Changes

← Older edit

OPS235 Lab 4 - CentOS7

2,875 bytes added, 12:31, 24 September 2018

no edit summary

[[Category:OPS235]]

{{Admon/caution|THIS IS AN OLD VERSION OF THE LAB|'''This is an archived version. Do not use this in your OPS235 course.'''}}

=LAB PREPARATION=

=~~LAB PREPARATION~~=Purpose / Objectives of Lab 4=={| width="40%" align="right" cellpadding="10"|- valign="top"|[[Image:users.png|thumb|right|150px|System administrators are required to add, remove and modify user accounts.]]|[[Image:on-off.png|thumb|right|135px|In order to perform maintenance, system administrators need to know how to stop and start services for a Linux system. ]]|}

~~==Purpose / Objectives of Lab 1==~~

There are many other tasks that a Linux system administrator must perform other than installing Linux and installing software.

Main ~~objectives~~Objectives:

:* Administer '''(add, remove, modify) users''' on a Linux system.

:* '''Start and Stop services''' on a Linux system.

:* Display the '''status of running services''' on a Linux system.

'''Answer the Part 4 observations / questions in your lab log book.'''

=INVESTIGATION 2: Managing System Services and Run-~~Levels and System Services~~levels=

Many students may think that the following topic is small and "not a big deal". Those students may say, '''"How hard is running and stopping services?"'''

The process may not be hard, but knowing how to stop, start, restart and check the status of services is absolutely critical to a Linux server. '''Aside from learning to trouble-shoot problems''' by checking the status of running services, '''understanding how to manage services is critical to help protect a Linux server from penetration''' (this term is referred to as "'''Hardening a system'''"). Sometimes it is "what we don't know" that can harm us. One key element in hardening a computer system is to disable non essential networkng services to allow IDSs ('''Intrusion Detection Systems''') to focus on a narrower range of policy violations. A Debian-based penetration testing distribution called '''Kali ''' (formerly referred to as '''"BackTrax"''') allows sysadmins and security professionals to identify vulnerabilities in their computer systems, and thus improve (harden) their systems against penetration. Learning to monitor the status, enable and disable networking services underlies the '''Backtrax''' motto: '''''"The quieter you are, then more you will hear..."'''''

=== Part 1: How do we Manage System Services? ===

We have seen that maintaining unneeded '''packages can be a security risk''' due to the unnecessary increase in the complexity of your system. Similarly, it is also unnecessarily hazardous, and even more so, to leave unneeded services running. In this investigation, we will learn how to '''control services, and turn off those services that we think are not necessary to help reduce security risks'''.}}

#Use your '''centos2''' VM for this part.

<li>Note the services that are currently running.</li>

<li>Use the command <code>service iptables stop</code> to stop the service named '''iptables'''</li>

<li>Run a command to verify that the '''iptables''' service has stopped.<~~/li~~br> <libr>~~A newer method of managing services~~ '''NOTE:''' Although the service command seems to work, it is ~~by using~~ '''~~systemd~~deprecated''' (i.e. "out-dated:). It has been replaced by using the [http://zenit.senecac.on.ca/wiki/index.php/Init_vs_systemd#systemd_Command_Usage systemctl] command. This is a command based upon a newer method of starting and managing system services called [http://zenit.senecac.on.ca/wiki/index.php/Init_vs_systemd systemd] (which replaces init - the ~~ability~~ "initialization table"). This method allows services to ~~manage dependent service in parallel and allow one~~ run more independently of each other, so that a service to may be stopped without ~~disrupting the~~ other dependent servicesto be stopped as well. ~~Here~~ The most common '''systemctl''' commands are shown below (it is optional to include the filename extension '''.service''' after the service-name):<ul><li>'''systemctl list-units --all'''   (get a ~~link that briefly explains how~~ listing of all service names. Can pipe to grep to ~~use systemd and the~~ list service you are interested in)</li><li>'''systemctl status service-name'''   (Confirm status of a service - running or not-running)</li><li>'''systemctl stop service-name'''   (stop a service)</li><li>'''systemctl start service-name'''   (start a service)</li><li>'''systemctl restart service-name'''   (restart a service)</li><li>'''systemctl ~~command~~enable service-name'''   (enable service so service runs upon system startup)</li><li>'''systemctl disable service-name'''   (disable service so it does NOT run upon system startup) </li></ul></li> <li>If you reboot now - the iptables service will be turned back on. We don't want it on though, it causes students headaches. To turn it off permanently we need to use the '''~~chkconfig~~systemctl''' command:~~ ~~<code>~~chkconfig~~ systemctl disable iptables ~~off~~</code> (the '''chkconfig''' command used to be the way to enble/disable services, but is now deprecated).</li> <li>Use the '''systemctl''' command ~~(from the link above - showing examples)~~ to verify that the '''iptables''' service is ~~off~~ no longer running ('''hint:''' issue command, and pipe to grep "'''iptables'''").

<li>Reboot and confirm that it's no longer running.</li>

</ol>

'''Answer Part 1 observations / questions in your lab log book.'''

===Part 2: How do we Manage Runlevels?===

</li>

<li>Note the difference in output between '''centos2''' and '''centos3'''.</li>

<li>You can use the '''init''' command to change the current run-level. See a list of runlevels [https://www.centos.org/docs/5/html/5.2/Installation_Guide/s2-init-boot-shutdown-rl.html here]. ~~Use the~~ <~~code~~/li>~~man~~<~~/code~~li> Use the '''man''' command to learn how to use the '''init''' command. Use this command to change the current ~~runlevel in centos2 to 3. What happened? What happens after your reboot?</li>~~ ~~<li>Change the default~~ run-level on in '''centos2''' to '''3'''. What ~~happens now after you reboot~~happened?</li> <li>Issue the following Linux command:

<ul>

<li><code>startx</code></li>

<li>What happens?</li>

<li>Log-off your graphical system. You should return to your shell prompt.</li>

<li>Using systemd requires a different method of setting text mode and graphical mode. You can refer to this link for future reference: [http://fedoraproject.org/wiki/Systemd#How_do_I_change_the_runlevel.3F How to Change ~~the default run~~Run-~~level for '''~~Levels with Systemd]</li><li>Restart your centos2machine, and make certain that it runs in ''' ~~back to '''5~~graphical''' ~~and reboot~~ mode</li> </li>Why would you want to make ~~sure it works.~~a graphical Linux system run in text-based mode?</li>

</ol>

|- valign="top"

|

{{Admon/tip|Bash Shell Scripting Tips:| <ul><li>'''The case statement:''' The case statement is a control-flow statement that works in a similar way as the if-elif-else statement (but is more concise). This statement presents scenerios or "cases" based on values or regular expressions (not ranges of values like if-elif-else statements). After action(s) are taken for a particular scenerio (or "case"), a break statement (''';;''') is used to "break-out" of the statement (and not perform other actions). A default case (*) is also used to catch exceptions. '''Examples (try in shell script):''' ''read -p "pick a door (1 or 2): " pick case $pick in   1) echo "You win a car!" ;;   2) echo "You win a bag of dirt!" ;;   *) echo "Not a valid entry"      exit 1 ;; esac'' ''read -p "enter a single digit: " digit case $digit in   [0-9]) echo "Your single digit is: $digit" ;;          *) echo "not a valid single digit"              exit 1 ;; esac'' </li><li>'''The getopts function:''' </li></ul>The getopts function allows the shell scripter to create scripts that accept options (like options for Linux commands). This provides the Linux administrator with scripts that provide more flexibility and versatility. A built-in function called '''getopts''' (i.e. get command options) is used in conjunction with a '''while''' loop and a '''case''' statement to carry out actions based on if certain options are present when the shell script is run. The variable '''$OPTARG''' can be used if an option accepts text (denoted in the getopts function with an option letter followed by a colon. Case statement exceptions use the ''':)''' and '''\?)''' cases for error handling. '''Example of getopts''' (try in script and run with options) ''while getopts abc: name do   case $name in     a) echo "Action for option \"a\"" ;;     b) echo "Action for option \"b\"" ;;     c) echo "Action for option \"c\""         echo Value is: $OPTARG" ;;     :) echo "Error: You need text after -c option"         exit 1 ;;     \?) echo "Error: Incorrect option"         exit 1 ;; esac'' done }}

|}

#~~Use the <code>wget</code> command to download~~You will be using your '''c7host''' machine for this section.#Download, study, and run the following shell ~~scripts on-line~~script. Issue the command:<~~blockquote~~br><code>wget https://scs.senecac.on.ca/~murray.saul/user-create.bash</code>

#Try to understand what these Bash Shell scripts do, and then run the script as root. After running the shell script, view the contents of the '''/home''' directory to confirm.

