Monthly Archives: March 2017

Package installation in Linux (YUM,APT & zypper)

Different types of package installations in Linux explained with examples. Learn package installation on a yum or apt-based system.

One of the sysadmin tasks in Linux administration is package management. Under which he needs to install, remove, upgrade packages on the system. In another post, we already saw package/patch installation in HPUX (Unix based system), in this article we will be studying package installation in Linux.

There are many distributions in the market and they support different ways to manage packages on the system. Distros like Red Hat, Cent OS supports YUM (Yellow dog Updater Modified) whereas distros like Debian or Ubuntu support APT (Advanced Packaging Tool).

YUM based system uses packages with .rpm extension (RedHat package manager) whereas APT based systems use packages with .deb extension (Debian distribution)

Package installation on YUM based system

YUM needs to be configured properly to receive package inventory from source server over HTTP/FTP etc. If not then you should have a package file (.rpm) with you.

Installing package from list using yum in RHEL / CentOS

YUM is smart enough to locate packages for you. For instance, if you want to install a telnet package, you are not supposed to supply a complete telnet package name which includes version, architecture, etc details in the name. Typing yum install telnet is enough. YUM will search the package with the name telnet and confirm with you before installation.

root@kerneltalks # yum install telnet
Loaded plugins: amazon-id, rhui-lb, search-disabled-repos
Resolving Dependencies
--> Running transaction check
---> Package telnet.x86_64 1:0.17-60.el7 will be installed
--> Finished Dependency Resolution

Dependencies Resolved

=============================================================================================================================================================
 Package                      Arch                         Version                              Repository                                              Size
=============================================================================================================================================================
Installing:
 telnet                       x86_64                       1:0.17-60.el7                        rhui-REGION-rhel-server-releases                        63 k

Transaction Summary
=============================================================================================================================================================
Install  1 Package

Total download size: 63 k
Installed size: 113 k
Is this ok [y/d/N]: y
Downloading packages:
telnet-0.17-60.el7.x86_64.rpm                                                                                                         |  63 kB  00:00:00
Running transaction check
Running transaction test
Transaction test succeeded
Running transaction
  Installing : 1:telnet-0.17-60.el7.x86_64                                                                                                               1/1
  Verifying  : 1:telnet-0.17-60.el7.x86_64                                                                                                               1/1

Installed:
  telnet.x86_64 1:0.17-60.el7

Complete!

In the above output, you can see the install process goes through stages checks, resolving dependencies, printing details, confirmation from the user, downloading, installing, verifying. You can even download the only package using this command.

Recommended read : How to upgrade package using YUM

Installing a standalone package using rpm in RHEL / CentOS

If you don’t have yum repositories setup and have standalone package file (.rpm) then you can install it using rpm -i command.

root@kerneltalks # rpm -ivh telnet-0.17-60.el7.x86_64.rpm
Preparing...                          ################################# [100%]
Updating / installing...
   1:telnet-1:0.17-60.el7             ################################# [100%]

In the above command, we used -v verbose mode and -h to print progress hash marks!

Package installation on APT based system

APT configuration needs to be in place to fetch packages from the source server. If not then at least you should have a package file .deb with you for installation.

Installing package from list using apt-get on Ubuntu / Debian

apt-get command used for package management. For installing new package use apt-get install <package-name>. See below example for installing telnet package :

root@kerneltalks # apt-get install telnet                                                                                                                                      
Reading package lists... Done
Building dependency tree       
Reading state information... Done
The following NEW packages will be installed:
  telnet
0 upgraded, 1 newly installed, 0 to remove and 0 not upgraded.
Need to get 0 B/63.5 kB of archives.
After this operation, 182 kB of additional disk space will be used.
Selecting previously unselected package telnet.
(Reading database ... 53784 files and directories currently installed.)
Preparing to unpack .../telnet_0.17-40_amd64.deb ...
Unpacking telnet (0.17-40) ...
Processing triggers for man-db (2.7.5-1) ...
Setting up telnet (0.17-40) ...
update-alternatives: using /usr/bin/telnet.netkit to provide /usr/bin/telnet (telnet) in auto mode

You can see in the above output, it first checks the availability of the stated package in the package list. Then it prints install-info along with size details. Then it downloads a package, unpacks it, installs it, and completes configurations.

