user:tippy:rw-

group::rwx

group:lensmen:rwx

mask::rwx

other::rwx

[yourUserID@fc4 projectBox]#setfacl -x u:tippy,u:axel pizza

[yourUserID@fc4 projectBox]#getfacl --omit pizza

user::rwx

group::rwx

group:lensmen:rwx

mask::rwx

other::rwx

Remove Entire ACL

To completely remove an ACL from a file or directory:

[yourUserID@fc4 projectBox]#setfacl -b pizza

You can also use:

[yourUserID@fc4 projectBox]#setfacl --remove-all pizza

Using the --set Option

If you want to explicitly set all of the file permissions on a file or a group of files, you must use the --set option. This is different from the -m option, which only modifies the existing ACL. The --set option replaces all permissions and ACLs with the new values. When you use the --set option, all of the User, Group, and Other permissions must be defined. Here is an example:

[yourUserID@fc4 projectBox]#setfacl --set u::rw,g::rw,o::-,u:tippy:r pizza

[yourUserID@fc4 projectBox]#getfacl --omit pizza

user::rw-

user:tippy:r--

group::rw-

mask::rw-

other::---

Using setfacl Recursively

If you want to apply ACLs to an entire directory and all of its subdirectories, use the -R option. Given the directory hierarchy /home/tristan/Level1/Level2/Level3/Level4, the following command will add an ACL entry for group "lensmen" to all of the Level* directories and their contents:

[yourUserID@fc4 projectBox]#setfacl -R -m g:lensmen:r-x /home/tristan/Level1

Using ACL Entries from a File:

What if you have a lengthy ACL that needs to be used frequently? Rather than typing it over and over again on the command line, you can save the ACL as a text file and use it to apply ACLs to other files. For example, we will create the ACL config file /home/tristan/myacl:

user:axel:rw-

user:tippy:rw-

group:lensmen:r--

group:marty:r--

group:fafnir:r--

mask::rw-

other::---

Now, we can easily apply these ACL modifications to files:

[yourUserID@fc4 projectBox]#setfacl -M myacl test*

[yourUserID@fc4 projectBox]#ls -l test*

-rw-rw----+ 1 tristan tristan 168 May 30 09:41 test1

-rw-rw----+ 1 tristan tristan 168 May 30 09:42 test2

-rw-rw----+ 1 tristan tristan 168 May 30 09:42 test3

[yourUserID@fc4 projectBox]#getfacl test1

# file: test1

# owner: tristan

# group: tristan

user::rw-

user:axel:rw-

user:tippy:rw-

group::rw-

group:marty:r--

group:lensmen:r--

group:fafnir:r--

mask::rw-

other::---

Note on UID, GID, and Permissions

When you are using setfacl, you can use numeric UIDs and GIDs instead of the actual names. The UIDs and GIDs do not have to exist yet. If you use names, then they must exist or you will get an error. You can use the

getfacl --numeric filename

command to view the numeric values.

Also, when you are specifying permissions, you can use octal permissions (0-7) instead of (r,w,x,-).

Appendix

http://www.linuxdevcenter.com/linux/cmd/cmd.csp?path=g/groupadd

http://gnumonks.org/ftp/pub/doc/chroot-howto.html

http://www.vanemery.com/Linux/linux.html

mkdir

mkdir [options] directories

Create one or more directories. You must have write permission in the parent directory in order to create a directory. See also rmdir. The default mode of the new directory is 0777, modified by the system or user's umask.

Options

-m, --mode mode

Set the access mode for new directories. See chmod for an explanation of acceptable formats for mode.

-p, --parents

Create intervening parent directories if they don't exist.

--verbose

Print a message for each directory created.

--help

Print help message and then exit.

--version

Print version number and then exit.

Examples

Create a read-only directory named personal:

mkdir -m 444 personal

The following sequence:

mkdir work; cd work mkdir junk; cd junk mkdir questions; cd ../..

can be accomplished by typing this:

mkdir -p work/junk/questions

rm

rm [options] files

Delete one or more files. To remove a file, you must have write permission in the directory that contains the file, but you need not have permission on the file itself. If you do not have write permission on the file, you will be prompted (y or n) to override.

Options

-d, --directory

Remove directories, even if they are not empty. Available only to a privileged user.