<ol><li value="3">Open a Bash shell terminal and login as root.</li><li>Use the wget command to download the input file called user-data.txt by issuing the command: <code>wget https://scs.senecac.on.ca/~murray.saul/user-data.txt</code></li><li>View the contents on the user-data.txt file to confirm there are 3 fields (username, fullname, and e-mail address)which are separated by the colon (:) symbol.<li><li>Use a text editor (such as <code>vi</code> or <code>nano</code>) to create a Bash Shell script called: <code>createUsers.bash</code> in /root's home directory.</li><li>Enter the following text content into your text-editing session:</li></ol>

# createUsers.bash

# Purpose: Generates a batch of user accounts (user data stored in a text file)

# # USAGE:~~ # #~~ /root/createUsers.bash [-i {input-path}]

#

# Author: *** INSERT YOUR NAME ***

# Date: *** CURRENT DATE ***

if [ $~~HOME~~ PWD != "/root" ] # only runs if ~~logged~~ in as root's home directory then  echo "You must be ~~logged~~ in as root's home directory." >&2

exit 1

fi

if [ "$#" -eq 0 ] # if no arguments after command

then

echo "You must enter an argument" >&2

echo "USAGE: $0 [-i {input-path}]" >&2

exit 2

fi

</code>

outputFlag="n"

while getopts i~~:n:a:g:o~~: name

do

case $name in

exit 1 ;;

esac

done

</code>

<ol><li value="6">Save your editing session, but remain in the text editor.</li><li>The code displayed below uses logic to exit the script if the input file does not exist. Command substitution is used to store each line of the input file as a positional parameter. There is one subtle problem here: The full names of the users contain spaces which can create havoc when trying to set each line as a separate positional parameter. In this case the sed command is used to convert spaces to plus signs (+), which will be converted back later. Finally, a '''for''' loop is used to create each account ('''useradd''') and mail the user their account information ('''mail'''). Add the following code:</li></ol>

fi

set $(sed 's/ /+/g' $~~inputfile~~inputFile) # temporarily convert spaces to + for storing lines as positional parameters

for x

do

mail -s "Server Account Information" $(echo $x | cut -d":" -f3) <<+

Here is your server account information:

servername: myserver.senecac.on.ca

username: $(echo $x | cut -d":" -f1)

password: $~~(date | md5sum | cut -d" " -f1)~~userPassWd

Regards,

IT Department

= LAB 4 SIGN-OFF (SHOW INSTRUCTOR) =

{{Admon/important~~|Time for a new backup!~~|If you have successfully completed this lab, make a new backup of your virtual machinesas well as your host machine. Remember to also make a backup of the new second virtual disk drive on ''centos1'' -- you now have two virtual disks on ''centos1'', and therefore two image files, and therefore will need two backup files.|}}

'''Arrange proof of the following on the screen:'''

::<ol><li>✓ '''centos1''' VM:<blockquote><ul><li> Account created on '''centos1''' VM.::<~~span style="color:green;font-size:1.5em;"~~/li>~~✓~~<~~/span~~li> List contents of '''/etc/group''' file (ops235 group) on </li><li>List contents of '''~~centos1~~/etc/passwd''' ~~VM.~~::file (created accounts)</li></ul></blockquote><li>✓ ~~List contents of~~ '''~~/etc/passwd~~centos2''' ~~file (created accounts)~~ VM:<blockquote><ul><li>Display current run-level status on '''~~centos1~~centos2''' VM.::</li></ul></blockquote></li></li><li>✓ ~~Display current run-level status on~~ '''~~centos2~~c7host''' machine<blockquote><ul><li>Creation of your bash shell script called ''' VMcreateUsers.::bash'''</li></ul></blockquote></li><li>✓ ~~Creation of your bash shell script called~~ '''~~createUsers.bash~~Lab4'''log-book filled out.</li></ol>

= ~~Preparing for the~~ = Practice For Quizzes , Tests, Midterm & Final Exam ==

# Describe all of the field in <code>'''/etc/passwd'''</code>

Chris.johnson

Bureaucrats, Administrators

1,576

edits

Changes

OPS235 Lab 4 - CentOS7

Navigation menu

Personal tools

Namespaces

Variants

Views

More

Search

Navigation

get involved with CDOT

courses

course projects

links

Tools