While installing a new package, default dependencies will be checked and resolved. There are a few options which you can use with install operation :

-d: download only package in the current directory
-q: quiet operation
-v: verbose mode
-s: simulate/dry run. Don’t actually install.

Installing standalone package using dpkg on Debian / Ubuntu

If you have a package file (.deb) with you on the server and you want to install it then you can use dpkg command. Supply package file path along with -i option.

root@kerneltalks # dpkg -i telnet_0.17-40_amd64.deb                                                                                                                       
Selecting previously unselected package telnet.
(Reading database ... 53784 files and directories currently installed.)
Preparing to unpack telnet_0.17-40_amd64.deb ...
Unpacking telnet (0.17-40) ...
Setting up telnet (0.17-40) ...
update-alternatives: using /usr/bin/telnet.netkit to provide /usr/bin/telnet (telnet) in auto mode
Processing triggers for man-db (2.7.5-1) ...

The command will set up the package for you with an almost the same sequence as apt-get only looking for a package in the list and downloading stuff omitted.

Installing package using zypper in Suse Linux

In Suse Linux, zypper is mainly used for package management. You can use install or in switch followed by package name to install package using zypper.

root@kerneltalks # zypper install telnet
Refreshing service 'SMT-http_smt-ec2_susecloud_net'.
Refreshing service 'cloud_update'.
Loading repository data...
Reading installed packages...
Resolving package dependencies...

The following NEW package is going to be installed:
  telnet

1 new package to install.
Overall download size: 51.8 KiB. Already cached: 0 B. After the operation, additional 113.3 KiB will be used.
Continue? [y/n/...? shows all options] (y): y
Retrieving package telnet-1.2-165.63.x86_64                                                                                        (1/1),  51.8 KiB (113.3 KiB unpacked)
Retrieving: telnet-1.2-165.63.x86_64.rpm .........................................................................................................................[done]
Checking for file conflicts: .....................................................................................................................................[done]
(1/1) Installing: telnet-1.2-165.63.x86_64 .......................................................................................................................[done]

zypper also auto-resolve dependencies and install them along with your required package.

YUM automatic updates! Save your valuable time!

Leave a reply

Learn how to schedule YUM automatic updates to upgrade all system packages to the available latest version in the background without manual intervention!

Set YUM to update packages automatically

Recently we published a post about how to update packages in the RHEL system using YUM. In this post, we have explained how to update single or multiple packages and even all packages at once using the command line. But these ways are manual tasks and needs human intervention to complete them.

In this post, we will see how to set automatic updates using YUM-cron. This will save sysadmin time which is invested in updating packages manually.

Setting this up is not recommended in the production system since they always need a risk analysis of their environment before processing updates.

Setting YUM automatic updates in production servers not recommended. Since production servers seek analysis on who updates will impact the operation of the server and its hosted apps. And this process is completely automatic and runs in the background, it’s advisable to refrain implementing it on critical servers.

YUM-cron is service available on RHEL which runs in background and updates packages on the system automatically. It’s like cron for YUM like we have crons for scripts/commands in Linux. It’s available with the package name yum-cron. Let’s see stepwise install and configure the process of it.

Install yum-cron

yum-cron package is available on optional and supplementary channels. Your YUM should be configured to fetch packages from these channels. Install these packages using :

# yum install yum-cron

Once installed, you need to enable this service since its disabled by default. Enable service using chkconfig & start it manually:

# chkconfig yum-cron on
# service yum-cron start

Configure yum-cron:

yum-cron configuration file is /etc/sysconfig/yum-cron & /etc/sysconfig/yum-cron-houely.conf. In this configuration file, you can set the frequency and extent of updates.

It has majorly three important fields to set as highlighted below :

# Whether a message should emitted when updates are available.
update_messages = yes

# Whether updates should be downloaded when they are available. Note
# that updates_messages must also be yes for updates to be downloaded.
download_updates = yes

# Whether updates should be applied when they are available.  Note
# that both update_messages and download_updates must also be yes for
# the update to be applied
apply_updates = yes

In the hourly conf file you can set security updates with below settings to make sure your system running latest secured packages and not missing any important security update :

#  What kind of update to use:
# default                            = yum upgrade
# security                           = yum --security upgrade
# security-severity:Critical         = yum --sec-severity=Critical upgrade
# minimal                            = yum --bugfix update-minimal
# minimal-security                   = yum --security update-minimal
# minimal-security-severity:Critical =  --sec-severity=Critical update-minimal

You can also configure email ID so that notification will be sent out after yum-cron finishes its tasks. This can be defined against MAILTO or email_to variable in the configuration file.

Once configuration is done restart yum-cron service.

That’s it! you are done. Now yum-cron service runs in the background quietly. It will update packages on the system (configured as per extent) on time set by frequency in the config and send you an email notification (if configured). You can use your valuable time in other sysadmin tasks!

4 tools to download any file using the command line in Linux

Leave a reply

Learn how to download any file using the command line from the internet or FTP servers to your Linux server. Get files in your server in seconds!

How to download any file using command line

There are many times when you want a file on your Linux server from the Internet or FTP server and you are on command line terminal! When using the GUI of Linux, it’s easy to get files by using browsers but for command-line, it’s a little bit difficult.

We have 4 tools here to help you with the task! They are :

wget
curl
elinks
w3m

wget

Most popular utility! wget is a package you can install and use it right out of the box. You can install it with YUM or APT package. Once installed you can use it with supplying URL of the targeted download.

# wget https://kerneltalks.com/image.png
--2017-03-05 06:56:54--  https://kerneltalks.com/image.png
Resolving kerneltalks.com... 208.91.198.91
Connecting to kerneltalks.com|208.91.198.91|:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 12477 (12K) [image/png]
Saving to: “image.png”

100%[===================================================================================================================>] 12,477      --.-K/s   in 0s

2017-03-05 06:56:55 (782 MB/s) - “image.png” saved [12477/12477]

In the above example, we have downloaded one picture file from the internet! The file will be saved in your present working directory by default.

# wget ftp://rpmfind.net/linux/fedora/linux/development/rawhide/Everything/x86_64/os/Packages/s/systemd-233-2.fc27.x86_64.rpm
--2017-03-05 06:58:54--  ftp://rpmfind.net/linux/fedora/linux/development/rawhide/Everything/x86_64/os/Packages/s/systemd-233-2.fc27.x86_64.rpm
           => “systemd-233-2.fc27.x86_64.rpm.1”
Resolving rpmfind.net... 195.220.108.108
Connecting to rpmfind.net|195.220.108.108|:21... connected.
Logging in as anonymous ... Logged in!
==> SYST ... done.    ==> PWD ... done.
==> TYPE I ... done.  ==> CWD (1) /linux/fedora/linux/development/rawhide/Everything/x86_64/os/Packages/s ... done.
==> SIZE systemd-233-2.fc27.x86_64.rpm ... 3179496
==> PASV ... done.    ==> RETR systemd-233-2.fc27.x86_64.rpm ... done.
Length: 3179496 (3.0M) (unauthoritative)

100%[===================================================================================================================>] 3,179,496   1.85M/s   in 1.6s

2017-03-05 06:58:57 (1.85 MB/s) - “systemd-233-2.fc27.x86_64.rpm.1” saved [3179496]

In this example, we used wget to download file from the FTP server. It used anonymous login to get into the server and download the file!