-f, --force

Remove write-protected files without prompting.

--help

Print a help message and then exit.

-i, --interactive

Prompt for y (remove the file) or n (do not remove the file).

-r, -R, --recursive

If file is a directory, remove the entire directory and all its contents, including subdirectories. Be forewarned: use of this option can be dangerous.

-v, --verbose

Verbose mode (print the name of each file before removing it).

--version

Print version information and then exit.

--

Mark the end of options. Use this when you need to supply a filename beginning with -.

useradd

useradd [options] [user]

System administration command. Create new user accounts or update default account information. Unless invoked with the -D option, user must be given. useradd will create new entries in system files. Home directories and initial files may also be created as needed.

Options

-c comment

Comment field.

-d dir

Home directory. The default is to use user as the directory name under the home directory specified with the -D option.

-e date

Account expiration date. date is in the format MM/DD/YYYY. Two-digit year fields are also accepted. The value is stored as the number of days since January 1, 1970. This option requires the use of shadow passwords.

-f days

Permanently disable account this many days after the password has expired. A value of -1 disables this feature. This option requires the use of shadow passwords.

-g group

Initial group name or ID number. If a different default group has not been specified using the -D option, the default group is 1.

-G groups

Supplementary groups given by name or number in a comma-separated list with no whitespace.

-k [dir]

Copy default files to the user's home directory. Meaningful only when used with the -m option. Default files are copied from /etc/skel/ unless an alternate dir is specified.

-m

Make user's home directory if it does not exist. The default is not to make the home directory.

-M

Do not create a home directory for the user, even if the system default in /etc/login.defs is to create one.

-n

Red Hat-specific option. Turn off the Red Hat default that creates a group with the same name as the username and puts the user in that group.

-o

Override. Accept a nonunique uid with the -u option. (Probably a bad idea.)

-p passwd

The encrypted password, as returned by crypt(3).

-r

Red Hat-specific option. Create a system account with a non-expiring password and a UID lower than the minimum defined in /etc/login.defs. Do not create a home directory for the account unless -m is also specified.

-s shell

Login shell.

-u uid

Numerical user ID. The value must be unique unless the -o option is used. The default value is the smallest ID value greater than 99 and greater than every other uid.

-D [options]

Set or display defaults. If options are specified, set them. If no options are specified, display current defaults. The options are:

-b dir

Home directory prefix to be used in creating home directories. If the -d option is not used when creating an account, the user name will be appended to dir.

-e date

Expire date. Requires the use of shadow passwords.

-f days

Number of days after a password expires to disable an account. Requires the use of shadow passwords.

-g group

Initial group name or ID number.

-s shell

Default login shell.

userdel

userdel [option] user

System administration command. Delete all entries for user in system account files.

Option

-r

Remove the home directory of user and any files contained in it.

Since all users are using the same home directory, you should NEVER user the –r option. And unless you never plane to have that user on this sytem again, I would not remvove users, but instead disable them.

usermod

usermod [options] user

System administration command. Modify user account information.

Options

-c comment

Comment field.

-d dir

Home directory.

-e date

Account expiration date. date is in the format MM/DD/YYYY; two-digit year fields are also accepted. The value is stored as the number of days since January 1, 1970. This option requires the use of shadow passwords.

-f days

Permanently disable account this many days after the password has expired. A value of -1 disables this feature. This option requires the use of shadow passwords.

-g group

Initial group name or number.

-G groups

Supplementary groups given by name or number in a comma-separated list with no whitespace. user will be removed from any groups to which it currently belongs that are not included in groups.

-l name

Login name. This cannot be changed while the user is logged in.

-L

Lock user's password by putting a ! in front of it. This option cannot be used with -p or -U.

-o

Override. Accept a nonunique uid with the -u option.

-p pw

Encrypted password, as returned from crypt(3).

-s shell

Login shell.

-u uid

Numerical user ID. The value must be unique unless the -o option is used. Any files owned by user in the user's home directory will have their user ID changed automatically. Files outside of the home directory will not be changed. user should not be executing any processes while this is changed.

-U

Unlock the user's password by removing the ! that -L put in front of it. This option cannot be used with -p or -L.

chpasswd

chpasswd [option]

System administration command. Change user passwords in a batch. chpasswd accepts input in the form of one username:password pair per line. If the -e option is not specified, password is encrypted before being stored.

Option

-e

Passwords given are already encrypted

passwd

passwd [user]

Create or change a password associated with a user name. Only the owner or a privileged user may change a password. Owners need not specify their user name

sudo

sudo [options] [command]

If you are allowed, execute command as the superuser. Authorized users of sudo and the commands they are permitted to execute are listed in the sudo configuration file, /etc/sudoers. If an unauthorized user attempts to run a command, sudo will inform an administrator via email. By default, it will send the message to the root account. Users attempting to run commands are prompted for their password. Once authenticated, sudo sets a timestamp for the user. For five minutes from the timestamp, the user may execute further commands without being prompted for their password. This grace period may be overriden by settings in the /etc/sudoers file.

Options

-b

Execute command in the background.

-h

Print help message, then exit.

-k

Revoke user's sudo permissions. Similar to -K, but changes user's timestamp to the Epoch instead of revoking it.

-l

List all allowed and forbidden commands for the user on the current host, then exit.

-p promptstring

Use the specified promptstring to prompt for a password. The string may contain escape codes %u and %h, which will be replaced with the current user's login name and local hostname.

-s

Run the shell specified in the SHELL environment variable, or the default shell specified in /etc/passwd. If a command is given, it should be a shell script and not a binary file.

-u user

Run command as the specified user instead of the root user. This may also be specified as a user ID number using #uid.

-v

Update timestamp for user. Prompt for password if necessary.

-H

Set the HOME environment variable to the home directory of the target user.

-K

Remove user's timestamp.

-L

List parameters that may be set as defaults for a user in the /etc/sudoers file.

-P

Preserve initial user's group membership.

-S

Read password from standard input instead of from the console.

-V

Print version number, then exit. When run by the root user, print sudo's defaults and the local network address as well.

--

Stop reading command-line arguments.

users

users [file]users option

Print a space-separated list of each login session on the host. Note that this may include the same user multiple times. Consult file or, by default, /var/log/utmp or /var/log/wtmp.

Options

--help

Print usage information and exit.

--version

Print version information and exit.

ls

ls [options] [names]

List contents of directories. If no names are given, list the files in the current directory. With one or more names, list files contained in a directory name or that match a file name. names can include filename metacharacters. The options let you display a variety of information in different formats. The most useful options include -F, -R, -l, and -s. Some options don't make sense together (e.g., -u and -c).

Options

-1, --format=single-column

Print one entry per line of output.

-a, --all

List all files, including the normally hidden files whose names begin with a period.

-b, --escape

Display nonprinting characters in octal and alphabetic format.

-c, --time-ctime, --time=status

List files by status change time (not creation/modification time).

--color =when

Colorize the names of files depending on the type of file. Accepted values for when are never, always, or auto.

-d, --directory

Report only on the directory, not its contents.

-f

Print directory contents in exactly the order in which they are stored, without attempting to sort them.

--full-time

List times in full, rather than use the standard abbreviations.

-g

Long listing like -l, but don't show file owners.

-h

Print sizes in kilobytes and megabytes.

--help

Print a help message and then exit.

-i, --inode

List the inode for each file.

--indicator-style=none

Display filenames without the flags assigned by -p or -f (default).

-k, --kilobytes

If file sizes are being listed, print them in kilobytes. This option overrides the environment variable POSIXLY_CORRECT.

-l, --format=long, --format=verbose

Long format listing (includes permissions, owner, size, modification time, etc.).

-m, --format=commas

Merge the list into a comma-separated series of names.

-n, --numeric-uid-gid

Like -l, but use group ID and user ID numbers instead of owner and group names.

-o

Long listing like -l, but don't show group information.

-p, --filetype, --indicator-style=file-type

Mark directories by appending / to them.

-q, --hide-control-chars

Show nonprinting characters as ? (default for display to a terminal).

-r, --reverse

List files in reverse order (by name or by time).

-s, --size

Print file size in blocks.

--show-control-chars

Show nonprinting characters verbatim (default for printing to a file).

--si

Similar to -h, but uses powers of 1000 instead of 1024.

-t, --sort=time

Sort files according to modification time (newest first).

-u, --time=atime, --time=access, --time=use

Sort files according to file access time.

--version

Print version information on standard output, then exit.

-x, --format=across, --format=horizontal

List files in rows going across the screen.

-v, --sort=version

Interpret the digits in names such as file.6 and file.6.1 as versions, and order filenames by version.

-w, --width=n

Format output to fit n columns.

-A, --almost-all

List all files, including the normally hidden files whose names begin with a period. Does not include the . and .. directories.

-B, --ignore-backups

Do not list files ending in ~ unless given as arguments.

-C, --format=vertical

List files in columns (the default format).

-D, --dired

List in a format suitable for Emacs dired mode.

-F, --classify, --indicator-style=classify

Flag filenames by appending / to directories, * to executable files, @ to symbolic links, | to FIFOs, and = to sockets.

-G, --no-group

In long format, do not display group name.

-H, --dereference-command-line

When symbolic links are given on the command line, follow the link and list information from the actual file.

-I, --ignore pattern

Do not list files whose names match the shell pattern pattern unless they are given on the command line.

-L, --dereference

List the file or directory referenced by a symbolic link rather than the link itself.

-N, --literal

Display special graphic characters that appear in filenames.

-Q, --quote-name

Quote filenames with "; quote nongraphic characters.

-R, --recursive

List directories and their contents recursively.

-S, --sort=size

Sort by file size, largest to smallest.

-Rfile, --reload-state file

Load state from file before starting execution.

-U, sort=none

Do not sort files.

-X, sort=extension

Sort by file extension, then by filename

Securing a webapp - Am I missing something?

Recently in an interview I was asked an open ended question "How do you secure a web app". I think this is fairly simple, and because it was an interview I kept it somewhat brief skimming a lot of detail. However it seemed to me that they wanted more then what I was giving. Not so much that they wanted more details but that they were looking for me to touch on some point I missed. In the interest of expanding my skills, let me give you a list of what I covered, and you can tell me what I am missing.

I. Secure the server

A. Make sure your using a secure OS - Personally I am a RedHat Enterprise Linux Fan

B. Secure the Server

i. Install Tripwire

ii. Monitor Everything

iii. Use a firewall

iv. Eliminate unused services

v. Run all services as non-privileged users

vi. Use SELinux

vii. Restrict file permissions

1. Particularly on things like the uploadable content directory!

2. Use ACL's not standard linux permissions

II. Secure the aplication service (I like Apache/Tomcat)

A. Clean your configs

i. Do not load modules you don't use - see services above

ii. Turn off indexing services (directory browsing)

iii. If you can turn off SSI (Server Side Includes)

iv. If you can turn off follow symlinks

v. If you can turn off old school CGI execution

- Get the point if you don't use it turn it off

vi. When in doubt

Order Deny, Allow

Deny from All

vii. Use mod_security when possible

viii. Use SSL whenever possible (Always) and use mod rewrite to direct users to the secure site.

ix. Turn off listening on ports you don't use (80) - and firewall them too.

x. Do not use .htaccess files

1. If you must use .htaccess files for distributed administration read them in to the appropriate conf.d config as an include.

xi. Cut the default time out in half (or more) to reduce DoS effectiveness.

xii. Eliminate unsolicited information

1. Set server signature to off

2. Set server tokens to prod

B. Actually look at your logs - that is what logwatch is all about

C. Create custom error files - Indeed this is as much a security thing as it is a branding thing. Standard pages are just cheep, like your company does not take the effort or even care about your experience and any issues you may be having.

D. If you can try out mod evasion, or if you only server a specific geographic region, try mod geoip to server specific content, including thank you but we have nothing for you static content. - OK I may have forgotten to mention this one in the interview.

E. Eliminate cross site scripting (xss and csrf are handled similarly)

III. Secure the application level

A. PHP

i. If possible set globles to off (I think is the php.ini line is reisterglobles) - there is (usually) no need for this and end users should not be able to set your variables!

ii. Initialize your variables - see above

iii. Set safe mode to on

iv. Set disclosure to off (expose_php I think)

v. Set display errors to off

vi. Turn on log errors (this may be the default already)

vii. Turn off or restrict administration pages

B. Tomcat - This is just a repeat of securing Apache

i. Run as a restricted user

ii. Make sure your tomcat user (and group) own the catalina_home directory.

iii. Don't allow access to contexts you don't use

iv. Don't serve directory indexs

v. Don't tell people what kind of application server your running - let alone the version!

vi. Use custom error pages

vii. Use ssl

viii. Log and read those logs

ix. Don't allow communication to anything but YOUR webservers

IV. Secure the database - There are so many DB's I am not going to go into to detail but

A. Use good passwords

B. Use restricted users

C. Make sure those users can only connect from YOUR app servers

i. And restrict who can see this server at all!! If it is closed to everyone not on your DB server VPN then you are less likely to have to deal with a direct attack!)

V. Secure the application

A. When possible use separate restricted DB users for each task. If you need to insert then do so with a user that can only insert, same with update, delete, and query.

B. Clean user inputs and guard against SQL injections.

C. Don't let users see your errors! - Capture errors and report them!

D. And don't write inherently insecure applications

Summery

- Close your ports

o Protect your system against EVERYONE and then open some ports for some peoplE. The front end web servers need to be a bit more flexible on port 443.

- Turn off stuff you don't use

- Restrict permissions

o And use ACL's there is no need for a top level directory to be more permissive then a bottom level directory or to be limited to just one user/group

- Don't let your users see anything behind the Curtain - obfuscate everything your can.

- Check your logs

o Use monitoring applications

- Update and patch

So oh great community of mine - what am I missing?

My geek joy for the day - Using public records for on the fly identity check

Those of you who know me already understand my record keeping paradox. At the office I am freak for record keeping. Truth is it almost borders on a nazi-esk insanity. However, at home I am much more.. well.. lax. Somewhere in my garage is an unmarked folder in an unmarked box that contains my birth certificate, a spare driver’s license, and my social security card. The problem is that I can not find these things and, I am hoping, that at some point here I will get a job and need to use such papers to prove my identity.

To this end I decided to get a copy of my birth certificate (At a cost of $50.00 BTW) so I can get a copy of my social security card (Which also requires I get a copy of my drivers license since I need to have one in my pocket and send one to the SS office, who insists on having an original mailed to them.) But this is all mundane personal life bookkeeping that no one, not even me, finds particularly interesting. So why am I blogging? Well at check out the service state uses to provide copies of your birth certificate, VitalChek, asked my four interesting questions.

In addition to the standard, what is your name, birthdates, social security number, father’s full name, mothers full maiden name, place you were born, etc. I received four security questions that were rather interesting.

• Which of the following cities have you PREVIOUSLY OR CURRENTLY used as your address?
• In what county do you currently live?
• Which of the following people have resided with you or used the same address as you?
• Which of the following streets have you PREVIOUSLY OR CURRENTLY used as your address?

Supposedly the questions are random and each has a dropdown box for multiple choice answers. The last one actually had two correct answers from two different states in the pool. My initial reaction was “Wow that is cool!” and then it went to “This is all public record information that is not difficult to obtain.” Which lead me back to my first reaction as I realized that this service takes the information you entered, name, birthdate, shipping address, etc. and pulls the “security” information from other public databases on the net. Being a data freak who believes in the liberal use of public API’s and automation I thought that was way fun and easily represented several weeks of work to find the systems with the info, figure out their api’s and then hunt down the information, and generate questions and answers from that information on the fly! Then again, they could also just take a part of my $15 fee and subscribe to a central information clearing hose, but that is not nearly as much fun.

For a bit of a thrill check out
http://govsearchrecords.com/
http://www.searchsystems.net/
https://www.knowx.com/

I just read the “Does the Distro Matter” post and immediately felt compelled to relay some of my experiences, not with distributions, but with recruiters. What is the deal with these people? Does it matter if a company is looking for experience with RHEL5 and you have experience with CentOS5? No! From a technical point of view they are almost identical! I would personally say that if you have 5-10 years experience with almost any distribution you should be able to move into a new one easily. But core skills do not matter to recruiters, only how well you match the buzz words. I helped a friend install a distributed MySQl environment for a small company once, but since it was not my company it apparently does not count as real experience. I may be a Java programmer with experience with several IDE’s but since Microsoft Visual Studio’s is not one of them it is the same as if I answered “What’s Java?” Why is this? What is wrong with these people?

I blame three things:

1) The recruiters, or even the companies central HR, are not in the field and thus do not understand the buzz words on their sheet. Most of them would not know the difference between one distribution of Linux and another. They also would not understand KRB/AD cross platform integration if it hit them in the face. They only know what is on the list in front of them. To them the difference between FC10 and FC11 may as well be the difference between speaking Bask and Thai. The people who would understand never get to see your resume.

2) The people who are looking for employees are too specific – mostly due to the fact the screeners don’t know anything. Do you ask for some one who understands the differences between Exchange Server 2003 and Server 2003 with Exchange? No, but they will ask for some one with RHEL5 (Even if they are using CentOS5) because that is what they are using. They could just ask for 15 years Linux experience but they don’t. In addition it would seem most people write the job requests so specific that only an internal candidate could possibly fill them. For example “Must have 5 years experience with Joseph ERP” Is not valid when Joseph ERP has less then 2000 outstanding user licenses across the globe and has only produced a commercial product for the last 6 years! Just because they guy your replacing had 5 years experience with it does not mean you need to be looking for some one with the exact same experience. Some times this is done so they can higher the internal candidate they had in mind before HR told them they had to post the job publicly, or sometimes this is done so they can decline any candidate they don’t feel is a good personal fit without filling out a ton of paperwork with HR, and sometimes it is because the person writing the job description was not thinking; i.e. the Joseph ERP example above.

3) The current applicant pool is so great they can get away with it. When I am loosing out to people with masters degrees, $100K worth of certifications, and 15 years experience, for a $20/hour job on a 3 Mo. contract you know there is a problem. That is too much experience for that job. On the other hand, if you have reached upper management, you have been apparently poisoned from playing in the field. No on wants to higher a former Director to manage their system migrations, so I should be grateful that they have the good sense to realize the over qualified person is a barging and buy. But this does mean that almost no mater how strict you write your requirements and how literal the recruiters follow them, eventually you will find a person who fits your requirements, or at least lies well enough to get in the door.

As an abstract complain, why do they ask what other jobs you have applied for and then disparage where you have applied? And why would they say they know some one at company X but when it is not the person you know at company X they believe you are lying about knowing any one at company X? And finally you do not have the technical experience to understand what I am telling you so why are you interrogating me regarding my technical experience. When I say that I believe DR is dead because of the reduced cost of CDP w/ FO why do you conclude I have no DR experience? I have many other complaints but I think most of them have been covered in prior posts.

Host Identity Protocol

This is going to be an uncherictersticaly short post; however I am woundering what is up with the Host Identity Protocol? For those who do not know the HIP allows for the implemntation of the HIT or Host Identity Tag. This is designed to solve the issue of moblie people losing thier sessions and streams when moving between networks. The assumption is that all, or atleast the majority, of services identify a client based upon there IP address. Acording to the abstract this will also make setting up servers behind NAT fierwalls easyer and increase security by uniqly identifying each host similer to an ssh finger print.

However I have three questins that leasd me to ask why this is a real projects:

1) Session ID's - When an application server needs to indentify a client they issue a session id to the client. For example when you hit my tomcat server and start a particuler session I don't care what network the client is on or what physical server the client may be hitting, I need to identify the client for the life of his session. Session ID's are already in place - so what what portion of session ID's fails so badly that it needs to be replaced with an entierly seporate project?

2) Existing Identifyers - Why not use existing identifiers such as the MAC address of the clients network interface? While it is true that ones IP can change all to frequently during the cource of a normal mobile operation, the MAC does not.

3a) Security Vs. Privacy - The answer to the above question leads to my final concern. Mac addresses can change when one user changes network interfaces. However the protocol sugested, as I understand it, sits between the Addressing and Transport layers. This is tradtionaly tied to a network interface thus changing interfaces would also change your HIT. The other one would be that MAC addresses can be esaly changed and this breaks it from being a consistant and secure identifyer. But HIP suffers from this as well.

3b) Security Vs. Privacy - There was a way to solve this security issue introduced back in the 90's; it was called CPU ID. This was a hardware based ID that was easy for all applications to read but very difficult to change or mask. The problem soon became that everyone screamed PRIVACY! It turns out people do not want to be uniquely identified with all of there activities on line at all times. As such manufactures quickly included the option to volunteerly turn off CPUID, and that was so popular it started to come turned off by default. This, of course, made it a completely invalid identifier.

So, unless you planning on replacing an entirely server side expiration based session ID I do not see how this will work. However, at the same time, I can not see why you want to replace session ID's. This leaves me to ask - Why is this a real project?

This is an actually question I am hoping some one can answer so please feel free to comment to this via the blog comments, or like most of you do, via twitter or facebook.

Open Source PDF Printing in Windows

Configuring broad application PDF and TIFF printing using Ghost Script and Red Mon port redirection.

If you have ever wanted to produce PDFs without having to pay for Adobes PDF writer please read on. If you have no need to create pdfs for free, then this is not the article for you.

Setting up Ghost Script
Down load the latest version of ghost script.

• Download from http://www.cs.wisc.edu/~ghost/
• (AFPL is the Always Free Version, and the GPL is the OK for commercial version, other wise they are nearly identical.)

Install into C:\gs

• Run the installer and accept all the defaults except the location. Change that to C:\gs. At this time there are still some issues with directory names that include spaces.

Setting up RedMon port redirection Download and install the latest version of RedMon

• Download from http://www.cs.wisc.edu/~ghost/redmon/index.htm
• Expand the zip file and copy into C:\gstool
• Run installer

Setting up printer

Since ghost script is a command line tool that uses it’s own environment, each printer will either be used at the ghost script command prompt, or via a pre written script. Obviously a script is better. We then must configure the port redirector to use this script

Printer Script

A script is just a test file that contains the required commands and settings. We will be creating one called “tif.rsp” and we will be placing it in the C:\gstools directory.

1. Create a text file
2. Cut and past the following lines.

-Ic:\gs\gs8.54\lib;c:\gs\fonts

-sDEVICE=tiffg4

-sOutputFile=c:\print.tif

-dNOPAUSE

-dSAFER

-dBATCH

-r600

-sPAPERSIZE=a4

3. Save this as tif.rsp
4. Copy tif.rsp to C:\gstools

Script items explained

If you want to change some of the variables inorder to make more printers that do difrent things, here is a list of each and wht they do.

• -Ic:\gs\gs8.64\lib;c:\gs\fonts: Tells they system were to find Ghost Script and its fonts. It is highly likely you will need to change the version number to match your particular set up.
• -sDEVICE=Device Name: Instruct GS to use a particular virtual encoder. Some acceptable encoders are

jpeg (several additional options are required to control quality with JPEG)

pdfwrite (sounds like this prints pdf’s to me)

tiffg4 (four bit black and white)

tiffgray (eight bit grey scale))

tiff12nc (12 bit RGB color)

tiff24nc (24 bit RGB color)

tiff32nc (32 bit CMYK color)

tiffsep (Creates one 32bit CMYK and a 8 bit grey for each separation)

There are also devices for fax, BMP, PCX, Photoshop PSD, Adobe PDF, PS, EPS, PXL, and many more.

• -sOutputFile=Directory\file.ext: This is where you want the output file to be placed and what you want it to be called.
• -r#: This is the resolution in DPI. If nothing is selected 75dpi is the default.
• -sPAPERSIZE=ISO Standard Size: This is the default paper size. A small list of sizes can be faund at, http://www.cs.wisc.edu/~ghost/doc/cvs/Use.htm#Known_paper_sizes

Create a virtual printer

1. Go to Printers and Faxes (Off of the start menu or in the control panel)
2. Add a printer
3. Choose Local
4. Set the port to RPT1 (created by the RedMon installer.)
• If this port does not exist, add it.
• Select the Create a New Port option and choose Redirected Port.
• Name it RPT1: -or- RPT2:, or RPT3:, etc.
5. Choose the Generic manufacturer and MS Publishing Imagesetter for the type.
6. Open the printer just created
7. Go to properties
8. Go to the Ports Tab
9. Set the configuration options for the port to:
10. Redirect this port to the program: C:\gs\gs8.xx\bin\gswin32c.exe (obviously you will need to change these to your particular location for each)
11. Arguments for this program are: @c:\gstools\tif.rsp -

(See window snapshot below for example) Pay attention that there is a hyphen at the end of the Arguments for this program field.

Prompt for filename

When output is set to Prompt for filename, the redirection program should write its output to a file. The name of the file is obtained from a Save as dialog, can be obtained by inserting %1 in the program arguments. If you wish to place %1 in the program arguments and do not want it substituted with the filename, you must instead use %%1.

