Monitoring users - I

MONITORING USERS-I
User-management is always one of the basic tasks for Linux administrators, here we are going to see some basics user related "Monitoring Commands".

1) "finger" is a command which will give full details about user properties such as name, login, shell what he is using etc.

Syntax:

#finger username

Example:
[root@localhost ~]# finger root
Login: root Name: root
Directory: /root Shell: /bin/bash
On since Sat Jun 6 19:20 (EDT) on tty1 4 hours 12 minutes idle
On since Sun Jun 7 02:18 (EDT) on pts/0 from :0.0
On since Sun Jun 7 03:48 (EDT) on pts/1 from :0.0
16 minutes 9 seconds idle
New mail received Sun Jun 7 04:02 2009 (EDT)
Unread since Sat Jun 6 22:17 2009 (EDT)
No Plan.

Here you can see so many user related information
one security information you can see is when he loged in last time and from where he loged in etc.

2)"id" is one more command which will show the user details such as his primary group and his secondary group.

Syntax:

#id username

Example:

[root@localhost ~]# id root
uid=0(root) gid=0(root) groups=0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel) context=root:system_r:unconfined_t:SystemLow-SystemHigh
[root@localhost ~]#


3)"chage" is one more command which is used to see user related "threshold details" such as user disable time etc.

Syntax:

#chage -l username

Example:

[root@localhost ~]# chage -l root
Last password change : Jun 06, 2009
Password expires : never
Password inactive : never
Account expires : never
Minimum number of days between password change : 0
Maximum number of days between password change : 99999
Number of days of warning before password expires : 7
[root@localhost ~]#

4)"who" is one more command to see who other people logged in and from where they logged in.

Syntax:
#who

Example:

[root@localhost ~]# who
root tty1 2009-06-06 19:20
root pts/0 2009-06-07 02:18 (:0.0)
root pts/1 2009-06-07 03:48 (:0.0)
[root@localhost ~]#

5)"w" is one more command which is similar to "who" command but will give some more details.

Example:

[root@localhost ~]# w
06:36:49 up 11:23, 3 users, load average: 0.54, 0.38, 0.42
USER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT
root tty1 - 19:20 4:27m 0.69s 0.69s -bash
root pts/0 :0.0 02:18 0.00s 0.16s 0.02s w
root pts/1 :0.0 03:48 31:25 0.10s 0.10s bash
[root@localhost ~]#

6)"groups" is one more wonderful command which will show which user belongs to what groups, we can say its a subset of id command

Syntax:

#groups username

Example:

[root@localhost ~]# groups root
root : root bin daemon sys adm disk wheel
[root@localhost ~]#

7)"users" is one more monitoring command to see which users loged in at present in to the system

Example:

[root@localhost ~]# groups root
root : root bin daemon sys adm disk wheel
[root@localhost ~]#

Please add if you know some other user related monitoring commands.

Like the post? Please Subscribe to free RSS feed to get updates

Login Problems

Login Problems

When a user/root try to login to Linux system there are so many problems which will prevent the root/user not to login.

Here we will see what are the problems which will prevent user from not to login to system and try to resolve them one by one.

We can divide these problems in to two categories:

1. Physically present at system.
2. Accessing system from remote location(through network).
   

Logging in to the system when you are present infront of the system.

Issue1:Check weather the password you are typing is correct or not, what I mean is Case sensitive etc,
here I am considering that you forgot the password for that system, In this case follow these steps

Issue2:Still not able to login to system except runlevel1, so how to resolve this issue?

• Check root user properties such as shell type, age and security etc?

Step1 : Check the root properties by using finger command.

#finger root
Login: root Name: root
Directory: /root Shell: /sbin/nologin
Never logged in.

this command will give you the properties of the root user, here we have to check what is the shell he is using, the shell should not be nologin shell. If the shell for the root user is no login shell he will not able to login to system so we have to change the login shell from /sbin/nologin shell to some other shells such as /bin/bash.
To do this we can use chsh command

#chsh -l

This command will display all the shell's installed in your system, to change the shell.

#chsh /bin/bash

then execute finger command to check weather shell has been changed to our required shell or not

#finger root

Step2 : Still not able to login? try if there is any age related issues is there on root user

#chage -l root

It will display the age related info for the root user.
Please increase the age of the root user expiry time

#chage root

Step3 : Still unable to login? Check for security related restriction on root user

Check in /etc/securetty file wether all the entries are there or not(in this file there will be entirs of the terminals from where root user can access the system) check weather tty1 to tty7 and vc1 to vc7 are there or not if they are not there add them and try to login.

Like the post? Please Subscribe to free RSS feed to get updates

Lost Root password

Lost the Root password

When you lost root password how you can recover and login back in to the system?
To login in to system there are so many ways to get root access depending on security level of the system.
Method1: When there is no password set to access runlevel 1.

Here are the steps to change your root password the most esiest way is as follows..

1. Start your computer when you see Redhat Linux boot loader(GRUB menu where you can see all the Operating system's in the system) select the redhat linux and press "e", and select second line where you can set the temporary runlevel for the system to boot

2. You will notice that now you can edit boot loader command arguments now again press "e" and edit the line to add single or 1 without quots at the end of line.

3. Press enter to return to previous screen

4. Press b to boot with this new argument which will run Linux into single user mode. Please make sure that you see single at the end of line.

5. Now you will get root login with out asking for a password in single user mode.

6. Use "passwd" command to change your password.
#passwd
here it will not ask previous password so you can just enter new password.

7. When updateing the password in runlevel1 if the server is not allowing you to change password giving you error, this is due to /etc/shadow file issue.
In order to resolve this issue execute the following command and then try to change the password

#pwunconv

7.After changing the password just type exit command which will take you to default runlevel of the system or just Reboot and use the new password.

Method2: When GRUB boot loader is protected with a password.
When the GRUB boot loader is protected by a password the above mentioned method will not work, so how to login to the system?
In order to retrive root password we have to have first RHEL cd or a live CD(may be konpics/Ubuntu) .

It is easy to boot using the first Cd.
then enter into the rescue mode
just type linux rescue and boot prompt with out quoat

Now we will be logged in to a normal shell, do the folowing steps
Step1 : change the root partation to /mnt/sysimage

chroot /mnt/sysimage

Step2 : Now just change the password
passwd

Step3 : Exit from rescue mode
#exit
#exit
then login with the new passwd
And if you don't have the correct version CD, you can boot from a live CD,
Mkdir /a
mount ... /a
vi /a/etc/password
delete the password in /etc/shadow for root
Now it will come up with no root password (change immediately).

Method3: This method will give you how to retrive your lost root password, not for changing the root password
So how to recover the root password? We can use Rainbow tables technic to do this.

Like the post? Please Subscribe to free RSS feed to get updates

SUDO

SUDO

Sudo (su "do") the name it self indicates that switching user and to do some command as admin.
What actually the difference between su and sudo is that,su is switch user so that we should know administrator password to get admin rights.
But this is security threat for the superuser password it self.
So if an admin wants to give a normal user some/all admin rights depending on his/her requirement's so that he can execute some system level commands and in turn it will not effect root's integrity/properties etc.

So how to give sudo permissions to user?
To use sudo the sudo package should be installed on the server.

step1:quarry for the sudo package

#rpm -q sudo

step2:If the sudo package is not installed install it by below command

#rpm -ivh sudo.versionno.arch.rpm

step3:configuring sudousers

#visudo

there is no space between vi and sudo right? remember this.
when you execute the above command you will be able to open one temporary file which contains all sudo related configuration in it
so you will find some thing like below
# sudoers file.
#
# This file MUST be edited with the 'visudo' command as root.
#
# See the sudoers man page for the details on how to write a sudoers file.
#

# Host alias specification

# User alias specification

# Cmnd alias specification

# Defaults specification

# User privilege specification
root    ALL=(ALL) ALL
# Uncomment to allow people in group wheel to run all commands
# %wheel        ALL=(ALL)       ALL

# Same thing without a password
# %wheel        ALL=(ALL)       NOPASSWD: ALL

you will find some thing like this in that file
this file is self explanatory
We will see some example
user alias specification you can find it
this is the place where we can put user names to whom I want to give sudo permissions
so this is  my sample file
User_Alias USER=surendra
here I declared surendra to use sudo
Cmnd_Aias CMD=/usr/sbin/useradd
I set CMD to /usr/sbin/useradd so if I combined USER variable and CMD variable
the user surendra can execute useradd command with out having admin rights
so this the way I can combine the USER and CMD
USER ALL=CMD
so USER(surendra) can execute all the commands(ie CMD)
so after doing that save and exit that file
so log-in as surendra
and to access sudo you have to use like below
$sudo /usr/sbin/useradd

Like this we can add as many commands as possible which are not available to normal users

Like the post? Please Subscribe to free RSS feed to get updates

Linux user management - 1

User Management Basics-I

For a linux admin, knowledge of user management is must. In this we'll look at simple user management tasks such as creating users

I) Creating a user in linux

Syntax:
   

#useradd username

Example:

        #useradd phani

here we created an user called phani. Before executing this command we should know that useradd is an admin command so only root user can execute this command,So we created user what next? simply logging in ha? if you try to login with "phani" user system will ask for password for that user so with out creating a password phani cant login

II) Creating user password

Syntax:

#passwd username

Example:

        #passwd phani

when you enter this command you will be prompted for new password and for re-entring new password, once the password is updated to system we will get conformation saying that,password has been updated sucessfully

thats its, Creating user in linux is this much easy.. So what next we will see some other commands to know more about user management

III)So how to change password ?

Syntax

#passwd username

Example:

#passwd phani

this is almost same as creating a password, but we have to know one more info suppose you logged in to user "phani" and want to change password for that user you no need to specify the user name just give passwd it will ask for new password for user "phani"

Example:

[phani@server1 ~]$passwd

here it will just ask for new password for phani user.

IV)Can we able to login to linux server with out providing password?

the answer for this is yes we can login to linux with out password, this can be achived with -d option for password command

Syntax

#passwd -d username

     here -d is nothing but deleting the passwor for the specified user.

Example:

#passwd -d phani


please comment if you like this topic

Like the post? Please Subscribe to free RSS feed to get updates