There are several options which you can use according to your requirement. The listing below a few important ones.

-b: send copy progress in the background
-c: continue download (broken or paused download resume)
-r: recursive (download all files in destination)
-A file extension: download only files with the specified extension

curl

Curl is a simple downloader that supports many protocols for file transfer few being FTP, HTTP, HTTPS, telnet, etc. It can be installed using the same above method yum install curl or apt-get install curl.

Curl renders file downloaded to its best-known way. Like if you try to download HTML URL then it will render it and shows you HTML code on terminal :

# curl https://kerneltalks.com
<!DOCTYPE html><html lang="en-US" prefix="og: http://ogp.me/ns# fb: http://ogp.me/ns/fb#"><head ><meta charset="UTF-8" /><title>Kernel Talks - Unix, Linux & scripts.</title><meta name="viewport" content="width=device-width, initial-scale=1" /><meta name="google-site-verification" content="jeFc7PXM8ZxDY5awb8nCCD5-bYwj5S7bwsAIgp1JIgU" /><meta name="msvalidate.01" content="920806CD9A79B08EC8477C0D440658A4" /><meta name="p:domain_verify" content="738d0b16e329ab01cc894a68d2adda34" /><meta name="yandex-verification" content="bd079834c4df4ebf" />
------output clipped-----

See the above example where it shows the HTML code of URL. Same way if you get text file it will show you text file content on the terminal.

To only download the file without trying to read/open it on terminal use option -o with curl.

# curl -O  ftp://rpmfind.net/linux/fedora/linux/development/rawhide/Everything/x86_64/os/Packages/s/systemd-233-2.fc27.x86_64.rpm
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100 3104k  100 3104k    0     0   361k      0  0:00:08  0:00:08 --:--:--  618k

It will download file and progress will be shown on terminal in real time.

elinks

elinks is a text-based browser that supports colors, rendering, tabbed menus, etc. Mostly it’s preloaded with Installations but if not you can install it using yum or apt-get. Let try to download website using elinks https://kerneltalks.com :

Above example shows elinks renders website in text mode (kind of) on terminal!

If you try to download image (or any type of) file it will show you below the GUI screen (within the terminal) with options to choose from what to do next. If you choose to save then it will download a file and keep it.

w3m

The last tool of this article to download internet-based files is w3m. w3m is a text-based www (world wide web) client. Installation steps remain same yum/apt-get install w3m

It also opens up a text-mode GUI screen like elinks and gives you interactive options to choose actions. w3m ftp://rpmf...../...86_64.rpm opens :

If you right-click on the terminal window (normally we don’t!!) it does show you a menu you can use to perform various actions.

You can navigate through this menu using keyboard arrow keys or even using mouse clicks. You can even use short cut keys defined for each menu item in brackets beside them.

All user interactive commands/options are shown in the lower-left corner of the terminal and choices can be submitted there only.

In all, if you are looking for a simple tool, less eye-rolling on-screen, a fast way to get the file on the server then wget is the choice you should make IMHO! Let me know which command-line tool you use for downloading internet files in comments.

How to upgrade package using YUM in RHEL

Leave a reply

Learn step by step to upgrade the package using YUM on the RHEL system. Insights into how the package upgrade process takes place in the background.

YUM is a Red Hat package manager who is capable of searching available packages, install, un-install packages and update them to the latest version. In this article, we are seeing how to update the package using YUM.

You should be having superuser privilege to perform YUM updates or you can use sudo, su for performing it with superuser privilege.

You can update the single package, multiple packages, or all available packages at once. Let’s see stepwise commands for the upgrade package using YUM.