For example, the program arguments might include:

 -sOutputFile="%1"

This method is recommended for use with Ghostscript, and is commonly used with a PostScript printer driver and the Ghostscript pdfwrite device to create a PDF writer.

Do not share a printer which uses RedMon with Prompt for filename. RedMon will not allow this because the Save as dialog box would appear on the server computer, not the client which submitted the print job.

Fine Tuning

After you install the printer, you may want to fine-tune its properties. To do so, open again the Printers setting folder, and right click on the printer; select `Properties`.

1. Under `Device Settings`, set very low values (e.g. 5) to the following two parameters:
1. Minimum font size to download as outline
2. Maximum font size to download as bitmap
2. Next, go to the `Advanced` tab, and from there, select `Printing Defaults…`. In the window that opens, select `Document options`, then `Postscript options`. Set the following two options:
1. PostScript Output Option: Optimize for Portability
2. TrueType Font Download Option: Outline

For large format color printing: I recommend using the Xerox Document Center CS50 PS. Just make sure you tell the driver the paper sizes you want to use are loaded. To do this just go back to the properties window, click on the Device Settings Tab and under the Tray Assignment menu select a few paper sizes. Personally I believe, in addition to Letter, Legal and Tabloid are musts.

Appendix: We pages to know for this application set:

http://www.cs.biu.ac.il/~herzbea/makeP.htm#_Creating_PDF_using_Windows_Office_A

http://www.cs.wisc.edu/~ghost/doc/cvs/Devices.htm

http://server3.nethost.co.il/set_tif.html

http://www.noliturbare.com/

http://server3.nethost.co.il/set_tif.html

http://www.cs.wisc.edu/~ghost/doc/cvs/Use.htm#Known_paper_sizes

Installing VMServer 2 on Ubuntu 9.04

I just installed VMServer 2 on Ubuntu 9.04, and like most linux VM installs, there is a trick. Below you will find the cheet sheet version in a hope that it saves some of you some time when you go to install VMServer 2 on your Ubuntu machine. I make the assumption that you have installed things before, and maybe used VM ware in the past, but if that is not the case and you would like a more detailed guide just let me know.

0) Prep the system
Find out what kernel your running with uname -r
Install the headers with sudo apt-get install linux-headers-`uname -r` build-essential xinetd where uname is the name of your kernel.

1) Get VMWare server. http://www.vmware.com/products/server/

2) Sign up or login & don't forget to make note of your serial number

3) Download the Linux tar file, not the rpm

4) Expand the tar file
tar xvfz VMare-server-*.tar.gz

5) cd into the folder

6) Fix the installer (Otherwise you will have trouble compiling vsock)
Either - install the patch
get the patch (created by delgurth @ http://blog.delgurth.com) from http://ubuntuforums.org/attachment.php?attachmentid=94477&d=1227872015

• If you have not done the install (and assuming your still inside the expanded VMServer install folder)

patch bin/vmware-config.pl /path/to/vmware-config.pl.patch

• If you have already installed

sudo patch /usr/bin/vmware-config.pl /path/to/vmware-config.pl.patch

Or - Fix it manually (Finish install first)
tar xvf /usr/lib/vmware/modules/source/vsock.tar
cd vsock-only
sed -i 's/^\#include //' autoconf/*.c
include
make
sudo cp vsock.o /lib/modules/$(uname -r)/misc
sudo ln -s vsock.o /lib/modules/$(uname -r)/misc/vsock.ko
sudo depmod -a
sudo /etc/init.d/vmware restart

7) Install / reconfigure

• If you have not installed

sudo ./vmware-install.pl

• If you have already installed but skipped the vsock install,

sudo /usr/bin/vmware-config.pl

8) Preparing a user
During the configuration, when prompted for the admin user you can enter your user name, or, if you accepted the default, your can use root

• If your using root you will need to set a root password, since by default root on ubuntu is locked without a password (make it very strong)

sudo passwd root

9) Fixing permissions
Login by opining a web browser and going to https://server:8333
Enter root, or if you set the admin, the admins user name
Enter your password
Go to Permissions
Click on New Permission
Enter your user name
Choose the Admin role
Remove root, if root was set as the default admin user