110.1 Lesson 1

Aside from the traditional permission set of read, write and execute, files in a Linux system may also have some special permissions set such as the SUID or the SGID bits.

The SUID bit will allow the file to be executed with the privileges of the file’s owner. It is numerically represented by 4000 and symbolically represented by either s or S on the owner’s execute permission bit. A classic example of an executable file with the SUID permission set is passwd:

The lowercase s in rws indicates the presence of the SUID on the file — together with the execute permission. An uppercase S instead (rwS) would mean the underlying execute permission is not set.

On the other hand, the SGID bit can be set both on files and directories. With files, its behaviour is equivalent to that of SUID but the privileges are those of the group owner. When set on a directory, however, it will allow all files created therein to inherit the ownership of the directory’s group. Like SUID, SGID is symbollically represented by either s or S on the group’s execute permission bit. Numerically, it is represented by 2000. You can set the SGID on a directory by using chmod. You have to add 2 (SGID) to the traditional permissions (755 in our case):

To find files with either or both the SUID and SGID set you can use the find command and make use of the -perm option. You can use both numeric and symbolic values. The values — in turn — can be passed on their own or preceded by a dash (-) or a forward slash (/). The meaning is as follows:

For example, to find files with only SUID set in the present working directory, you will use the following command:

Note how — as there were not any files having exclusively the SUID — we created one to show some output. You can run the same command in symbolic notation:

To find files matching SUID (irrespective of any other permssions) in the /usr/bin/ directory, you can use either of the following commands:

If you are looking for files in the same directory with the SGID bit set, you can execute find /usr/bin/ -perm -2000 or find /usr/bin/ -perm -g+s.

Finally, to find files with either of the two special permissions set, add 4 and 2 and use /:

As noted above you can use the passwd utility to change your own password as a regular user. Additionally, you can pass the -S or --status switch to get status information about your account:

Here is a breakdown of the seven fields you get in the output:

Apart from reporting on account status, you will use the passwd command as root to carry out some basic account maintenance. You can lock and unlock accounts, force a user to change their password on the next login and delete a user’s password with the -l, -u, -e and -d options, respectively.

To test these options it is convenient to introduce the su command at this point. Through su you can change users during a login session. So, for example, let us use passwd as root to lock carol's password. Then we will switch to carol and check our account status to verify that the password has — in fact — been locked (L) and cannot be changed. Finally, going back to the root user, we will unlock carol's password:

Alternatively, you can also lock and unlock a user’s password with the usermod command:

Aside from passwd and usermod, the most direct command to deal with password and account aging is chage (“change age”). As root, you can pass chage the -l (or --list) switch followed by a username to have that user’s current password and account expiry information printed on the screen; as a regular user, you can view your own information:

Run without options and only followed by a username, chage will behave interactively:

The options to modify the different chage settings are as follows:

When it comes to keeping an eye on open ports, four powerful utilities are present on most Linux systems: lsof, fuser, netstat and nmap. We will cover them in this section.

lsof stands for “list open files”, which is no small thing considering that — for Linux — everything is a file. In fact, if you type lsof into the terminal, you will get a large listing of regular files, device files, sockets, etc. However, for the sake of this lesson, we will mainly focus on ports. To print the listing of all “Internet” network files, run lsof with the -i option:

Apart from the bootpc service — which is used by DHCP — the ouput shows two services listening for connections — ssh and the Apache web server (http) —  as well as two established SSH connections. You can specify a particular host with the @ip-address notation to check for its connections:

Likewise, you can filter by port by passing the -i (or -i@ip-address) option the :port argument:

Multiple ports are separated by commas (and ranges are specified using a dash):

Next on the list of network commands is fuser. Its main purpose is to find a “file’s user” — which involves knowing what processes are accessing what files; it also gives you some other information such as the type of access. For example, to check on the current working directory, it is sufficient to run fuser . However, to get a little more information, it is convenient to use the verbose (-v or --verbose) option:

Let us break down the output:

With the -n (or --namespace) option, you can find information about network ports/sockets. You must also supply the network protocol and port number. Thus, to get information about the Apache web server you will run the following command:

Let us turn to netstat now. netstat is a very versatile network tool that is mostly used to print “network statistics”.