1. Check for updates :

First of all, you can check for available updates using below command :

# yum check-update
Loaded plugins: amazon-id, rhui-lb, security

ConsoleKit.x86_64                                                       0.4.1-6.el6                                          rhui-REGION-rhel-server-releases
ConsoleKit-libs.x86_64                                                  0.4.1-6.el6                                          rhui-REGION-rhel-server-releases
Red_Hat_Enterprise_Linux-Release_Notes-6-en-US.noarch                   8-2.el6                                              rhui-REGION-rhel-server-releases
abrt.x86_64                                                             2.0.8-40.el6                                         rhui-REGION-rhel-server-releases
abrt-addon-ccpp.x86_64                                                  2.0.8-40.el6                                         rhui-REGION-rhel-server-releases
abrt-addon-kerneloops.x86_64                                            2.0.8-40.el6                                         rhui-REGION-rhel-server-releases
------ output clipped -----

You will be presented with the list of packages with the available update. You can update one, multiple, or all packages at once. Dependencies during the update will be resolved and installed by YUM itself. You need not worry about them.

During any package update it goes through below steps :

It checks if package update available or not
It checks and resolves any dependencies
It will present the user with updated information and seeks user confirmation to proceed
Post confirmation it downloads the package from YUM server
It installs/updates dependencies and package
It cleans up stuff it created during the update
It verifies package post-update
Prints completion details screens and exits.

2. Update single package :

For single package update, you need to use the command yum update <package_name>

# yum update bash.x86_64
Loaded plugins: amazon-id, rhui-lb, security
Setting up Update Process
Resolving Dependencies
--> Running transaction check
---> Package bash.x86_64 0:4.1.2-33.el6_7.1 will be updated
---> Package bash.x86_64 0:4.1.2-41.el6_8 will be an update
--> Finished Dependency Resolution

Dependencies Resolved

=============================================================================================================================================================
 Package                    Arch                         Version                                Repository                                              Size
=============================================================================================================================================================
Updating:
 bash                       x86_64                       4.1.2-41.el6_8                         rhui-REGION-rhel-server-releases                       909 k

Transaction Summary
=============================================================================================================================================================
Upgrade       1 Package(s)

Total download size: 909 k
Is this ok [y/N]: y
Downloading Packages:
bash-4.1.2-41.el6_8.x86_64.rpm                                                                                                        | 909 kB     00:00
Running rpm_check_debug
Running Transaction Test
Transaction Test Succeeded
Running Transaction
  Updating   : bash-4.1.2-41.el6_8.x86_64                                                                                                                1/2
  Cleanup    : bash-4.1.2-33.el6_7.1.x86_64                                                                                                              2/2
  Verifying  : bash-4.1.2-41.el6_8.x86_64                                                                                                                1/2
  Verifying  : bash-4.1.2-33.el6_7.1.x86_64                                                                                                              2/2

Updated:
  bash.x86_64 0:4.1.2-41.el6_8

Complete!

In the above example, we updated the bash package. You can see command also tried to check and resolve any dependencies for this update process.

3. Update multiple packages :

Multiple packages can be updated using the same command but supplying more than one package name at the end.

# yum update grep.x86_64 sudo.x86_64
Loaded plugins: amazon-id, rhui-lb, security
Setting up Update Process
Resolving Dependencies
--> Running transaction check
---> Package grep.x86_64 0:2.20-3.el6_7.1 will be updated
---> Package grep.x86_64 0:2.20-5.el6_8 will be an update
---> Package sudo.x86_64 0:1.8.6p3-20.el6_7 will be updated
---> Package sudo.x86_64 0:1.8.6p3-25.el6_8 will be an update
--> Finished Dependency Resolution

Dependencies Resolved

=============================================================================================================================================================
 Package                    Arch                         Version                                Repository                                              Size
=============================================================================================================================================================
Updating:
 grep                       x86_64                       2.20-5.el6_8                           rhui-REGION-rhel-server-releases                       345 k
 sudo                       x86_64                       1.8.6p3-25.el6_8                       rhui-REGION-rhel-server-releases                       710 k

Transaction Summary
=============================================================================================================================================================
Upgrade       2 Package(s)

Total download size: 1.0 M
Is this ok [y/N]: y
Downloading Packages:
(1/2): grep-2.20-5.el6_8.x86_64.rpm                                                                                                   | 345 kB     00:00
(2/2): sudo-1.8.6p3-25.el6_8.x86_64.rpm                                                                                               | 710 kB     00:00
-------------------------------------------------------------------------------------------------------------------------------------------------------------
Total                                                                                                                        2.3 MB/s | 1.0 MB     00:00
Running rpm_check_debug
Running Transaction Test
Transaction Test Succeeded
Running Transaction
  Updating   : grep-2.20-5.el6_8.x86_64                                                                                                                  1/4
  Updating   : sudo-1.8.6p3-25.el6_8.x86_64                                                                                                              2/4
warning: /etc/sudoers created as /etc/sudoers.rpmnew
  Cleanup    : grep-2.20-3.el6_7.1.x86_64                                                                                                                3/4
  Cleanup    : sudo-1.8.6p3-20.el6_7.x86_64                                                                                                              4/4
  Verifying  : sudo-1.8.6p3-25.el6_8.x86_64                                                                                                              1/4
  Verifying  : grep-2.20-5.el6_8.x86_64                                                                                                                  2/4
  Verifying  : grep-2.20-3.el6_7.1.x86_64                                                                                                                3/4
  Verifying  : sudo-1.8.6p3-20.el6_7.x86_64                                                                                                              4/4

Updated:
  grep.x86_64 0:2.20-5.el6_8                                                  sudo.x86_64 0:1.8.6p3-25.el6_8

Complete!

In the above example, we updated grep and sudo package using single command.

4. Updating all packages at once :

Sometimes you want to avoid the hassle of updating multiple packages and want to install all available updates in a single shot. Then you can go for yum update command. Make a note that all related dependencies also gets installed/updated with this.

This is not recommended in a production environment unless you review the complete list of available updates thoroughly.

# yum update
----- output clipped -----
Transaction Summary
=============================================================================================================================================================
Install       3 Package(s)
Upgrade     243 Package(s)

Total download size: 237 M
Is this ok [y/N]: y
Downloading Packages:
(1/246): ConsoleKit-0.4.1-6.el6.x86_64.rpm                                                                                            |  83 kB     00:00
----- output clipped -----

Installed:
  kernel.x86_64 0:2.6.32-642.15.1.el6                                      python-libipa_hbac.x86_64 0:1.13.3-22.el6_8.6

Dependency Installed:
  libnl3.x86_64 0:3.2.21-8.el6

Updated:
  ConsoleKit.x86_64 0:0.4.1-6.el6                                                  ConsoleKit-libs.x86_64 0:0.4.1-6.el6
  Red_Hat_Enterprise_Linux-Release_Notes-6-en-US.noarch 0:8-2.el6                  abrt.x86_64 0:2.0.8-40.el6
  abrt-addon-ccpp.x86_64 0:2.0.8-40.el6                                            abrt-addon-kerneloops.x86_64 0:2.0.8-40.el6
----- output clipped -----

You can see I had 243 updates available, 3 new packages were available and 1 dependency has to be installed for the update process.

We have seen above all manual steps to upgrade packages using YUM. In a case where you are comfortable with updating all packages on the system without checking the available list then you can use YUM crons as well which will automate the complete process for you.

YUM-cron is service available on RHEL which runs in background and updates packages on the system automatically. See the complete YUM-cron configuration here.

All outputs in this post are from RHEL 6.8 server.

What is the difference between su and sudo?

Leave a reply

Learn the difference between su and sudo. By learning difference you will be able to judge which one is best suited for your requirement of access management.

Granting access to someone’s account to someone is a security threat and should be handled cautiously. Its a part of access management and one should which is the best fit tool for his requirement.

The first question will be why to give someone else’s access to another account?

There are situations like when a normal user needs a superuser privilege to run a few commands only maybe during installation or configuration of his application. Sometimes a normal user needs to execute some database-related tasks which will need access to DB privileged account. So, there are situations that arise in which one user needs access to some other user’s privilege (normally superuser access).

What are available ways to share account access?

Very obvious way and too risky is to share the password of another account which generally not at all suggested and implemented in production environments.
Use sudo to define access to specific commands as a different user
Use su to switch to another account

Difference between su and sudo :

sudo aims at allowing only a few commands (specified in configuration) to run as a different user with their level of access whereas su directly takes you to a different user account so that you have complete access which is owned by that account.

sudo executes commands while the environment of current user loaded. With su you can load the complete environment of the destination account.

So su opens up Pandora box to you! Once you are into different user’s account, you can do whatever you want using that account with its level of access. Imagine if it’s a superuser account, you have full access to the system. This is dangerous! Since the system administrator has no control which command you execute as a different user.

On another hand, sudo allows only specific commands to be executed as a different user with its level of access. This limits your use as a different account and system administrator has complete control over tasks you perform using other account’s level of access.

In a sentence, we can say that sudo awards superuser ability to the normal user without logging into superuser account while su is logging into superuser accounts to get that level of access.

Hence, its always advisable to use sudo for access management than su. SU will be best fitted only in case you trust user getting access won’t misuse it & that user also well aware that what he is doing on the system.

How-to guide: sudo configuration in Unix – Linux (with examples)

Leave a reply

Learn how to secure your system and limit user access using sudo configuration. It helps to restrict superuser privileges of the normal user for a specific command

Many times there is a requirement where a normal user on system needs superuser privileges to run some commands. There are options to this situation which are like sharing the password of the superuser account so the user can su to that user or declaring UID 0 to the user making him superuser himself. Both options open pandora box to user granting him limitless power on the system. This is dangerous and not at all a good practice to compromise the whole system for a few commands. The alternative is sudo !

What is sudo ?

Sudo stands for ‘superuser do’. Sudo grants superuser (or other user’s) privileges to another user for specific/all commands. Normally sudo used to grant superuser privileges to other users hence ‘superuser do’ stand perfect for it. The beauty of sudo is you can define user access command wise. So that user is restricted to only defined commands and your system is secured from the user doing stuff with root privileges without your knowledge.

Sudo configuration :

Let’s see sudo configuration step by step. Here we will assign user usr5 sudo permission to execute apache bounce commands.

First of all, you need to check if sudo package is installed on your system or not.

# rpm -qa |grep  sudo (RHEL, CentOS, Fedora)
sudo-1.6.7p5-30.1.5
# dpkg -s sudo   (Debian, Ubuntu)
Package: sudo
Status: install ok installed
Priority: optional
---- output clipped ----

If not installed, then install it using yum or apt depending on your Linux distro.

Once installed, you will be able to edit /etc/sudoers file which is sudo configuration file. This is a plain text file that can be opened using vi editor. But its recommended to edit it using visudo command. visudo command opens /etc/sudoers file safely and maintains the integrity of the file. It’s the same way vipw command safely edits /etc/passwd file.

# cat /etc/sudoers
# sudoers file.
#
# This file MUST be edited with the 'visudo' command as root.
#
# See the sudoers man page for the details on how to write a sudoers file.
#

# Host alias specification

# User alias specification

# Cmnd alias specification

# Defaults specification

# User privilege specification
root    ALL=(ALL) ALL

# Uncomment to allow people in group wheel to run all commands
# %wheel        ALL=(ALL)       ALL

# Same thing without a password
# %wheel        ALL=(ALL)       NOPASSWD: ALL

# Samples
# %users  ALL=/sbin/mount /cdrom,/sbin/umount /cdrom
# %users  localhost=/sbin/shutdown -h now

See above sample sudoers file.

We will see each section of this file one by one:

1: Host alias specification –

Host alias is a list of one or more hostnames, IP addresses, network numbers, or netgroups. This alias is defined so that group of hosts can be defined in configuration with a single name.

Host_Alias SERVERS = 10.10.5.1, 10.10.5.2, testsrv1, testsrv3
Host_Alias NETWORK = 192.168.0.0/255.255.255.0

In the above example, we are defining SERVERS alias for 4 machines declared using IP or hostname. So any sudo settings defined for SERVERS will be applicable for all 4 machines. This saves the hassle to write all 4 machine details in each and every time in settings, only writing SERVERS will serve the purpose. Also, alias NETWORK for the range defined.

2: User alias specification –

User alias is list of one or more users, groups, uids etc.

User_Alias ADMINS = %admin
User_Alias USERS = user4, oracle65, testuser, #4523

In the above example, all users under system group admin are covered under alias ADMINS. Also we defined USERS alias for 4 machine users. #4523 indicates user with uid 4523.

3: Cmnd alias specification –

Its a list of commandnames, files, or directories. Commandnames includes is a complete command with wildcards support.

Cmnd_Alias ADMIN_CMDS = /usr/sbin/useradd, /usr/sbin/userdel, /usr/sbin/usermod
Cmnd_Alias APACHE_CMDS = /etc/init.d/apache2

In the above examples we defined ADMIN_CMDS and APACHE_CMDS aliases for a list of commands listed in front of them.

4: User privilege section –

Here actual sudo setting for a user defined. Line root ALL=(ALL) ALL indicates, account root can execute any commands from any hosts as any user. If we want to define usr5 to execute apache commands then the line will be –

usr5    ALL=(ALL) NOPASSWD: APACHE_CMDS

Here usr5 is allowed to run commands defined under alias APACHE_CMDS without password from all hosts. If NOPASSWD is not mentioned, the user will be prompted for his own password again before executing a command like below (RHEL).

We trust you have received the usual lecture from the local System
Administrator. It usually boils down to these three things:

    #1) Respect the privacy of others.
    #2) Think before you type.
    #3) With great power comes great responsibility.

[sudo] password for <user>:

5: Run_as alias –

Here you define a list of users. This alias is used to run a command as a different user.

Examples :

Here are few examples to understand how config file works :

ADMINS ALL= /sbin/poweroff

Allows any ADMINS users to run poweroff command from any host.

%users  ALL=/sbin/mount /cdrom,/sbin/umount /cdrom

Allows users under group ‘users’ to mount and unmount /cdrom from any host.

testuser    SERVERS=(root) ADMIN_CMDS

Allows user ‘testuser‘ to run commands defined under ADMIN_CMDS from hosts defined user SERVERS as user root.

testuser ALL=(ALL) NOPASSWD: /usr/bin/su -

Allows user ‘testuser‘ to run command su - without any password. This is an example of how to add commands with arguments in sudo configuration.

Defaults targetpw

Allow users to run commands with their own password. sudo will asks password of the same user before executing su. You need to un-comment the above parameter in sudoers file.

Mailchimp KernelTalks newsletters are here!

Leave a reply

We have moved our subscriptions from native Jetpack subscription to Mailchimp ones. More advanced email communication with readers and RSS email management.

Hey there…

KernelTalks is almost 4 months old now and has seen many technical enhancements for better user experience. In our last post, we happily announced a premium theme, Genesis framework, and CDN which runs in KernelTalk’s background. Those enhancements brought us better, cleaner looks to the website, and lightning-fast loading webpages.

We are implementing once for enhancement for our blog! We are moving our subscriptions from native Jetpack to Mailchimp! All existing subscribers will be moved to our Mailchimp subscriber’s list automatically. Now, all new posts notification will be sent out in email via Mailchimp.

If you are not a subscriber yet, join the Unix-Linux world now. It’s FREE. Fill in your email address here or below and you will get Unix-Linux tips right into your mailbox.