How to: Linux Group Disk Quota Implementation

Click here If you are looking for implementing user disk quota implementation in linux. Here in this post we are now going to discus how to implement Linux Group quota for a project?
Many people will ask why we require group quota if we have user quota?

I will explain this with an example. In companies people will be working on projects/groups where they want to share their data on a common location and accessed by any user for that group. Its some thing like group store where they will be dumping data on a single location. So its very much easy to restrict per group basis on this group store, so we can set some limit on all the users in that group on how much they can upload to that folder. We will take one example to accomplish this group quota.

group name : project1.
group members : user1, user2, user3.
group dump folder/common folder to the above mention users : /home/project1 (/dev/hda2).
group disk quota limit : 100MB soft/110MB hard limit

Now we have all the ingredients to prepare spicy food :)

Implementing Group disk quota on Linux

Step1 : Create a group
#groupadd project1

Step2 : Create all the require users with their home directory /home/project1 and group as project1
#useradd -c "Testing group quota implementation" -m -d /home/project1 -g project1 user1
#useradd -c "Testing group quota implementation" -m -d /home/project1 -g project1 user2
#useradd -c "Testing group quota implementation" -m -d /home/project1 -g project1 user3

Step3 : Select/prepare the partition for quota here my partition is /dev/hda2 so edit /etc/fstab file for with the required entries.
vi /etc/fstab /dev/hda2 /home ext3 defaults,usrquota,grpquota 0 0
save and exit the file

Step4 : Now remount the partition with rw permissions
#mount -o remount,rw /home

Step5 : Now create group quota database
#quotacheck -cug /home
check for user/group database is created or not when you give ls /home you can see
aquota. user, aquota.group files in /home directory,which contains user and group databases.

Step6 : Once the above command executed successfully, check quota is implemented or not.
#repquota -a

Step7 : Now set quota for the group project1, this can be done using edquota or setquota. Most of the people know edquota command usage when executed it will open a temporary quota file where we have to mention your desired values. But in this I am going to show you another way to set group quota.
#setquota -g project1 100 110 0 0 /dev/sda2

Explanation of above command.
-g specifies we are going to edit group quota.
The group name is project1
We are setting setting soft(100kb) and hard limit(110kb) on blocks
We disabled setting soft(0) and hard(0) limit on inodes
Last we specified on what partition we are going to set this quota(/dev/sda2)

Step8 : Don't think its completed. This is the most and main important point you have remember when implementing group quota. We have to set permission to /home/project1 with SGID so that all the members in the group can able to upload data to /home/project1 with out any issue.
#chmod 2770 /home/project1

Now all the group members of project1 can upload total of 100kb not more than that. For example user1 uploaded 75kb so members of project1 can only upload 25kb more.

Like the post? Please Subscribe to free RSS feed to get updates

How To : Auto Logout

What is this auto logout?
Ans : Auto logout is a concept to force user to logout from the remote server. If the open session to remote server is idle for a given time.


So why actually we require auto logout?
Ans : As a security measure, This is good practice to set this, because its not a good idea/practice to keep open terminal idle.


How to accomplish this?
Ans : This can be achieved by two ways.

1. Open /etc/profile and append TMOUT variable. See my below example

Export TMOUT=600 # 10 minutes in seconds
typeset -r TMOUT
This will set time-out to 600 sec(ie 10mins) and I have given typeset -r which read-only and will not allow users to change this. Save the file and exit.



2. By creating /etc/profile.d/sessiontimout.sh file then keeping above mention entries in it.
Export TMOUT=600 # 10 minutes in seconds
typeset -r TMOUT
Now save and exit the file

As this is a script we have to change the permissions too.
#chmod +x /etc/profile.d/sessiontimout.sh

Please share your thoughts on this.

Like the post? Please Subscribe to free RSS feed to get updates

Hardening SSH Server In The DMZ(De Militarised Zone)

Its good to harden your box which is in DMZ.
What is DMZ?
Ans : DMZ is a De Militarised Zone where we will be keeping our servers, so that they can be access by out side people. Let me explain more about this DMZ. Who are not familiarise(And this activity is most of the time a Network admin work).
1. DMZ is a place where we will be isolate machines from companies local LAN.
2. These DMZ machines will have different IP address range and subnet.
3. The communication between two machines in DMZ is blocked for security reasons.
4. We cannot login to Local LAN machine from a DMZ machine, but we can login to DMZ machine from local LAN(only one way communication from LAN).
5. Ping to these machines will be disabled(most of the companies will do this for security reasons).
6. The way these machines communicate totally depends on network team what type of rule they set on their routers.
7. The security of DMZ machines are more when compared to local LAN machines(in other ways every thing is restricted to DMZ machines).
8. Only required ports are opened on DMZ machines and remaining ports are in closed or reject state(This should be done on system by Linux admin and on network level done by companies network engineer).

Once you keep your Linux machine in DMZ first and far-most thing to do is to secure SSH logins to the server.

In this post we will see some security measures for SSH to be taken when system is kept in DMZ. Most of the SSH settings are located in /etc/ssh/sshd_config (Red hat/Debian based systems).

1. Set Maximum failed login attempts, so after that many login attempts connection to the server is reseted and once again we have to connect to server.
MaxAuthTries 3
Here I have set failed login attempts to 3.

2. Disable root to login through SSH. This is a good option to force the user not to use root user to login to the server
PermitRootLogin no
Here we set it to no which indicates root can not login.

3. We should disable logging of users who donot have passwords.
PermitEmptyPasswords no

4. Allow only users who have passwords.
PasswordAuthentication yes

5. Specify who should access this server. I can say this one is more secure because SSH will allow only the users who are specified here.
AllowUsers test1 test2
Here I have allowed only two users i.e. test1 and test2.

6. Set-up a login banner to give warnings to the users how are logging in to that server
Banner /etc/ssh-banner
Please specify the warning message in /etc/ssh-banner.

Once done the above changes in /etc/ssh/sshd_config file just reload the ssh server.

Note : Don't restart SSH service on production servers. Its not advisable to do it. so in-order to update your changes always use reload option. Most of the services will support reload option with service command.
#service sshd reload

Please share your experience which you feel not mentioned in this post.

Like the post? Please Subscribe to free RSS feed to get updates