Run without options, netstat will display both active Internet connections and Unix sockets. Because of the size of the listing, you may want to pipe its output through less:

To list only “listening” ports and sockets, you will use the -l or --listening options. The -t/--tcp and -u/--udp options can be added to filter by TCP and UDP protocol, respectively (they can also be combined in the same command). Likewise, -e/--extend will display additional information:

If you omit -l option, only established connections will be shown:

If you are only interested in numerical information concerning ports and hosts, you can use the -n or --numeric option to print only port numbers and IP addresses. Note how ssh turns into to 22 when adding -n to the command above:

As you can see, you can make very useful and productive netstat commands by combining some of its options. Browse through the man pages to learn more and find the combinations that best suit your needs.

Finally, we will introduce nmap — or the “network mapper”. Another very powerful utility, this port scanner is executed by specifying an IP address or hostname:

Aside from a single host, nmap allows you to scan:

To scan a particular port, use the -p switch followed by the port number or service name (nmap -p 22 and nmap -p ssh will give you the same output):

You can also scan multiple ports or port ranges by using commas and dashes, respectively:

Two other important and handy nmap options are:

Resources on a Linux system are not unlimited so — as a sysadmin — you should ensure a good balance between user limits on resources and the proper functioning of the operating system. ulimit can help you out in that regard.

ulimit deals with soft and hard limits — specified by the -S and -H options, respectively. Run without options or arguments, ulimit will display the soft file blocks of the current user:

With the -a option, ulimit will show all current soft limits (the same as -Sa); to display all current hard limits, use -Ha:

The available shell resources are specified by options such as:

Thus, to display limits you will use ulimit followed by either -S (soft) or -H(hard) and the resource option; if neither -S or -H is supplied, soft limits will be shown:

Likewise, to set new limits on a particular resource you will specify either -S or -H, followed by the corresponding resource option and the new value. This value can be a number or the special words soft (current soft limit), hard (current hard limit) or unlimited (no limit). If neither -S or -H is specified, both limits will be set. For example, let us first read the current maximum size value for files written by the shell and its children:

Now, let us change the value from unlimited to 500 blocks without specifying either -S or -H. Note how both the soft and hard limits are changed:

Finally, we will decrease only the soft limit to 200 blocks:

Hard limits can only be increased by the root user. On the other hand, regular users can decrease hard limits and increase soft limits up to the value of hard limits. To make new limit values persistent across reboots, you must write them to the /etc/security/limits.conf file. This is also the file used by the administrator to apply restrictions on particular users.

Another of your jobs as a sysadmin entails keeping track of logged-in users. There are three utilities that can help you out with those tasks: last, who and w.

last prints a listing of the last logged in users with the most recent information on top:

Considering the truncated listing, we get information about the last two users on the system. The first two lines tell us about user carol; the next two lines, about user mimi. The information is as follows:

You can pass last a username to have only entries for that user displayed:

Regarding the second column (terminal), pts stands for Pseudo Terminal Slave — as opposed to a proper TeleTYpewriter or tty terminal; 0 refers to the first one (the count starts at zero).

The who and w utilities focus on currently logged in users and are quite similar. The former displays who is logged on, while the latter also shows information on what they are doing.

When executed with no options, who will display four columns corresponding to logged-in user, terminal, date and time, and hostname:

who accepts a series of options, among which we can highlight the following:

Compared to who, w gives a little more verbose output:

The top line gives you information about the current time (17:56:12), how long the system has been up and running (up 40 min), the number of currently logged in users (2 users) and the load average numbers (load average: 0.04, 0.12, 0.09). These values refer to the number of jobs in the run queue averaged over the last 1, 5 and 15 minutes, respectively.

Then you find eight columns; let us break them down:

Just like with who, you can pass w usernames:

As already noted in this lesson, su lets you switch to any other user in the system as long as you provide the target user’s password. In the case of the root user, having its password distributed or known to (many) users puts the system at risk and is a very bad security practice. The basic usage of su is su - target-username. When changing to root — though — the target username is optional:

The use of the dash (-) ensures that the target user’s environment is loaded. Without it, the old user’s environment will be kept:

On the other hand, there is the sudo command. With it you can execute a command as the root user — or any other user for that matter. From a security perspective, sudo is a far better option than su as it presents two main advantages:

The basic usage of sudo is sudo -u target-username command. However, to run a command as user root, the -u target-username option is not necessary: