Linux Reference Guide
Below you will find brief information for Linux. This guide provides a quick reference for Linux system administration, covering topics like LVM, system boot, filesystems, package management, command line tools, networking, security, and more. It's designed to be a handy resource for system administrators and those preparing for Linux certifications.
Advertisement
Advertisement
Linux
Quick Reference Guide
4 th edition June 2016
Foreword
This guide stems from the notes I have been taking while working as a Linux sysadmin and preparing to pass the exams for
LPIC-1 (Linux Professional Institute Certification level 1), LPIC-2 (Linux Professional Institute Certification level 2), and
RHCSA (Red Hat Certified System Administrator). This guide was originally named Linux & LPIC Quick Reference Guide, then starting from this edition its title was changed to be certification-agnostic.
It includes quite a good amount of topics for these certification exams, with some subjects handled in more details than others. I started writing this guide in 2013 and it is my aim to update and integrate it periodically.
This document is an independent publication and is not affiliated with, authorized by, sponsored by, or otherwise approved by
LPI or Red Hat. You can freely use and share this guide or the single pages, either in electronic or in printed form, provided that you distribute them unmodified and not-for-profit. Please feel free to contact me if you find any error, inaccuracy, or unclear point so I can correct it in future editions.
Happy Linux hacking,
Daniele Raffo
Version history
1
2 st nd
edition
3 rd
4 th
edition
edition
edition
May 2013
September 2014
July 2015
June 2016
Sources and suggested readings
●
Evi Nemeth et al., UNIX and Linux System Administration Handbook, O'Reilly
●
Mendel Cooper, Advanced Bash-Scripting Guide, http://tldp.org/LDP/abs/html
●
Adam Haeder et al., LPI Linux Certification in a Nutshell, O'Reilly
●
Heinrich W. Klöpping et al., The LPIC-2 Exam Prep, http://lpic2.unix.nl
●
Michael Jang, RHCSA/RHCE Red Hat Linux Certification Study Guide, McGraw-Hill
●
Asghar Ghori, RHCSA & RHCE RHEL 7: Training and Exam Preparation Guide, Lightning Source Inc.
●
Colin Barschel, Unix Toolbox, http://cb.vu/unixtoolbox.xhtml
●
Ellen Siever et al., Linux in a Nutshell, O'Reilly, http://archive.oreilly.com/linux/cmd
●
Bruce Barnett, UNIX tutorials, http://www.grymoire.com/Unix
●
RHEL manuals, https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux
●
A-Z index of Bash command line, http://ss64.com/bash
●
GNU software manuals, http://www.gnu.org/manual
●
Shell command line snippets, http://www.commandlinefu.com
●
Bash command line snippets, http://www.bashoneliners.com
●
RAM management in Linux, http://www.linuxatemyram.com
●
Regular expressions tester, http://www.regextester.com
●
Linux man pages, https://www.kernel.org/doc/man-pages
Index
LVM................................................1
LVM commands................................2
System boot....................................3
SysV startup sequence.....................4
Login..............................................5
Runlevels........................................6
SysV vs Systemd init scripts..............7
/etc/inittab......................................8
Filesystem Hierarchy Standard...........9
Partitions......................................10
mount..........................................11
Filesystem types............................12
Swap............................................13
/etc/fstab......................................14
Filesystem operations.....................15
Filesystem maintenance..................16
XFS, ReiserFS, CD-ROM fs...............17
AutoFS..........................................18
RAID............................................19
Bootloader....................................20
GRUB 2 configuration......................21
GRUB 2 usage................................22
GRUB Legacy.................................23
Low-level package managers...........24
High-level package managers..........25
Package management tools.............26
Backup.........................................27
Tape libraries.................................28
Command line...............................29
System information........................30
Text filters.....................................31
cut, sed, tr....................................32
Regular expressions........................33
File management...........................34
I/O streams...................................35
read and echo................................36
Processes......................................37
Signals.........................................38
Resource monitoring.......................39
vmstat and free.............................40
File permissions.............................41
File attributes................................42
ACLs.............................................43
Links............................................44
Find system files............................45
Shell environment..........................46
Variable assignment.......................47
Scripting.......................................48
Tests............................................49
Flow control...................................50
Text processors..............................51
Vi.................................................52
Vi options......................................53
SQL..............................................54
SQL SELECTs.................................55
SQL JOINs.....................................56
MySQL..........................................57
MySQL syntax................................58
MySQL status................................59
MySQL recipes...............................60
MySQL operations..........................61
X Window......................................62
X Window tools..............................63
X11 keysim codes..........................64
/etc/passwd...................................65
User management..........................66
UID and GID..................................67
su and sudo...................................68
Terminals......................................69
cron.............................................70
at.................................................71
Utilities.........................................72
Localization...................................73
System time..................................74
Syslog..........................................75
E-mail...........................................76
SMTP............................................77
Sendmail.......................................78
Exim.............................................79
Postfix..........................................80
Postfix configuration.......................81
Procmail........................................82
Courier POP...................................83
Courier IMAP.................................84
Dovecot login.................................85
Dovecot mailboxes.........................86
Dovecot POP and IMAP....................87
Dovecot authentication...................88
FTP..............................................89
vsftpd...........................................90
CUPS............................................91
IP addressing.................................92
Subnetting....................................93
Network services............................94
Network config commands...............95
Wireless networking.......................96
Network tools................................97
Network monitoring........................98
tcpdump.......................................99
netcat.........................................100
Network config files......................101
Network config files (Red Hat)........102
TCP Wrapper................................103
Routing.......................................104
iptables.......................................105
iptables rules...............................106
firewalld......................................107
firewalld rules..............................108
NAT routing.................................109
SSH............................................110
SSH operations............................111
SSH configuration.........................112
GnuPG........................................113
OpenVPN.....................................114
Key bindings................................115
udev...........................................116
Kernel.........................................117
Kernel management......................118
Kernel compile and patching..........119
Kernel modules............................120
/proc filesystem...........................121
System recovery..........................122
DNS............................................123
DNS configuration.........................124
DNS zone file...............................125
Apache........................................126
Apache configuration....................127
Apache virtual hosts.....................128
Apache directory protection...........129
Apache SSL/TLS...........................130
OpenSSL.....................................131
CA.pl..........................................132
Samba (server)............................133
Samba (client).............................134
Samba global configuration............135
Samba share configuration............136
Samba share access and macros....137
NFS............................................138
/etc/exports.................................139
DHCP..........................................140
PAM............................................141
LDAP..........................................142
OpenLDAP...................................143
SELinux.......................................144
KVM............................................145
HTML 4.01 (components)..............146
HTML 4.01 (text)..........................147
HTML 4.01 (images).....................148
HTML 4.01 (tables and lists)..........149
7-bit ASCII table..........................150
1/150 LVM
LVM
Logical Volume Management (LVM) introduces an abstraction between physical and logical storage that permits a more versatile use of filesystems. LVM uses the Linux device mapper feature (/dev/mapper).
Disks, partitions, and RAID devices are made of Physical Volumes, which are grouped into a Volume Group.
A Volume Group is divided into small fixed-size chunks called Physical Extents, which are mapped 1-to-1 to Logical Extents.
Logical Extents are grouped into Logical Volumes, on which filesystems are created.
How to create a Logical Volume
1.
Add a new physical or virtual disk to the machine
2.
lsblk
3.
fdisk /dev/sda
4.
pvcreate /dev/sda1
5.
vgcreate -s 8M myvg0 /dev/sda1 or vgextend myvg0 /dev/sda1
6.
lvcreate -L 1024M -n mylv myvg0
7.
mkfs -t ext3 /dev/myvg0/mylv
8.
mount /dev/myvg0/mylv /mnt/mystuff
Check that the new disk is being recognized e.g. as
/dev/sda
Create a new partition (should be of type 0x8E = Linux
LVM) on the new disk.
This is not necessary but recommended, because other
OSes might not recognize LVM and see the whole unpartitioned disk as empty
Initialize the Physical Volume to be used with LVM
Create a Volume Group and define the size of Physical
Extents to 8 Mb (default value is 4 Mb) or add the Physical Volume to an existing Volume Group
Create a Logical Volume
Create a filesystem on the Logical Volume
Mount the Logical Volume which is now ready to be used
How to increase the size of a Logical Volume (only if the underlying filesystem permits it)
1.
Add a new physical or virtual disk to the machine; this will provide the extra disk space
2.
fdisk /dev/sdc Partition the new disk
3.
4.
pvcreate /dev/sdc vgextend myvg0 /dev/sdc
5.
lvextend -L 2048M /dev/myvg0/mylv or lvresize -L+2048M /dev/myvg0/mylv
Initialize the Physical Volume /dev/sdc
Add /dev/sdc to an existing Volume Group
Extend the Logical Volume by 2 Gb or lvresize -l+100%FREE /dev/myvg/mylv
6.
resize2fs /dev/myvg0/mylv or extend the Logical Volume taking all free space
Extend the filesystem
How to reduce the size of a Logical Volume (only if the underlying filesystem permits it)
1.
resize2fs /dev/myvg0/mylv 900M Shrink the filesystem
2.
lvreduce -L 900M /dev/myvg0/mylv or lvresize -L-900M /dev/myvg0/mylv
Shrink the Logical Volume by 900 Mb
How to snapshot and backup a Logical Volume
1.
lvcreate -s -L 1024M -n snapshot0 /dev/myvg0/mylv
2.
tar cvzf snapshot0.tar.gz snapshot0
3.
lvremove /dev/mvvg0/snapshot0
Create the snapshot just like another Logical Volume
Backup the snapshot with any backup tool
Delete the snapshot
Linux Quick Reference Guide 4 th ed. June 2016 © Daniele Raffo www.crans.org/~raffo
2/150 LVM commands
pvs pvscan pvdisplay pvck pvcreate
PV commands
Report information about
Physical Volumes vgs vgscan Scan all disks for
Physical Volumes
Display Physical Volume attributes
Check Physical Volume metadata
Initialize a disk or partition for use with
LVM vgdisplay vgck vgcreate
Change Physical Volume attributes
Remove a Physical
Volume vgchange vgremove vgextend
VG commands
Report information about Volume Groups
Scan all disks for
Volume Groups
Display Volume Group attributes
Check Volume Group metadata
Create a Volume Group using Physical Volumes lvs lvscan lvdisplay lvcreate pvchange pvremove vgreduce
Change Volume Group attributes
Remove a Volume
Group
Add a Physical Volume to a Volume Group
Remove a Physical
Volume from a Volume
Group pvresize Resize a disk or partition in use with LVM vgmerge vgsplit vgimport vgexport
Merge two Volume
Groups
Split two Volume
Groups
Import a Volume Group into a system
Export a Volume Group from a system pvmove lvmdiskscan
Move the Logical Extents on a Physical Volume to wherever there are available Physical
Extents (within the
Volume Group) and then put the Physical Volume offline dmsetup command
LVM global commands
Scan the system for disks and partitions usable by LVM
Perform low-level LVM operations lvchange lvremove lvextend lvreduce lvresize
LVM commands
LV commands
Report information about Logical Volumes
Scan all disks for
Logical Volumes
Display Logical Volume attributes
Create a Logical
Volume in a Volume
Group
Change Logical Volume attributes
Remove a Logical
Volume
Increase the size of a
Logical Volume
Shrink the size a
Logical Volume
Modify the size of a
Logical Volume
/dev/mapper/vgname-lvname
/dev/vgname/lvname
Mapping of Logical Volumes in the filesystem
Linux Quick Reference Guide 4 th ed. June 2016 © Daniele Raffo www.crans.org/~raffo
3/150 System boot
POST
(Power-On Self Test)
BIOS
(Basic I/O System)
Chain loader
GRUB
(GRand Unified
Bootloader)
Linux kernel init
Startup
Login
System boot
Boot sequence
Low-level check of PC hardware.
Detection of disks and hardware.
GRUB stage 1 is loaded from the MBR and executes GRUB stage 2 from filesystem.
GRUB chooses which OS to boot on.
The chain loader hands over to the boot sector of the partition on which resides the OS.
The chain loader also mounts initrd, an initial ramdisk (typically a compressed ext2 filesystem) to be used as the initial root device during kernel boot; this make possible to load kernel modules that recognize hard drives hardware and that are hence needed to mount the real root filesystem. Afterwards, the system runs /linuxrc with PID 1.
(From Linux 2.6.13 onward, the system instead loads into memory initramfs, a cpiocompressed image, and unpacks it into an instance of tmpfs in RAM. The kernel then executes /init from within the image.)
Kernel decompression into memory.
Kernel execution.
Detection of devices.
The real root filesystem is mounted on / in place of the initial ramdisk.
Execution of init, the first process (PID 1).
The system tries to execute in the following order:
/sbin/init
/etc/init
/bin/init
/bin/sh
If none of these succeeds, the kernel panics.
The system loads startup scripts and runlevel scripts.
If in text mode, init calls the getty process, which runs the login command that asks the user for login and password.
If in graphical mode, the X Display Manager starts the X Server.
Newer systems use UEFI (Unified Extensible Firmware Interface) instead of BIOS. UEFI does not use the MBR boot code; it has knowledge of partition table and filesystems, and stores its application files required for launch in a EFI System
Partition, mostly formatted as FAT32.
After the POST, the system loads the UEFI firmware which initializes the hardware required for booting, then reads its Boot
Manager data to determine which UEFI application to launch. The launched UEFI application may then launch another application, e.g. the kernel and initramfs in case of a boot loader like GRUB.
Linux Quick Reference Guide 4 th ed. June 2016 © Daniele Raffo www.crans.org/~raffo
4/150 SysV startup sequence
OS startup sequence (SysV)
At startup /sbin/init executes all instructions on /etc/inittab . This script at first switches to the default runlevel...
Debian
id:2:initdefault:
SysV startup sequence
Red Hat
id:5:initdefault:
... then it runs the following script (same for all runlevels) which configures peripheral hardware, applies kernel parameters, sets hostname, and provides disks initialization...
... and then, for runlevel N, it calls the script
/etc/init.d/rc N (i.e. with the runlevel number as parameter) which launches all services and daemons specified in the following startup directories:
/etc/init.d/rcS
/etc/rcN.d/
/etc/rc.d/rc.sysinit or
/etc/rc.sysinit
/etc/rc.d/rcN.d/
The startup directories contain symlinks to the init scripts in /etc/init.d/ which are executed in numerical order.
Links starting with K are called with argument stop, links starting with S are called with argument start. lrwxrwxrwx. 1 root root 14 Feb 11 22:32 K88sssd -> ../init.d/sssd lrwxrwxrwx. 1 root root 15 Nov 28 14:50 K89rdisc -> ../init.d/rdisc lrwxrwxrwx. 1 root root 17 Nov 28 15:01 S01sysstat -> ../init.d/sysstat lrwxrwxrwx. 1 root root 18 Nov 28 14:54 S05cgconfig -> ../init.d/cgconfig lrwxrwxrwx. 1 root root 16 Nov 28 14:52 S07iscsid -> ../init.d/iscsid lrwxrwxrwx. 1 root root 18 Nov 28 14:42 S08iptables -> ../init.d/iptables
The last script to be run is S99local -> ../init.d/rc.local ; therefore, an easy way to run a specific program upon boot is to call it from this script file.
/etc/init.d/boot.local
/etc/init.d/before.local (SUSE)
/etc/init.d/after.local (SUSE) runs only at boot time, not when switching runlevel.
runs only at boot time, before the scripts in the startup directories.
runs only at boot time, after the scripts in the startup directories.
To add or remove services at boot sequence: update-rc.d service defaults update-rc.d -f service remove chkconfig --add service chkconfig --del service
When adding or removing a service at boot, startup directories will be updated by creating or deleting symlinks for the default runlevels: K symlinks for runlevels 0 1 6, and S symlinks for runlevels 2 3 4 5.
Service will be run via the xinetd super server.
start stop restart status force-reload condrestart try-restart reload
Service operation parameters supported by the init scripts
Start the service
Stop the service
Restart the service (stop, then start)
Display daemon PID and execution status
Reload configuration if service supports it, otherwise restart
Restart the service only if already running
Reload the service configuration
Mandatory
Optional
Linux Standard Base (LSB)
The Linux Standard Base defines a format to specify default values on an init script /etc/init.d/foo :
### BEGIN INIT INFO
# Provides: foo
# Required-Start: bar
# Defalt-Start: 2 3 4 5
# Default-Stop: 0 1 6
# Description: Service Foo init script
### END INIT INFO
Default runlevels and S/K symlinks values can also be specified as such:
# chkconfig: 2345 85 15
# description: Foo service
Linux Quick Reference Guide 4 th ed. June 2016 © Daniele Raffo www.crans.org/~raffo
5/150
/etc/init/start-ttys.conf (Red Hat)
/etc/sysconfig/init (Red Hat)
/etc/securetty
/etc/issue
/etc/issue.net
/etc/motd
Login
Start the specified number of terminals at bootup via getty, which manages physical or virtual terminals (TTYs)
Login
Control appearance and functioning of the system during bootup
List of TTYs from which the root user is allowed to login
Message that will be printed before the login prompt.
Can contain the following escape codes:
\b Baudrate of line
\d Date
\s System name and OS
\l Terminal device line
\m Architecture identifier of machine
\n Nodename aka hostname
\o Domain name
\r OS release number
\t Time
\u Number of users logged in
\U "n users" logged in
\v OS version and build date
Message that will be printed before the login prompt on a remote session
Message that will be printed after a successful login, before execution of the login shell
Linux Quick Reference Guide 4 th ed. June 2016 © Daniele Raffo www.crans.org/~raffo
6/150
default runlevels
Runlevel
(SysV)
0
1
2
5
6
3
4
S
Target
(Systemd) multi-user.target
graphical.target
Runlevels
Runlevels
Debian Red Hat
Shutdown
Single user / maintenance mode
Multi-user mode
(default)
Multi-user mode without network
Multi-user mode
Multi-user mode
Multi-user mode
Multi-user mode with network
Unused, for custom use
Multi-user mode with network and X
(default)
Reboot
Single user / maintenance mode
(usually accessed through runlevel 1)
Systemd's runleveln.target emulates a SysV's runlevel n.
runlevel who -r init runlevel telinit runlevel systemctl get-default systemctl set-default target systemctl isolate target systemctl emergency systemctl rescue
Display the previous and the current runlevel
Change to runlevel
Get the default target
Set the default target
Change to target
Change to maintenance single-user mode with only /root filesystem mounted
Change to maintenance single-user mode with only local filesystems mounted init 0 telinit 0 shutdown -h now halt poweroff init 6 telinit 6 shutdown -r now reboot shutdown
Halt the system
Reboot the system shutdown -h 16:00 message shutdown -a shutdown -f shutdown -F shutdown -c
Shut down the system in a secure way: all logged-in users are notified via a message to their terminal, and login is disabled.
This command can be run only by the root user, and by the users (if any) listed in
/etc/shutdown.allow
Schedule a shutdown for 4 PM and send a warning message to all logged-in users
Non-root users that are listed in /etc/shutdown.allow can use this command to shut down the system
Skip fsck on reboot
Force fsck on reboot
Cancel a shutdown that has been already initiated
Linux Quick Reference Guide 4 th ed. June 2016 © Daniele Raffo www.crans.org/~raffo
7/150 SysV vs Systemd init scripts
System V
/etc/init.d/service operation service service operation (Red Hat) rcservice operation (SUSE) update-rc.d service defaults (Debian) chkconfig --add service (Red Hat) update-rc.d -f service remove (Debian) chkconfig --del service (Red Hat) update-rc.d -f service \ start 30 2 3 4 5 . stop 70 0 1 6 .
chkconfig --levels 245 service on chkconfig service on chkconfig service off chkconfig service chkconfig service reset chkconfig service resetpriorities chkconfig --list service chkconfig chkconfig --list ls /etc/rcn.d (Debian)
Systemd
SysV vs Systemd init scripts
Action
systemctl operation service Perform one of these operations on the specified service: start stop restart status force-reload condrestart try-restart reload
Add a service at boot
Remove a service at boot
Add a service on the default runlevels; create S30 symlinks for starting the service and K70 symlinks for stopping it
Add the service on runlevels 2 4 5 systemctl enable service systemctl disable service
Add the service on default runlevels
Remove the service on default runlevels systemctl is-enabled service Check if the service is enabled on the current runlevel systemctl list-unit-files \
--type=service systemctl systemctl --all
Reset the on/off state of the service for all runlevels to whatever the LSB specifies in the init script
Reset the start/stop priorities of the service for all runlevels to whatever the LSB specifies in the init script
Display current configuration of service (its status and the runlevels in which it is active)
List all active services and their current configuration
List services started on runlevel n
List loaded and active units
List all units, including inactive ones
Linux Quick Reference Guide 4 th ed. June 2016 © Daniele Raffo www.crans.org/~raffo
8/150 /etc/inittab
/etc/inittab
/etc/inittab
# The default runlevel.
id:2:initdefault:
# Boot-time system configuration/initialization script.
# This is run first except when booting in emergency (-b) mode.
si::sysinit:/etc/init.d/rcS
# What to do in single-user mode.
~~:S:wait:/sbin/sulogin
# /etc/init.d executes the S and K scripts upon change of runlevel.
l0:0:wait:/etc/init.d/rc 0 l1:1:wait:/etc/init.d/rc 1 l2:2:wait:/etc/init.d/rc 2 l3:3:wait:/etc/init.d/rc 3 l4:4:wait:/etc/init.d/rc 4 l5:5:wait:/etc/init.d/rc 5 l6:6:wait:/etc/init.d/rc 6
# Normally not reached, but fall through in case of emergency.
z6:6:respawn:/sbin/sulogin
# /sbin/getty invocations for the runlevels.
# Id field must be the same as the last characters of the device (after "tty").
1:2345:respawn:/sbin/getty 38400 tty1
2:23:respawn:/sbin/getty 38400 tty2
/etc/inittab describes which processes are started at bootup and during normal operation; it is read and executed by init at bootup.
All its entries have the form id:runlevels:action:process
id runlevels
1-4 characters, uniquely identifies an entry.
For gettys and other login processes it should be equal to the suffix of the corresponding tty
Runlevels for which the specified action must be performed.
If empty, action is performed on all runlevels respawn Process will be restarted when it terminates wait once boot bootwait off
Process is started at the specified runlevel and init will wait for its termination
(i.e. execution of further lines of /etc/inittab stops until the process exits)
Process is executed once at the specified runlevel
Process is executed at system boot. Runlevels field is ignored
Process is executed at system boot and init will wait for its termination.
Runlevels field is ignored
Does nothing
action process
ondemand initdefault sysinit powerfail
Process is executed when an on-demand runlevel (A, B, C) is called
Specifies the default runlevel to boot on. Process field is ignored
Process is executed at system boot, before any boot or bootwait entries.
Runlevels field is ignored
Process is executed when power goes down and an UPS kicks in. init will not wait for its termination powerwait powerfailnow powerokwait
Process is executed when power goes down and an UPS kicks in. init will wait for its termination
Process is executed when power is down and the UPS battery is almost empty
Process is executed when power has been restored from UPS ctrlaltdel
Process is executed when init receives a SIGINT via
CTRL kbdrequest
Process to execute. If prepended by a +, utmp and wtmp accounting will not be done
ALT DEL
Process is executed when a special key combination is pressed on console
Linux Quick Reference Guide 4 th ed. June 2016 © Daniele Raffo www.crans.org/~raffo
9/150 Filesystem Hierarchy Standard
/bin
/boot
/dev
/etc
/home
/lib
/lost+found
/media
/mnt
/net
/opt
/proc
/root
/sbin
/srv
Filesystem Hierarchy Standard
Filesystem Hierarchy Standard (FHS)
Essential command binaries
Bootloader files (e.g. OS loader, kernel image, initrd)
Virtual filesystem containing device nodes to devices and partitions
System configuration files and scripts
Home directories for users
Libraries for the binaries in /bin and /sbin, kernel modules
Storage directory for recovered files in this partition
Mount points for removable media
Mount points for temporary filesystems
Access to directory tree on different external NFS servers
Optional, large add-on application software packages
Virtual filesystem providing kernel and processes information
Home directory for the root user
Essential system binaries, system administration commands
Data for services provided by the system
/sys
/tmp
/usr
/usr/bin
/usr/include
/usr/lib
/usr/local
/usr/local/bin
Virtual filesystem providing information about hotplug hardware devices
Temporary files (deleted at reboot)
User utilities and applications
Non-essential command binaries (for all users)
C header files
Libraries for the binaries in /usr/bin and /usr/sbin
Software installed locally
Local software binaries
Local game binaries
/usr/local/games
/usr/local/include
/usr/local/lib
/usr/local/man
/usr/local/sbin
/usr/local/share
Local C header files
Local libraries for the binaries in /usr/local/bin and /usr/local/sbin
Local man pages
Local system binaries
Local architecture-independent hierarchy
/usr/local/src
/usr/sbin
/usr/share
/usr/share/doc
/usr/share/man
/usr/share/info
/usr/src
Local source code
Non-essential system binaries (daemons and services)
Architecture-independent files (e.g. icons, fonts, documentation)
Package-specific documentation not included in man pages
Man pages
Documentation in Info format
Source code for the actual OS
Variable files (e.g. logs, caches, mail spools)
/var
/var/log
/var/opt
Logfiles
Variable files for the application software installed in /opt
/var/spool
/var/tmp
Queued items to be processed (e.g. mail messages, cron jobs, print jobs)
Temporary files that need to be stored for a longer time (preserved between reboots)
Information about filesystem hierarchy can also be obtained via the manpage man hier
Linux Quick Reference Guide 4 th ed. June 2016 © Daniele Raffo www.crans.org/~raffo
10/150 Partitions
Partitions
/dev/hda IDE hard drive
/dev/sda SCSI, PATA, or SATA hard drive
/dev/vda Virtual disk for KVM-based virtual machines
/dev/hda, /dev/hdb, /dev/hdc ... first, second, third ... hard drive
/dev/sda1, /dev/sda2, /dev/sda3 ... first, second, third ... partition of the first hard drive
The superblock contains information relative to the filesystem e.g. filesystem type, size, status, metadata structures.
The Master Boot Record (MBR) is a 512-byte program located in the first sector of the hard disk; it contains information about hard disk partitions and has the duty of loading the OS. On recent systems, the MBR has been replaced by the GUID
Partition Table (GPT).
Most modern filesystems use journaling; in a journaling filesystem, the journal logs changes before committing them to the filesystem, which ensures faster recovery and less corruption in case of a crash.
Partitioning limits for Linux using MBR:
Max 4 primary partitions per hard disk, or 3 primary partitions + 1 extended partition
Max 11 logical partitions (inside the extended partition) per hard disk
Max disk size is 2 Tb
Partition numbers: 1-4
Partition numbers: 5-15
GPT makes no difference between partitions type and has practically no limits concerning number of partitions and disk size.
fdisk /dev/sda fdisk -l /dev/sda parted sfdisk /dev/sda cfdisk gparted gnome-disks partprobe mkfs -t fstype device mkfs -t ext2 /dev/sda mkfs.ext2 /dev/sda mke2fs /dev/sda mke2fs -j /dev/sda mkfs.ext3 /dev/sda mke3fs /dev/sda mkfs -t msdos /dev/sda mkfs.msdos /dev/sda mkdosfs /dev/sda
Disk partitioning interactive tool
List the partition table of /dev/sda
Disk partitioning interactive tool
Disk partitioning non-interactive tool
Disk partitioning tool with text-based UI
Disk partitioning tool with GUI
After fdisk operations, this command can be run to notify the OS of partition table changes. Otherwise, these changes will take place only after reboot
Create a filesystem of the specified type on a partition (i.e. format the partition).
mkfs is a wrapper utility for the actual filesystem-specific maker commands: mkfs.ext2 aka mke2fs mkfs.ext3 aka mke3fs mkfs.ext4
mkfs.msdos aka mkdosfs mkfs.ntfs aka mkntfs mkfs.reiserfs aka mkreiserfs mkfs.jfs
mkfs.xfs
Create a ext2 filesystem on /dev/sda
Create a ext3 filesystem (ext2 with journaling) on /dev/sda
Create a MS-DOS filesystem on /dev/sda
Linux Quick Reference Guide 4 th ed. June 2016 © Daniele Raffo www.crans.org/~raffo
11/150
mount cat /proc/mounts cat /etc/mtab
mount
mount
Display the currently mounted filesystems.
The commands mount and umount maintain in /etc/mtab a database of currently mounted filesystems, but /proc/mounts is authoritative mount -a Mount all devices listed in /etc/fstab (except those indicated as noauto) mount -t ext3 /dev/sda /foobar Mount a Linux-formatted disk. The mount point (directory) must exist mount -t msdos /dev/fd0 /mnt Mount a MS-DOS filesystem floppy disk to mount point /mnt mount /dev/fd0 mount -o remount,rw /
Mount a floppy disk. /etc/fstab must contain an entry for /dev/fd0
Remount the root directory as read-write (supposing it was mounted read-only).
Useful to change flags (in this case, read-only to read-write) for a mounted filesystem that cannot be unmounted at the moment mount -o nolock 10.7.7.7:/export/ /mnt/nfs Mount a NFS share without running NFS daemons.
Useful during system recovery mount -t iso9660 -o ro,loop=/dev/loop0 cd.img /mnt/cdrom Mount a CD-ROM ISO9660 image file like a CD-ROM
(via the loop device) umount /dev/fd0 umount /mnt umount -l /dev/fd0
Unmount a floppy disk that was mounted on /mnt (device must not be busy)
Unmount the floppy disk as soon as it is not in use anymore
Linux Quick Reference Guide 4 th ed. June 2016 © Daniele Raffo www.crans.org/~raffo
12/150 Filesystem types
Filesystem types
0x00 Empty
0x01 FAT12
0x02 XENIX root
0x03 XENIX usr
0x04 FAT16 <32M
0x05 Extended
0x06 FAT16
0x07 HPFS/NTFS/exFAT
0x08 AIX
0x09 AIX bootable
0x0a OS/2 Boot Manager
0x0b W95 FAT32
0x0c W95 FAT32 (LBA)
0x0e W95 FAT16 (LBA)
0x0f W95 extended (LBA)
0x10 OPUS
0x11 Hidden FAT12
0x12 Compaq diagnostics
0x14 Hidden FAT16 <32M
0x16 Hidden FAT16
0x17 Hidden HPFS/NTFS
0x18 AST SmartSleep
0x1b Hidden W95 FAT32
0x1c Hidden W95 FAT32 (LBA)
0x1e Hidden W95 FAT16 (LBA)
0x24 NEC DOS
0x27 Hidden NTFS WinRE
0x39 Plan 9
0x3c PartitionMagic recovery
0x40 Venix 80286
0x41 PPC PReP Boot
0x42 SFS
0x4d QNX4.x
Partition types
0x4e QNX4.x 2nd part
0x4f QNX4.x 3rd part
0x50 OnTrack DM
0x51 OnTrack DM6 Aux1
0x52 CP/M
0x53 OnTrack DM6 Aux3
0x54 OnTrackDM6
0x55 EZ-Drive
0x56 Golden Bow
0x5c Priam Edisk
0x61 SpeedStor
0x63 GNU HURD or SysV
0x64 Novell Netware 286
0x65 Novell Netware 386
0x70 DiskSecure Multi-Boot
0x75 PC/IX
0x80 Old Minix
0x81 Minix / old Linux
0x82 Linux swap / Solaris
0x83 Linux
0x84 OS/2 hidden C: drive
0x85 Linux extended
0x86 NTFS volume set
0x87 NTFS volume set
0x88 Linux plaintext
0x8e Linux LVM
0x93 Amoeba
0x94 Amoeba BBT
0x9f BSD/OS
0xa0 IBM Thinkpad hibernation
0xa5 FreeBSD
0xa6 OpenBSD
0xa7 NeXTSTEP
0xa8 Darwin UFS
0xa9 NetBSD
0xab Darwin boot
0xaf HFS / HFS+
0xb7 BSDI fs
0xb8 BSDI swap
0xbb Boot Wizard hidden
0xbe Solaris boot
0xbf Solaris
0xc1 DRDOS/sec (FAT-12)
0xc4 DRDOS/sec (FAT-16 < 32M)
0xc6 DRDOS/sec (FAT-16)
0xc7 Syrinx
0xda Non-FS data
0xdb CP/M / CTOS / ...
0xde Dell Utility
0xdf BootIt
0xe1 DOS access
0xe3 DOS R/O
0xe4 SpeedStor
0xeb BeOS fs
0xee GPT
0xef EFI (FAT-12/16/32)
0xf0 Linux/PA-RISC boot
0xf1 SpeedStor
0xf4 SpeedStor
0xf2 DOS secondary
0xfb VMware VMFS
0xfc VMware VMKCORE
0xfd Linux raid autodetect
0xfe LANstep
0xff BBT
List of partition IDs and their names, as obtained by the command sfdisk -T ext2 ext3 ext4
Reiserfs
XFS
JFS
Btrfs msdos umsdos fat32 vfat ntfs minix iso9660 cramfs nfs
SMB proc swap
Most used Linux-supported filesystems
Linux default filesystem, offering the best performances ext2 with journaling
Linux journaling filesystem, upgrade from ext3
Journaling filesystem
Journaling filesystem, developed by SGI
Journaling filesystem, developed by IBM
B-tree filesystem, developed by Oracle
DOS filesystem, supporting only 8-char filenames
Extended DOS filesystem used by Linux, compatible with DOS
MS-Windows FAT filesystem
Extended DOS filesystem, with support for long filenames
Replacement for fat32 and vfat filesystems
Native filesystem of the MINIX OS
CD-ROM filesystem
Compressed RAM disk
Network filesystem, used to access files on remote machines
Server Message Block, used to mount Windows network shares
Pseudo filesystem, used as an interface to kernel data structures
Pseudo filesystem, Linux swap area
Linux Quick Reference Guide 4 th ed. June 2016 © Daniele Raffo www.crans.org/~raffo
13/150 Swap
In Linux, the swap space is a virtual memory area (a file or a partition) used as RAM extension. Usually a partition is preferred because of better performances concerning fragmentation and disk speed. Although listed as filesystem type
0x82, the swap partition is not a filesystem but a raw addressable memory with no structure; therefore it is not shown in the output of mount or df commands.
The fdisk tool can be used to create a swap partition.
Swap
dd if=/dev/zero of=/swapfile \ bs=1024 count=512000
Create a 512-Mb swap file mkswap /swapfile swapon /swapfile swapoff /swapfile swapon -s cat /proc/swaps cat /proc/meminfo free top
Initialize a (already created) swap file or partition
Enable a swap file or partition, thus telling the kernel that it can use it now
Disable a swap file or partition
Any of these commands can be used to show the sizes of total and used swap areas
How to extend a swap partition using LVM
1.
lvs
2.
swapoff /dev/volgroup0/swap_lv
3.
lvresize -L+1G /dev/volgroup0/swap_lv
4.
mkswap /dev/volgroup0/swap_lv
5.
swapon /dev/volgroup0/swap_lv
Determine the name of the swap Logical Volume
Turn off the swap volume
Extend the swap volume with an additional 1 Gb of space
Format the swap volume
Turn on the swap volume
Linux Quick Reference Guide 4 th ed. June 2016 © Daniele Raffo www.crans.org/~raffo
14/150 /etc/fstab
/etc/fstab
/etc/fstab Filesystems information
# <filesystem> <mount point> <type> <options> <dump> <pass>
/dev/sda2 / ext2 defaults 0 1
/dev/sdb1 /home ext2 defaults 1 2
/dev/cdrom /media/cdrom auto ro,noauto,user,exec 0 0
/dev/fd0 /media/floppy auto rw,noauto,user,sync 0 0 proc /proc proc defaults 0 0
/dev/hda1 swap swap pri=42 0 0 nfsserver:/dirs /mnt nfs intr 0 0
//smbserver/jdoe /shares/jdoe cifs auto,credentials=/etc/smbcreds 0 0
LABEL=/boot /boot ext2 defaults 0 0
UUID=652b786e-b87f-49d2-af23-8087ced0c667 /test ext4 errors=remount-ro,noatime 0 0
filesystem mount point type
Device or partition. The filesystem can be identified either by its name, label, or UUID
Directory on which the partition must be mounted
Filesystem type, or auto if detected automatically defaults
Use the default options: rw, suid, dev, exec, auto, nouser, async ro rw suid nosuid dev nodev
Mount read-only
Mount read-write (default)
Permit SUID and SGID bit operations (default)
Do not permit SUID and SGID bit operations
Interpret block special devices on the filesystem (default)
Do not interpret block special devices on the filesystem
options dump pass
auto noauto user nouser
Mount automatically at bootup, or when command mount -a is given (default)
Mount only if explicitly demanded
Partition can be mounted by any user
Partition can be mounted only by the root user (default) exec noexec
Binaries contained on the partition can be executed
Binaries contained on the partition cannot be executed sync async
Write files immediately to the partition
Buffer write ops and commit them later, or when device is unmounted (default)
Other specific options apply to specific partition types (e.g. NFS or Samba)
Options for the dump backup utility. 0 = do not backup
Order in which the filesystem must be checked by fsck. 0 = do not check
Linux Quick Reference Guide 4 th ed. June 2016 © Daniele Raffo www.crans.org/~raffo
15/150
df df -h df /path/mydir
Filesystem operations
Filesystem operations
Report filesystem disk space usage
Report filesystem disk space usage in human-readable output
Shows on which device the specified directory is mounted lsblk lsscsi
List information about all available block devices
List information about all SCSI devices blockdev --getbsz /dev/sda1 Get the block size of the specified partition sync Flush the buffer and commit all pending writes.
To improve performance of Linux filesystems, many write operations are buffered in RAM and written at once; writes are done in any case before unmount, reboot, or shutdown chroot /mnt/sysimage mknod /dev/sda
Start a shell with /mnt/sysimage as filesystem root.
Useful during system recovery when the machine has been booted from a removable media (which hence is defined as the filesystem root)
Create a directory allocating the proper inode.
Useful during system recovery when experiencing filesystem problems hdparm hdparm -g /dev/hda hdparm -i /dev/hda hdparm -tT /dev/hda hdparm -p 12 /dev/hda sdparm
Get/set drive parameters for SATA/IDE devices
Display drive geometry (cylinders, heads, sectors) of /dev/hda
Display identification information for /dev/hda
Perform disk read benchmarks on the /dev/hda drive
Reprogram IDE interface chipset of /dev/hda to mode 4. Use with caution!
Access drive parameters for SCSI devices
The UUID (Universal Unique Identifier) of a partition is a 128-bit hash number that is associated to the partition when it is initialized. blkid -U 652b786e-b87f-49d2-af23-8087ced0c667 blkid -L /boot
Print the name of the specified partition, given its UUID
Print the UUID of the specified partition, given its label findfs UUID=652b786e-b87f-49d2-af23-8087ced0c667 findfs LABEL=/boot
Print the name of the specified partition, given its UUID
Print the name of the specified partition, given its label e2label /dev/sda1 Print the label of the specified partition, given its name
Linux Quick Reference Guide 4 th ed. June 2016 © Daniele Raffo www.crans.org/~raffo
16/150
fsck device fsck fsck -As fsck -f /dev/sda1 fsck -y /dev/sda1 fsck.ext2 -c /dev/sda1 e2fsck -c /dev/sda1
/forcefsck
Filesystem maintenance
Filesystem maintenance
Check and repair a Linux filesystem. Warning: filesystem must be unmounted!
Corrupted files will be placed into the /lost+found of the partition.
The exit code returned is the sum of the following conditions:
0 No errors
1 File system errors corrected
2 System should be rebooted
4 File system errors left uncorrected
8 Operational error
16 Usage or syntax error
32 Fsck canceled by user
128 Shared library error
Fsck is a wrapper utility for the actual filesystem-specific checker commands: fsck.ext2 aka e2fsck fsck.ext3 aka e2fsck fsck.ext4 aka e2fsck fsck.msdos fsck.vfat
fsck.cramfs
Check and repair serially all filesystems listed in /etc/fstab
Force a filesystem check on /dev/sda1 even if it thinks is not necessary
During filesystem repair, do not ask questions and assume that the answer is always yes
Check a ext2 filesystem, running the badblocks command to mark all bad blocks and add them to the bad block inode so they will not be allocated to files or directories
If this file exists, a filesystem check is forced after next reboot (Red Hat) tune2fs options device tune2fs -l /dev/sda1 tune2fs -j /dev/sda1 tune2fs -C 7 /dev/sda1
Adjust tunable filesystem parameters on ext2/ext3/ext4 filesystems
List the contents of the filesystem superblock
Add a journal to this ext2 filesystem, making it a ext3
Set the mount count of the filesystem to 7 tune2fs -c 20 /dev/sda1 tune2fs -i 15d /dev/sda1
Set the filesystem to be checked by fsck after 20 mounts
Set the filesystem to be checked by fsck each 15 days
Both mount-count-dependent and time-dependent checking are enabled by default for all hard drives on Linux, to avoid the risk of filesystem corruption going unnoticed.
dumpe2fs options device dumpe2fs -h /dev/sda1 dumpe2fs /dev/sda1 | grep -i superblock dumpe2fs -b /dev/sda1
Dump ext2/ext3/ext4 filesystem information
Display filesystem's superblock information (e.g. number of mounts, last checks, UUID)
Display locations of superblock (primary and backup) of filesystem
Display blocks that are marked as bad in the filesystem resize2fs options device size debugfs device debugfs -w /dev/sda1
Resize an ext2/ext3/ext4 filesystem
Interactive ext2/ext3/ext4 filesystem debugger
Debug /dev/sda1 in read-write mode
(by default, debugfs accesses the device in read-only mode)
Many hard drives feature the Self-Monitoring, Analysis and Reporting Technology (SMART) whose purpose is to monitor the reliability of the drive, predict drive failures, and carry out different types of drive self-tests.
The smartd daemon attempts to poll this information from all drives every 30 minutes, logging all data to syslog. smartctl -a /dev/sda smartctl -s off /dev/sda
Print SMART information for drive /dev/sda
Disable SMART monitoring and log collection for drive /dev/sda smartctl -t long /dev/sda Begin an extended SMART self-test on drive /dev/sda
Linux Quick Reference Guide 4 th ed. June 2016 © Daniele Raffo www.crans.org/~raffo
17/150
xfs_growfs options mountpoint xfs_info /dev/sda1 xfs_growfs -n /dev/sda1 xfs_check options device xfs_repair options device xfsdump -v silent -f /dev/tape / xfsrestore -f /dev/tape / xfsdump -J - / | xfsrestore -J - /new
XFS, ReiserFS, CD-ROM fs
XFS, ReiserFS, CD-ROM fs
Expand an XFS filesystem (there must be at least one spare new disk partition available)
Print XFS filesystem geometry
Check XFS filesystem consistency
Repair a damaged or corrupt XFS filesystem
Dump the root of a XFS filesystem to tape, with lowest level of verbosity.
Incremental and resumed dumps are stored in the inventory database
/var/lib/xfsdump/inventory
Restore a XFS filesystem from tape
Copy the contents of a XFS filesystem to another directory (without updating the inventory database) reiserfstune options device debugreiserfs device
Adjust tunable filesystem parameters on ReiserFS filesystem
Interactive ReiserFS filesystem debugger mkisofs -r -o cdrom.img data/ Create a CD-ROM image from the contents of the target directory.
Enable Rock Ridge extension and set all content on CD to be public readable (instead of inheriting the permissions from the original files)
Filesystem
ISO9660
UDF (Universal Disk Format)
CD-ROM filesystems
Commands
mkisofs mkudffs
Create a ISO9660 filesystem
Create a UDF filesystem udffsck wrudf cdrwtool
Check a UDF filesystem
Maintain a UDF filesystem
Manage CD-RW drives (disk format, read/write speed, ...)
HFS (Hierarchical File System)
Rock Ridge
MS Joliet
El Torito
CD-ROM filesystem extensions
Contains the original file information (e.g. permissions, filename) for MS Windows 8.3 filenames
Used to create more MS Windows friendly CD-ROMs
Used to create bootable CD-ROMs
Linux Quick Reference Guide 4 th ed. June 2016 © Daniele Raffo www.crans.org/~raffo
18/150 AutoFS
AutoFS
AutoFS is a client-side service that permits automounting of filesystems, even for nonprivileged users.
AutoFS is composed of the autofs kernel module that monitors specific directories for attempts to access them; in this case, the kernel module signals the automount userspace daemon which mounts the directory when it needs to be accessed and unmounts it when is no longer accessed.
Mounts managed by AutoFS should not be mounted/unmounted manually or via /etc/fstab, to avoid inconsistencies.
/etc/sysconfig/autofs
/etc/auto.master
AutoFS configuration files
AutoFS configuration file
Master map file for AutoFS. Each line is an indirect map, and each map file stores the configuration for the automounting of the subdir.
# mount point map options
/net -hosts
/- /etc/auto.direct
/misc /etc/auto.misc
/home /etc/auto.home --timeout=60
The -hosts map tells AutoFS to mount/unmount automatically any export from the NFS server nfsserver when the directory /net/nfsserver/ is accessed.
/etc/auto.direct
/etc/auto.misc
/etc/auto.home
AutoFS map files
Direct map file for automounting of a NFS share.
# dir filesystem
/mydir nfsserver1.foo.org:/myshare
Indirect map file for automounting of directory /misc .
# subdir options filesystem public -ro,soft,intr ftp.example.org:/pub cd -fstype=iso9660,ro,nosuid,nodev :/dev/cdrom
Indirect map file for automounting of directory /home on a NFS share.
The * wildcard matches any subdir the system attempts to access, and the & variable takes the value of the match.
# subdir options filesystem
* -rw,soft,intr nfsserver2.bar.org:/home/&
Linux Quick Reference Guide 4 th ed. June 2016 © Daniele Raffo www.crans.org/~raffo
19/150 RAID
RAID
Level
RAID 0
RAID 1
RAID 4
RAID levels
Description
Striping (data is written across all member disks).
High I/O but no redundancy
Mirroring (data is mirrored on all disks).
High redundancy but high cost
Parity on a single disk.
I/O bottleneck unless coupled to write-back caching
RAID 5
RAID 6
Parity distributed across all disks.
Can sustain one disk crash
Double parity distributed across all disks.
Can sustain two disk crashes
RAID 10 (1+0) Striping + mirroring.
High redundancy but high cost
Linear RAID Data written sequentially across all disks.
No redundancy
Storage capacity
Sum of the capacity of member disks
Capacity of the smaller member disk
Sum of the capacity of member disks, minus one
Sum of the capacity of member disks, minus one
Sum of the capacity of member disks, minus two
Capacity of the smaller member disk
Sum of the capacity of member disks mdadm -C /dev/md0 -l 5 \
-n 3 /dev/sdb1 /dev/sdc1 /dev/sdd1 \
-x 1 /dev/sde1 mdadm --manage /dev/md0 -f /dev/sdd1 mdadm --manage /dev/md0 -r /dev/sdd1 mdadm --manage /dev/md0 -a /dev/sdd1 mdadm --misc -Q /dev/sdd1 mdadm --misc -D /dev/md0 mdadm --misc -o /dev/md0 mdadm --misc -w /dev/md0
/etc/mdadm.conf
cat /proc/mdstat
Create a RAID 5 array from three partitions and a spare.
Partitions type must be set to 0xFD.
Once the RAID device has been created, it must be formatted e.g. via mke2fs -j /dev/md0
Mark a drive as faulty, before removing it
Remove a drive from the RAID array.
The faulty drive can now be physically removed
Add a drive to the RAID array.
To be run after the faulty drive has been physically replaced
Display information about a device
Display detailed information about the RAID array
Mark the RAID array as readonly
Mark the RAID array as read & write
Configuration file for the mdadm command.
DEVICE /dev/sdb1 /dev/sdc1 /dev/sdd1 /dev/sde1
ARRAY /dev/md0 level=raid5 num-devices=3
UUID=0098af43:812203fa:e665b421:002f5e42
devices=/dev/sdb1,/dev/sdc1,/dev/sdd1,/dev/sde1
Display information about RAID arrays and devices
Linux Quick Reference Guide 4 th ed. June 2016 © Daniele Raffo www.crans.org/~raffo
20/150 Bootloader
LILO
(Linux Loader)
Bootloader
Non-GRUB bootloaders
Obsolete. Small bootloader that can be placed in the MBR or the boot sector of a partition.
The configuration file is /etc/lilo.conf (run /sbin/lilo afterwards to validate changes).
SYSLINUX Able to boot from FAT and NTFS filesystems e.g. floppy disks and USB drives.
Used for boot floppy disks, rescue floppy disks, and Live USBs.
ISOLINUX Able to boot from CD-ROM ISO 9660 filesystems.
Used for Live CDs and bootable install CDs.
The CD must contain the following files: isolinux/isolinux.bin
boot/isolinux/isolinux.cfg
images/ kernel/memdisk
ISOLINUX image, from the SYSLINUX distro
ISOLINUX configuration
Floppy images to boot
SYSLINUX
The CD can be burnt with the command: mkisofs -o output.iso -b isolinux/isolinux.bin -c isolinux/boot.cat \
-no-emul-boot -boot-load-size 4 -boot-info-table CD_root_dir
PXELINUX Able to boot from PXE (Pre-boot eXecution Environment). PXE uses DHCP or BOOTP to enable basic networking, then uses TFTP to download a bootstrap program that loads and configures the kernel.
Used for Linux installations from a central server or network boot of diskless workstations.
The boot TFTP server must contain the following files:
/tftpboot/pxelinux.0
/tftpboot/pxelinux.cfg/
PXELINUX image, from the SYSLINUX distro
Directory containing a configuration file for each machine.
A machine with Ethernet MAC address 88:99:AA:BB:CC:DD and IP address 192.0.2.91 (C000025B in hexadecimal) will search for its configuration filename in this order:
01-88-99-aa-bb-cc-dd
C000025B
C000025
C00002
C0000
C000
C00
C0
C default
EXTLINUX General-purpose bootloader like LILO or GRUB. Now merged with SYSLINUX.
Linux Quick Reference Guide 4 th ed. June 2016 © Daniele Raffo www.crans.org/~raffo
21/150 GRUB 2 configuration
GRUB 2 configuration
GRUB (Grand Unified Bootloader) is the standard boot manager on modern Linux distros. The latest version is GRUB 2; the older version is GRUB Legacy.
GRUB Stage 1 (446 bytes), as well as the partition table (64 bytes) and the boot signature (2 bytes), is stored in the 512byte MBR. It then accesses the GRUB configuration and commands available on the filesystem, usually on /boot/grub .
/boot/grub/grub.cfg or /boot/grub2/grub.cfg GRUB 2 configuration file
# Linux Red Hat menuentry "Fedora 2.6.32" { # Menu item to show on GRUB bootmenu set root=(hd0,1) # root filesystem is /dev/hda1 linux /vmlinuz-2.6.32 ro root=/dev/hda5 mem=2048M initrd /initrd-2.6.32
}
# Linux Debian menuentry "Debian 2.6.36-experimental" { set root=(hd0,1) linux (hd0,1)/bzImage-2.6.36-experimental ro root=/dev/hda6
}
# Windows menuentry "Windows" { set root=(hd0,2) chainloader +1
}
The GRUB 2 configuration file must not be edited manually. Instead, edit the files in /etc/grub.d/ (these are scripts that will be run in order) and the file /etc/default/grub (the configuration file for menu display settings), then run updategrub (Debian) or grub2-mkconfig (Red Hat) which will recreate this configuration file.
Common kernel parameters: root= ro quiet debug splash single emergency init=/bin/bash
Specify the location of the filesystem root. This is a required parameter
Mount read-only on boot
Disable non-critical kernel messages during boot
Enable kernel debugging
Show splash image
Boot in single-user mode (runlevel 1)
Emergency mode: after the kernel is booted, run sulogin (single-user login) which asks for the root password for system maintenance, then run a Bash. Does not load init or any daemon or configuration setting.
Run a Bash shell (may also be any other executable) instead of init
Linux Quick Reference Guide 4 th ed. June 2016 © Daniele Raffo www.crans.org/~raffo
22/150 GRUB 2 usage
GRUB 2 usage
The GRUB menu, presented at startup, permits to choose the OS or kernel to boot:
ENTER
Boot the currently selected GRUB entry
C
E
B
P
Get a GRUB command line
Edit the selected GRUB entry (e.g. to edit kernel parameters in order to boot in single-user emergency mode, or to change IRQ or I/O port of a device driver compiled in the kernel)
Boot the currently selected GRUB entry (this is usually done after finishing modifying it)
Bring up the GRUB password prompt (necessary if a GRUB password has been set) grub-install /dev/sda grub grub2-set-default 1 grub2-editenv list
Install GRUB on first SATA drive
Access the GRUB shell
Set GRUB to automatically boot the second entry in the GRUB menu
Display the current GRUB menu entry that is automatically booted
/boot/grub/device.map This file can be created to map Linux device filenames to BIOS drives:
(fd0) /dev/fd0
(hd0) /dev/hda
Linux Quick Reference Guide 4 th ed. June 2016 © Daniele Raffo www.crans.org/~raffo
23/150
blocklist file boot cat file chainloader file cmp file1 file2 configfile file debug displayapm displaymem embed stage device find file fstest geometry drive halt help command impsprobe initrd file install options ioprobe drive
GRUB Legacy
GRUB Legacy
GRUB Legacy shell commands
Print the block list notation of a file kernel file
Boot the loaded OS
Show the contents of a file lock makeactive
Chainload another bootloader
Compare two files
Load a configuration file
Toggle debugging mode map drive1 drive2 md5crypt module file modulenounzip file
Display APM BIOS information
Display memory configuration
Embed Stage 1.5 in the device
Find a file pause message quit reboot read address
Toggle filesystem test mode
Print information on a drive geometry
Shut down the system root device rootnoverify device savedefault
Show help for a command, or the available commands setup device
Probe the Intel Multiprocessor
Specification testload file
Load an initial ramdisk image file testvbe mode
Install GRUB (deprecated, use setup instead)
Probe I/O ports used for a drive uppermem kbytes vbeprobe mode
Load a kernel
Lock a GRUB menu entry
Set active partition on root disk to
GRUB's root device
Map a drive to another drive
Encrypt a password in MD5 format
Load a kernel module
Load a kernel module without decompressing it
Print a message and wait for a key press
Quit the GRUB shell
Reboot the system
Read a 32-bit value from memory and print it
Set the current root device
Set the current root device without mounting it
Save current menu entry as the default entry
Install GRUB automatically on the device
Test the filesystem code on a file
Test a VESA BIOS EXTENSION mode
Set the upper memory size (only for old machines)
Probe a VESA BIOS EXTENSION mode
/boot/grub/menu.lst or /boot/grub/grub.conf GRUB Legacy configuration file
timeout 10 # Boot the default kernel after 10 seconds default 0 # Default kernel is 0
# Section 0: Linux boot title Debian # Menu item to show on GRUB bootmenu root (hd0,0) # root filesystem is /dev/hda1 kernel /boot/vmlinuz-2.6.24-19-generic root=/dev/hda1 ro quiet splash initrd /boot/initrd.img-2.6.24-19-generic
# Section 1: Windows boot title Microsoft Windows XP root (hd0,1) # root filesystem is /dev/hda2 savedefault makeactive # set the active flag on this partition chainloader +1 # read 1 sector from start of partition and run
# Section 2: Firmware/BIOS update from floppy disk title Firmware update kernel /memdisk # boot a floppy disk image initrd /floppy-img-7.7.7
Linux Quick Reference Guide 4 th ed. June 2016 © Daniele Raffo www.crans.org/~raffo
24/150
Low-level package managers
Install a package file
Remove a package
Upgrade a package
(and remove old versions)
Upgrade a package
(only if an old version is already installed)
List installed packages and their state
List installed packages and their installation date, from newest to oldest
List the content of an installed package
List the content of a package file
Show the package containing a specific file
Verify an installed package
Reconfigure a package
Install a package source file
Compile a package source file
Debian
dpkg -i package.deb dpkg -r package dpkg -l dpkg -L package dpkg -c package.deb dpkg -S file dpkg-reconfigure package
Low-level package managers
Low-level package managers
Red Hat
rpm -i package.rpm rpm -i ftp://host/package.rpm rpm -i http://host/package.rpm rpm -e package rpm -U package.rpm rpm -F package.rpm rpm -qa rpm -qa --last rpm -ql package rpm -qpl package.rpm rpm -qf file rpm -V package rpm -i package.src.rpm rpm -ba package.spec
Linux Quick Reference Guide 4 th ed. June 2016 © Daniele Raffo www.crans.org/~raffo
25/150 High-level package managers
High-level package managers
Install a package
Install a package file
Debian
apt-get install package
High-level package managers
Red Hat
yum install package yum install package.rpm yum localinstall package.rpm yum remove package Remove a package
Upgrade an installed package
Upgrade all installed packages
Upgrade all installed packages and handle dependencies with new versions
Replace a package with another
Get the source code for a package
Check for broken dependencies and update package cache
Fix broken dependencies
Update information on available packages
List all installed and available packages
List installed and available packages that match the search term
List installed packages
List packages available for install
Search for a package
Show package dependencies
Show package records
Show information about a package
Update information about package contents
List the content of an uninstalled package apt-get remove package apt-get upgrade apt-get dist-upgrade apt-get source package apt-get check apt-get install -f apt-get update apt-cache search package apt-cache depends package apt-cache show package apt-cache showpkg package apt-file update apt-file list package yum update package yum update yum swap packageout packagein yum list yum list searchterm yum list installed yum list available yum search package yum deplist package yum list package yum info package
Show which package provides a specific file
Add a CD-ROM to the sources list
Download package and all its dependencies
Show URLs that would be downloaded
Try to complete unfinished or aborted package installations apt-file search file apt-cdrom add yum whatprovides file yumdownloader --resolve package yumdownloader --urls package yum-complete-transaction
Print list of available repositories cat /etc/apt/sources.list
yum repolist cat /etc/yum.repos.d/*.repo
Package format compressed with ar compressed with cpio
High-level package managers are able to install remote packages and automatically solve dependencies.
GUI package managers
Manage packages and dependencies.
These package managers have a graphical or text-based UI aptitude dselect synaptic
Debian
pirut
Red Hat
Linux Quick Reference Guide 4 th ed. June 2016 © Daniele Raffo www.crans.org/~raffo
26/150 Package management tools
Package management tools
Red Hat Package management tools
Convert a RPM package to DEB and install it.
Might break the package system!
Convert a RPM package to cpio archive
Add a key to the list of keys used to authenticate packages
Register a system to the RHSM (Red Hat
Subscription Management) portal
Attach a RHSM subscription to a registered system
Debian
alien -i package.rpm apt-key add keyfile rpm2cpio package.rpm subscription-manager register subscription-manager attach
[fedora]
/etc/yum.repos.d/fedora.repo Configuration file for a specific "Fedora" repository
Repository ID name=Fedora $releasever - $basearch Repository name baseurl=http://download.fedoraproject.org/pub/fedora/linux/\ releases/$releasever/Everything/$basearch/os/
http://foo.org/fedora/$releasever/$basearch/
http://bar.org/fedora/$releasever/$basearch/ enabled=1 gpgcheck=1 failovermethod=priority
List of URLs to the repository's repodata directory. Can be any of these types: file:/// local file file:// NFS http:// HTTP https:// HTTPS ftp:// FTP
Whether this repository is enabled
Whether to perform a GPG signature check on the packages downloaded from this repository
Makes yum try the baseurls in the order they're listed. By default, if more than one baseurl is specified, yum chooses one randomly metalink=https://mirrors.fedoraproject.org/metalink?repo=\ fedora-$releasever&arch=$basearch gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-\
$releasever-$basearch
URL to a metalink file that specifies the list of mirrors to use. Can be used with or in alternative to a baseurl
ASCII-armored GPG public key file of the repository
The command man yum.conf shows more configuration options.
Linux Quick Reference Guide 4 th ed. June 2016 © Daniele Raffo www.crans.org/~raffo
27/150
dd if=/dev/sda of=/dev/sdb dd if=/dev/sda1 of=sda1.img
dd if=/dev/cdrom of=cdrom.iso bs=2048 dd if=install.iso of=/dev/sdc bs=512k
Backup
Copy the content of one hard disk over another, byte by byte
Create the image of a partition
Create an ISO file from a CD-ROM, using a block size of 2 Kb
Write an installation ISO file to a device (e.g. a USB thumb drive)
Backup
rsync -rzv /home /tmp/bak rsync -rzv /home/ /tmp/bak/home rsync -avz /home [email protected]:/backup/
Synchronize the content of the home directory with the temporary backup directory. Use recursion, compression, and verbosity.
For all transfers subsequent to the first, rsync only copies the blocks that have changed, making it a very efficient backup solution in terms of speed and bandwidth
Synchronize the content of the home directory with the backup directory on the remote server, using SSH. Use archive mode (operates recursively and preserves owner, group, permissions, timestamps, and symlinks)
cpio gzip bzip2 rar tar star
ls | cpio -o > myarchive.cpio
ls | cpio -oF myarchive.cpio
find /home/ | cpio -o > homedirs.cpio
cpio -id < myarchive.cpio
Archive formats
Create a cpio archive of all files in the current directory
Create a cpio archive of all users' home directories
Extract all files, recreating the directory structure cpio -i -t < myarchive.cpio
gzip myfile gunzip myfile.gz
gunzip -tv myfile.gz
zcat myfile.gz
List the contents of a cpio archive file without extracting it
Compress a file with gzip
Decompress a gzip-compressed file
Test the integrity of a gzip-compressed file
Output to stdin a gzip-compressed text file zgrep mypattern myfile.gz
grep for a gzip-compressed text file zless myfile.gz
less for a gzip-compressed text file zmore myfile.gz
bzip2 myfile bunzip2 myfile.bz2
bzcat myfile.bz2 rar a myarc.rar mydir/ unrar x myarc.rar
tar cvf myarc.tar mydir/ tar cvzf myarc.tar.gz mydir/ tar xvzf myarc.tar.gz
tar cvjf myarc.tar.bz2 mydir/ tar xvjf myarc.tar.bz2
tar cvJf myarc.tar.xz mydir/ tar xvJf myarc.tar.xz
tar tvf myarc.tar
star -c -f=myarc.star mydir/ star -x -f=myarc.star
more for a gzip-compressed text file
Compress a file with bzip2
Decompress a bzip2-compressed file
Read a bzip2-compressed text file
Create a RAR archive
Extract a RAR archive
Create a tarred archive
Create a tarred gzip-compressed archive
Extract a tarred gzip-compressed archive
Create a tarred bzip2-compressed archive
Extract a tarred bzip2-compressed archive
Create a tarred xz-compressed archive
Extract a tarred xz-compressed archive
List the contents of the tarred archive without extracting it
Create a star archive
Extract a star archive
Linux Quick Reference Guide 4 th ed. June 2016 © Daniele Raffo www.crans.org/~raffo
28/150
Devices
Utility for magnetic tapes
Utility for tape libraries
Tape libraries
Tape libraries
Tape libraries
/dev/st0
/dev/nst0 mt -f /dev/nst0 asf 3 mtx -f /dev/sg1 status mtx -f /dev/sg1 load 3 mtx -f /dev/sg1 unload mtx -f /dev/sg1 transfer 3 4 mtx -f /dev/sg1 inventory mtx -f /dev/sg1 inquiry
First SCSI tape device
First SCSI tape device (no-rewind device file)
Position the tape at the start of 3 rd file
Display status of tape library
Load tape from slot 3 to drive 0
Unload tape from drive 0 to original slot
Transfer tape from slot 3 to slot 4
Force robot to rescan all slots and drives
Inquiry about SCSI media device
(Medium Changer = tape library)
Linux Quick Reference Guide 4 th ed. June 2016 © Daniele Raffo www.crans.org/~raffo
29/150
man command man 7 command man man whatis command apropos keyword apropos -r regex man -k regex man -K regex info command history
!n history -c history -d n watch command watch -d -n 1 command timeout 30s command time command
command | ts sleep 5 usleep 5000
Command line
Show the man page for a command
Show section 7 of the command man page
Show information about man pages' sections:
1 Executable programs or shell commands
2 System calls (functions provided by the kernel)
3 Library calls (functions within program libraries)
4 Special files
5 File formats and conventions
6 Games
7 Miscellaneous
8 System administration commands (usually only for root)
9 Kernel routines
Show the man page's short description for a command
Show the commands whose man page's short description matches the keyword.
Inverse of the whatis command
Show the commands whose man page's short description matches the regex
Command line
Show the commands whose man page's full text matches the regex
Show the Info documentation for a command
Show the history of command lines executed up to this moment.
Commands prepended by a space will be executed but will not show up in the history.
After the user logs out from Bash, history is saved into ~/.bash_history
Execute command number n in the command line history
Clear the command line history
Delete command number n from the command line history
Execute command every 2 seconds
Execute command every second, highlighting the differences in the output
Execute command and kill it after 30 seconds
Execute command and print its execution time: elapsed real time between invocation and termination, user CPU time, and system CPU time
Prepend a timestamp to each line of the output of command
Pause for 5 seconds
Pause for 5000 microseconds
Almost all Linux commands accept the option -v (verbose), and many commands also accept the option -vv (very verbose).
Linux Quick Reference Guide 4 th ed. June 2016 © Daniele Raffo www.crans.org/~raffo
30/150
/etc/machine-id rm /etc/machine-id && \ systemd-machine-id-setup
System information
Randomly-generated machine ID (Red Hat)
Initialize the machine ID (Red Hat) cat /etc/debian_version (Debian) cat /etc/fedora-release (Fedora) cat /etc/redhat-release (Red Hat) cat /etc/lsb-release lsb_release -a
Show the version of the current Linux distribution
System information
Linux Quick Reference Guide 4 th ed. June 2016 © Daniele Raffo www.crans.org/~raffo
31/150
cat file cat file1 file2 > file3 cat > file <<EOF
line 1 line 2 line 3
EOF tac file head file head -n 10 file tail file tail -n 10 file tail -f file column file fmt -w 75 file pr file nl file wc file join file1 file2 paste file1 file2 split -l 1 file uniq file sort file expand file unexpand file od file diff file1 file2 grep foo file grep -v foo file grep -e foo -e bar file grep -E 'foo|bar' file grep -v -e foo -e bar file grep -E regex file egrep regex file
Text filters
Text filters
Print a text file
Concatenate text files
Create a Here Document, storing the lines entered in input to a file
Print or concatenate text files in reverse, from last line to first line
Print the first 10 lines of a text file
Print the last 10 lines of a text file
Output appended data as the text file grows; useful to read logs in realtime
Format a text file into columns
Format a text file so that each line has a max width of 75 chars
Format a text file for a printer
Prepend line numbers to a text file
Print the number of lines, words, and bytes of a text file
Join lines of two text files on a common field
Merge lines of text files
Split a text file into 1-line files (named xaa, xab, xac, and so on)
Print the unique lines of a text file, omitting consecutive identical lines
Sort alphabetically the lines of a text file
Convert tabs into spaces
Convert spaces into tabs
Dump a file into octal (or other formats)
Compare two files line by line and print the differences
Print the lines of a file containing foo
Print the lines of a file not containing foo
Print the lines of a file containing foo or bar
Print the lines of a file containing neither foo nor bar
Print the lines of a file matching the given Extended Regex
Linux Quick Reference Guide 4 th ed. June 2016 © Daniele Raffo www.crans.org/~raffo
32/150
cut -d: -f3 file cut -d: -f1 /etc/passwd cut -c3-50 file sed 's/foo/bar/' file sed -i 's/foo/bar/' file sed 's/foo/bar/g' file sed '0,/foo/s//bar/' file sed -n '7,13p' file sed "s/foo/$var/" file tr a-z A-Z <file tr [:lower:] [:upper:] <file tr -d 0-9 <file tr -d [:digit:] <file
cut, sed, tr
cut, sed, tr
Cut the lines of a file, considering : as the delimiter and printing only the 3 rd
field
Print the list of user accounts in the system
Print character 3 to 50 of each line of a file
Stream Editor: Replace the first occurrence on a line of foo with bar in file, and print on stdout the result
Replace foo with bar, overwriting the results in file
Replace all occurrences of foo with bar
Replace only the first line match
Print line 7 to 13 of a text file
Replace foo with the value of variable $var.
The double quotes allow for variable expansion
Translate characters: Convert all lowercase into uppercase in a text file
Delete all digits from a text file
Linux Quick Reference Guide 4 th ed. June 2016 © Daniele Raffo www.crans.org/~raffo
^
$
\< \>
.
+
?
[abc]
[a-z]
[^abc]
*
{5}
{5,}
{5,10}
|
( )
33/150 Regular expressions
Regular expressions
Beginning of a line
End of a line
Word boundaries (beginning of line, end of line, space, or punctuation mark)
Any character, except newline
Any of the characters specified
Any of the characters in the specified range
Any character except those specified
Zero or more times the preceding regex
One or more times the preceding regex
Zero or one time the preceding regex
Exactly 5 times the preceding regex
5 times or more the preceding regex
Between 5 and 10 times the preceding regex
The regex either before or after the vertical bar
Grouping, to be used for back-references. \1 expands to the 1 st match, \2 to the 2 nd , and so on until \9
The symbols above are used in POSIX EREs (Extended Regular Expressions). For POSIX BREs (Basic Regular Expressions), it will be necessary to escape certain symbols.
Linux Quick Reference Guide 4 th ed. June 2016 © Daniele Raffo www.crans.org/~raffo
34/150
cp myfile myfile2 cp myfile mydir/ cp -ar /root/mydir/. /opt/ mv myfile myfile2 mv myfile mydir/ rm myfile pv myfile > myfile2 mkdir mydir mkdir -m 755 mydir mkdir -p /tmp/mydir1/mydir2 rmdir mydir touch myfile ls ls -d */ tree stat myfile stat -c %A myfile stat -c %s myfile lsof lsof -u jdoe lsof -i lsof -i :80 lsof [email protected]
lsof [email protected]:80 lsof -c mysqld lsof /var/lib/mysql/mysqld.pid
Copy a file
Copy a file to a directory
Copy a directory recursively
Rename a file
Move a file to a directory
Delete a file
File management
File management
Common options:
-i Prompt before overwriting/deleting files
(interactive)
-f Don't ask before overwriting/deleting files
(force)
Copy a file, monitoring the progress of data through the pipe
Create a directory
Create a directory with 755 permission
Create a directory, creating also the parent directories if they don't exist
Delete a directory (must be empty)
Change access/modification timestamp on a file, creating it if it doesn't exist
List the contents of the current directory
List directories only
List directories and their contents in hierarchical format
Display file or filesystem status
Display file permissions
Display file size, in bytes
List all open files
List all files currently open by user jdoe
List open files and their sockets (equivalent to netstat -ap)
List connections of local processes on port 80
List connections of local processes to remote host 10.0.0.3
List connections of local processes to remote host 10.0.0.3 on port 80
List all files opened by the MySQL daemon
List all processes using a specific file
*
?
[kxw]
File-naming wildcards (globbing)
Matches zero or more characters
Matches one character
Matches k, x, or w
[!kxw] Matches any character except k, x, or w
[a-z] Matches any character between a and z cp myfile.{txt,bak}
Brace expansion
Copy myfile.txt to myfile.bak
touch myfile_{a,b,c} touch {a..h}
Create myfile_a, myfile_b, myfile_c
Create 8 files named a b c d e f g h
Linux Quick Reference Guide 4 th ed. June 2016 © Daniele Raffo www.crans.org/~raffo
35/150 I/O streams
In Linux, everything is (displayed as) a file. File descriptors are automatically associated to any process launched.
I/O streams
# Name
0
1
2
Standard input (stdin)
Standard output (stdout)
Standard error (stderr)
File descriptors
Type
Input text stream
Output text stream
Output text stream
Default device
Keyboard
Terminal
Terminal
Device file
/dev/stdin
/dev/stdout
/dev/stderr cat /etc/passwd | wc -l ls > file ls 1> file ls >| file ls >> file ls 1>> file df 2> file df 2>> file df 2> /dev/null mail [email protected] < file
Pipe the stdout of command cat to the stdin of command wc (hence printing the number of accounts in the system). Note: piped commands run concurrently
Redirect the stdout of command ls to a file (hence writing on a file the content of the current directory). File is overwritten if it already exists, unless the Bash noclobber option is set (via set -o noclobber)
Redirect the stdout of command ls to a file, even if noclobber is set
Append the stdout of command ls to a file ls 2>&1 ls > file 2>&1 ls &> file ls >& file
> file ls | tee file ls | tee -a file ls foo* | xargs cat
Redirect the stderr of command df to a file (hence writing any error encountered by the command df to a file)
Append the stderr of command df to a file
Silence any error coming from command df
Redirect a file to the stdin of command mail (hence sending via e-mail a file to the specified email address)
Redirect stderr of command ls to stdout
Redirect both stdout and stderr of command ls to a file
Redirect both stdout and stderr of command ls to a file. Non-POSIX standard and therefore not recommended
Create an empty file tee reads from stdin and writes both to stdout and a file (hence writing content of current directory to screen and to a file at the same time) tee reads from stdin and appends both to stdout and a file xargs calls the cat command multiple times for each argument found on stdin
(hence printing the content of every file whose filename starts by foo)
Linux Quick Reference Guide 4 th ed. June 2016 © Daniele Raffo www.crans.org/~raffo
36/150
Process a text file line by line, reading from a file.
If file is /dev/stdin, reads from standard input instead
read and echo
read and echo
while read -r line do
echo "Hello $line" done < file read MYVAR read -n 8 MYVAR read -t 60 MYVAR read -s MYVAR
Read a variable from standard input
Read only max 8 chars from standard input
Read a variable from standard input, timing out after one minute
Read a variable from standard input without echoing to terminal (silent mode)
Print a variable on screen
Print onscreen without a trailing line feed echo $MYVAR echo -n "message" printf "message" echo -e '\a' Produce an alert sound (BEL sequence) pv -qL10 <<< "Hello world" Print onscreen one character at a time
Linux Quick Reference Guide 4 th ed. June 2016 © Daniele Raffo www.crans.org/~raffo
37/150 Processes
Processes
Any application, program, or script that runs on the system is a process. Signals are used for inter-process communication.
Each process has an unique PID (Process ID) and a PPID (Parent Process ID); when a process spawns a child, the process
PID is assigned to the child's PPID.
The /sbin/init process, run at bootup, has PID 1. It is the ancestor of all processes and becomes the parent of any orphaned process. It is also unkillable; should it die, the kernel will panic.
When a child process dies, its status becomes EXIT_ZOMBIE and a SIGCHLD is sent to the parent. The parent should then call the wait() system call to read the dead process' exit status and other info; until that moment, the child process remains a zombie. ps -ef (UNIX options) ps aux (BSD options) pstree PID pidof process top htop ipcs kill -9 1138 killall -9 sshd pgrep -u root sshd pkill -9 -u root sshd jobs
CTRL bg %1 fg %1 kill %1
Z
List all processes
Display all processes in hierarchical format.
The process tree is rooted at PID, or at init if PID is omitted
Show PID of process
Monitor processes in realtime
Monitor processes in realtime (ncurses UI)
Show IPC facilities information (shared memory, message queues, and semaphores)
Send a signal 9 (SIGKILL) to process 1138, hence killing it
Kill processes whose name is sshd
Show processes whose name is sshd and are owned by root
Kill processes whose name is sshd and are owned by root
Note: pgrep and pkill accept the same options
List all jobs (i.e. processes whose parent is a Bash shell)
Suspend a job, putting it in the stopped state (send a SIGTSTP)
Put job #1 in the background (send a SIGCONT)
Resume job #1 in the foreground and make it the current job (send a SIGCONT)
Kill job #1
When a Bash shell is terminated cleanly via exit, its jobs will became child of the Bash's parent and will continue running.
When a Bash is killed instead, it issues a SIGHUP to his children which will terminate. nohup myscript.sh
Prevent a process from terminating (receiving a SIGHUP) when its parent Bash dies
To each process is associated a niceness value: the higher the niceness, the lower the priority.
The niceness value ranges from -20 to 19, and a newly created process has a default niceness of 0.
Unprivileged users can modify a process' niceness only within the range from 1 to 19.
nice -n -5 command renice -5 command
Start a command with a niceness of -5. If niceness is omitted, a default value of 10 is used
Change the niceness of a running command to -5 strace command Trace the execution of a command, intercepting and printing the system calls called by a process and the signals received by a process
( command )& pid=$!; sleep n; kill -9 $pid
:(){ :|:& };:
Run a command and kill it after n seconds
Fork bomb. Don't try this at home!
Linux Quick Reference Guide 4 th ed. June 2016 © Daniele Raffo www.crans.org/~raffo
38/150
Most frequently used signals
Signal number Signal name Meaning
1
2
SIGHUP
SIGINT
Used by many daemons to reload their configuration
Interrupt, stop
9
15
18
20
SIGKILL
SIGTERM
SIGCONT
SIGTSTP
Kill unconditionally (this signal cannot be ignored)
Terminate gracefully
Continue execution
Stop execution
Signals
Signals
man 7 signal kill -l kill -l n trap action condition
Display the man page about signals
List all available signal names
Print the name of signal number n
Trap a signal
Linux Quick Reference Guide 4 th ed. June 2016 © Daniele Raffo www.crans.org/~raffo
39/150
vmstat iostat mpstat vmstat 2 5 iostat 2 5 mpstat 2 5 iotop free uptime
Resource monitoring
Resource monitoring
Print a report about virtual memory statistics: processes, memory, paging, block I/O, traps, disks, and CPU activity
Print a report about CPU utilization, device utilization, and network filesystem.
The first report shows statistics since the system boot; subsequent reports will show statistics since the previous report
Print a report about processor activities
Print the relevant report every 2 seconds, for 5 times time command sar sar -n DEV sar -f /var/log/sa/s19 \
-s 06:00:00 -e 06:30:00 powertop sysbench
Display I/O usage by processes in the system
Show the amount of free and used memory in the system
Show how long the system has been up, how many users are connected, and the system load averages for the past 1, 5, and 15 minutes
Execute command and, at its completion, write to stderr timing statistics about the run i.e. elapsed real time, user CPU time, system CPU time
Show reports about system activity.
Reports are generated from data collected via the cron job sysstat and stored in
/var/log/sa/sn, where n is the day of the month
Show reports about network activity (received and transmitted packets per second)
Show reports for system activity from 6 to 6:30 AM on the 19 th of the month
Power consumption and power management diagnosis tool
Multithreaded benchmark tool able to monitor different OS parameters: file I/O, scheduler, memory allocation, thread implementation, databases collectd
Nagios
MRTG
Cacti
Munin
Zabbix
Centreon
Linux monitoring tools
System statistics collector
System monitor and alert
Network load monitor
Network monitor
System and network monitor and alert
System and network monitor and alert
System and network monitor and alert
Linux Quick Reference Guide 4 th ed. June 2016 © Daniele Raffo www.crans.org/~raffo
40/150 vmstat and free
vmstat and free
procs memory swap io system cpu
Output of command vmstat
procs -----------memory---------- ---swap-- -----io---- --system-- -----cpu-----
r b swpd free buff cache si so bi bo in cs us sy id wa st
0 0 0 296724 267120 3393400 0 0 17 56 0 3 2 2 95 1 0
r b swpd free buff cache si so bi bo in cs us sy id wa st
Number of runnable processes (running or waiting for run time)
Number of processes in uninterruptible sleep
Virtual memory used (swap)
Free memory (idle)
Memory used as buffers
Memory used as cache
Memory swapped in from disk
Memory swapped out to disk
Blocks received in from a block device
Blocks sent out to a block device
Number of interrupts
Number of context switches
Time spent running user code (non-kernel)
Time spent running system code (kernel)
Time spent idle
Time spent waiting for I/O
Time stolen from a virtual machine in Kb in Kb/second in blocks/second per second in percentage of total CPU time
Output of command free
total used free shared buff/cache available
Mem: 16344088 2273312 11531400 776228 2539376 12935112
Swap: 1048572 0 1048572
total used free shared buffers cached
Mem: 1504544 1491098 13021 0 91112 764542
-/+ buffers/cache: 635212 869498
Swap: 2047686 7667 2040019
Mem
-/+ buffers/cache total used free shared buff/cache available used free
Total configured amount of memory
Used memory
Unused memory
Memory used by tmpfs, 0 if not available
Memory used by kernel buffers, page cache, and slabs
Memory available for new applications (without using swap) *
Memory used by kernel buffers
Memory available for new applications (without using swap) *
Swap total used
Total configured amount of swap space
Used swap space
free
Free swap space *
* These are the true values indicating the free system resources available. All values are in Kb, unless options are used.
Linux Quick Reference Guide 4 th ed. June 2016 © Daniele Raffo www.crans.org/~raffo
41/150
- r w x r w x r w x
File permissions
File permissions
- = regular file d = directory l = symbolic link s = Unix domain socket p = named pipe c = character device file r = read w = write x = execute s = setUID and execute r = read w = write x = execute s = setGID and execute r = read w = write x = execute t = sticky and execute
Permission
Read
Write
Execute
SetUID (SUID)
SetGID (SGID)
Sticky
Octal value Command
user: 400 chmod u+r group: 40 others: 4 chmod g+r chmod o+r user: 200 chmod u+w group: 20 others: 2 chmod g+w chmod o+w user: 100 chmod u+x group: 10 chmod g+x others: 1 chmod o+x
4000 chmod u+s
2000 chmod g+s
1000 chmod +t
Effect on file
Can open and read the file
Can modify the file
Effect on directory
Can list directory content
Can create, delete, and rename files in the directory
Can execute the file (binary or script)
Can enter the directory, and search files within (by accessing a file's inode)
Executable is run with the privileges of the file's owner
Executable is run with the privileges of the file's group
No effect
No effect
All new files and subdirectories inherit the directory's group ID
Files inside the directory can be deleted or moved only by the file's owner chmod 710 file chmod u=rwx,g=x file chmod 660 file chmod ug=rw file chmod +wx file chmod -R o+r file chmod o-x file
Set read, write, and execute permission to user; set execute permission to group
Set read and write permission to user and group
Add write and execute permission to everybody (user, group, and others)
Add recursively read permission to others
Remove execute permission from others chown root file chown root:mygroup file umask 022
Change the owner of file to root
Change the owner of file to root, and the group of file to mygroup chgrp mygroup file
Change the group of file to mygroup
The chmod, chown, and chgrp commands accept the option -R to recursively change properties of files and directories.
Set the permission mask to 022, hence masking write permission for group and others.
Linux default permissions are 0666 for files and 0777 for directories. These base permissions are
ANDed with the inverted umask value to calculate the final permissions of a new file or directory.
Linux Quick Reference Guide 4 th ed. June 2016 © Daniele Raffo www.crans.org/~raffo
42/150 File attributes
File attributes
chattr +mode file chattr -mode file chattr =mode file lsattr file
Add a file or directory attribute
Remove a file or directory attribute
Set a file or directory attribute, removing all other attributes
List file or directory attributes
X
Z i
I
E h t
T u
D e j
N
Mode Effect
a
A c
C d
File can only be open in append mode for writing
When file is accessed, its atime record is not modified
File is automatically compressed on-the-fly on disk by the kernel
File is not subject to copy-on-write updates (only for filesystems which perform copy-on-write)
File will not be backed up by the dump program s
S
When directory is modified, changes are written synchronously on disk (equivalent to dirsync mount option)
File is using extents for mapping the blocks on disk
Compression error on file (attribute used by experimental compression patches)
File is storing its blocks in units of filesystem blocksize instead of in units of sectors, and was larger than 2 Tb
File is immutable: cannot be modified, linked, or changed permissions
Directory is being indexed using hashed trees
All file data is written to the ext3 or ext4 journal before being written to the file itself
File has data stored inline within the inode itself
File will be securely wiped by zeroing when deleted
When file is modified, changes are written synchronously on disk (equivalent to sync mount option)
File won't have EOF partial block fragment merged with other files (only for filesystems supporting tail-merging)
Directory is the top of directory hierarchies for the purpose of the Orlov block allocator
After file is deleted, it can be undeleted
Raw contents of compressed file can be accessed directly (attribute used by experimental compression patches)
Compressed file is dirty (attribute used by experimental compression patches)
Linux Quick Reference Guide 4 th ed. June 2016 © Daniele Raffo www.crans.org/~raffo
43/150 ACLs
Access Control Lists (ACLs) provide a fine-grained set of permissions that can be applied to files and directories.
An access ACL is set on an individual file or directory; a default ACL is set on a directory, and applies to all files and subdirs created inside it that don't have an access ACL.
The final permissions are the intersection of the ACL with the chmod/umask value.
A partition must have been mounted with the acl option in order to support ACLs on files.
ACLs
setfacl -m u:user:permissions file setfacl -m g:group:permissions file setfacl -m m:permissions file setfacl -m o:permissions file
Set an access ACL on a file for an user
Set an access ACL on a file for a group
Set the effective rights mask on a file
Set the permissions on a file for other users setfacl -x u:user file setfacl -x g:group file
Remove an access ACL from a file for an user
Remove an access ACL from a file for a group
The permissions are standard Unix permissions specified as any combination of r w x .
setfacl -m d:u:user:permissions dir setfacl -d -m u:user:permissions dir
As above, but set a default ACL instead of an access ACL.
This applies to all commands above getfacl file getfacl file1 | setfacl --set-file=- file2 getfacl --access dir | setfacl -d -M- dir chacl options man acl
Display the access (and default, if any) ACL for a file
Copy the ACL of file1 and apply it to file2
Copy the access ACL of a directory and set it as default ACL
Change an ACL. This is an IRIX-compatibility command
Show the manpage about ACLs
Linux Quick Reference Guide 4 th ed. June 2016 © Daniele Raffo www.crans.org/~raffo
44/150 Links
A Linux directory contains a list of structures which are associations between a filename and an inode.
An inode contains all file metadata: file type, permissions, owner, group, size, access/change/modification/deletion times, number of links, attributes, ACLs, and address where the actual file content (data) is stored.
An inode does not contain the name of the file; this information is stored in the directory where the file is.
Links
ls -i df -i
Show a listing of the directory with the files' inode numbers
Report filesystem inode usage
Definition
Command to create it
Link is still valid if the original file is moved or deleted
Can link to a file in another filesystem
Can link to a directory
Link permissions
Link attributes
Inode number
Hard link
A link to an already existing inode ln file hardlink
Yes (because the link references the inode the original file pointed to)
No (because inode numbers make sense only within a determinate filesystem)
No
Reflect the original file's permissions, even when these are changed
- (regular file)
The same as the original file
Soft or symbolic link
A path to a filename; a shortcut ln -s file symlink
No (because the path now references a non-existent file)
Yes
Yes rwxrwxrwx l (symbolic link)
A new inode number
Linux Quick Reference Guide 4 th ed. June 2016 © Daniele Raffo www.crans.org/~raffo
45/150
find / -name "foo*" find / -name "foo*" -print find / -name "foo*" -exec chmod 700 {} \; find / -name "foo*" -ok chmod 700 {} \; find / -size +128M find / -perm -4000 -type f find / -perm -2000 -type f find /home/jdoe/path -type f \
-newermt "May 4 14:50" -delete locate ls slocate ls updatedb which command which -a command whereis command whereis -b command whereis -s command whereis -m command type command file myfile strings myfile
Find system files
Find system files
Find all files, starting from the root dir, whose name start with foo
Find all files whose name start with foo and apply permission 700 to all of them
Find all files whose name start with foo and apply permission 700 to all of them, asking for confirmation before each file
Find all files larger than 128 Mb
Find all files with SUID set
(a possible security risk, because a shell with SUID root is a backdoor)
Find all files with SGID set
Find and delete all files newer than the specified datetime
Locate the command ls by searching the file index, not by actually walking the filesystem. The search is quick but will only held results relative to the last rebuilding of the file index (/etc/updatedb.conf)
Build the file index (/etc/updatedb.conf)
Locate a binary executable command within the PATH
Locate all matches of a command, not only the first one
Locate the binary, source, and manpage files for a command
Locate the binary files for a command
Locate the source files for a command
Locate the manpage files for a command
Determine if a command is a program or a builtin (i.e. an internal feature of the shell)
Analyze the content of a file or directory, and tell which kind of file it is
Print all printable character sequences, at least 4 characters long, that are inside a file
Linux Quick Reference Guide 4 th ed. June 2016 © Daniele Raffo www.crans.org/~raffo
46/150
Bash shell event
When a login shell is launched
When a login shell exits
When a non-login shell is launched
Shell environment
Files run
/etc/profile
~/.bash_profile
~/.bash_login
~/.profile
~/.bash_logout
/etc/bash.bashrc
/etc/bashrc
~/.bashrc
The shell executes the system-wide profile file, then the first of the 3 user files that exists and is readable
Shell environment
set -o set -option set -o long_option set +option set +o long_option set -v set -o verbose set -x set -o xtrace typeset -f alias ls='ls -lap' alias unalias ls
\ls
/bin/ls cd directory cd pwd pushd directory popd
Show the status of all Bash options
Enable a Bash option
Disable a Bash option
Enable printing of shell input lines as they are read
Enable printing of command traces before execution of each command
Show functions defined in the current Bash session
Set up an alias for the ls command
Show defined aliases
Remove the alias for the ls command
Run the non-aliased version of the ls command
Change to the specified directory
Change to the previously used directory
Print the current working directory
Add a directory to the top of the directory stack and make it the current working directory
Remove the top directory from the directory stack and change to the new top directory
.
..
~
~jdoe
~-
Bash directory shortcuts
Current directory
Parent directory
Home directory of current user
Home directory of user jdoe
Previously used directory
Linux Quick Reference Guide 4 th ed. June 2016 © Daniele Raffo www.crans.org/~raffo
47/150
set env
MYVAR=value
((MYVAR=value)) echo $MYVAR echo ${MYVAR}
MYVAR=$((MYVAR+1))
((MYVAR=MYVAR+1))
((MYVAR+=1))
((MYVAR++)) let "MYVAR=MYVAR+1" let "MYVAR+=1" let MYVAR++
MYVAR=`expr $MYVAR + 1`
MYVAR=`date`
MYVAR=$(date) for i in $(ls) do
echo "Item: $i" done unset MYVAR export MYVAR set ${MYVAR:=value}
MYVAR=${MYVAR:-value} echo $MYVAR echo ${MYVAR:-message} echo ${MYVAR:+message} echo $((3+3)) echo ${MYVAR,,}
Variable assignment
Variable assignment
Display all Bash variables (only valid in the current shell)
Display all environment variables (valid globally in the whole system).
Environment variables are set in /etc/environment in the form var=value
Set a variable
Print a variable. If other characters follow the variable name, it is necessary to specify the boundaries of the variable name via {} to make it unambiguous
Increment a numeric variable
Assign to a variable the output resulting from a command
Loop through all the output tokens (in this case, the contents of the current dir)
Delete a variable
Export a variable so it can be seen by Bash child processes
Set a variable, if it is not already set (i.e. does not exist) or is null
Print the value of a variable
If variable exists and is not null, print its value, otherwise print a message
If variable exists and is not null, print a message, otherwise print nothing
Evaluate an expression and print the result
Print a variable (string) in lowercase
$0
$n
$#
$?
${PIPESTATUS[n]}
$$
$SHLVL
Bash built-in variables
Script name
nth argument passed to the script or function
Number of arguments passed to the script or function
Exit status of the last executed command
Exit status of the nth command in the executed pipeline
PID of the script in which this variable is called
Deepness level of current shell, starting with 1
Linux Quick Reference Guide 4 th ed. June 2016 © Daniele Raffo www.crans.org/~raffo
48/150 Scripting
Scripting
Bash scripts must start with the shebang line #!/bin/bash indicating the location of the script interpreter.
source myscript.sh
. myscript.sh
bash myscript.sh
./myscript.sh (file must be executable)
Script execution
Script execution takes place in the same shell. Variables defined and exported in the script are seen by the shell when the script exits
Script execution spawns a new shell
command &
command1; command2
command1 && command2
command1 || command2
(command1 && command2) exit exit n
command || exit 1 if command then
echo "Success" else
echo "Fail" fi if [ $? -eq 0 ] then
echo "Success" else
echo "Fail" fi function myfunc { commands } myfunc() { commands } myfunc arg1 arg2 ...
Execute command in the background
Execute command 1 and then command 2
Execute command 2 only if command 1 executed successfully (exit status = 0)
Execute command 2 only if command 1 did not execute successfully (exit status > 0)
Group commands together for evaluation priority
Terminate a script
Terminate a script with the specified exit status number n. By convention, a 0 exit status is used if the script executed successfully, non-zero otherwise
(To be used inside a script.) Exit the script if command fails
Run a command, then evaluate whether it exited successfully or failed
Evaluate whether the last executed command exited successfully or failed
Define a function
Call a function for DIR in `ls` do
rmdir $DIR done zenity
Loop through a list of directories
Display GTK+ graphical dialogs for user messages and input
Linux Quick Reference Guide 4 th ed. June 2016 © Daniele Raffo www.crans.org/~raffo
49/150 Tests
Tests
Perform a test; if it holds true, the command is executed test $MYVAR = "value" && command
[ $MYVAR = "value" ] && command if [ $MYVAR = "value" ]; then command; fi
Integer operators
-eq Equal to
-ne
-lt
-le
-gt
Not equal to
Less than
Less than or equal to
Greater than
-ge Greater than or equal to
String operators
-z Is zero length
-n or nothing
Is non-zero length
=
!= or == Is equal to
<
>
Is not equal to
Is alphabetically before
Is alphabetically after expr $MYVAR = "39 + 3"
MYVAR=$((39 + 3)) expr string : regex expr string : \(regex\)
= Equal to
!= Not equal to
< Less than
<= Less than or equal to
> Greater than
>= Greater than or equal to
Test operators
File operators
-e or -a
-d
-b
Exists
Is a directory
Is a block special file
-c
-f
-r
-w
Is a character special file
Is a regular file
Is readable
Is writable
-x
-s
Is executable
Is non-zero length
-u
-g
-k
-h
Is SUID
Is SGID
Is sticky
Is a symbolic link
Expression operators
-a
-o
!
\( \)
Logical AND
Logical OR
Logical NOT
Priority
Evaluate an expression (in this case, assigns the value 42 to the variable)
Return the length of the substring matching the regex
Return the substring matching the regex
Evaluation operators
+
-
Plus
Minus
\* Multiplied by
/ Divided by
% Remainder
string : regex match string regex substr string pos length index string chars length string
String matches regex
Substring
Index of any chars in string
String length
Linux Quick Reference Guide 4 th ed. June 2016 © Daniele Raffo www.crans.org/~raffo
50/150
if [test 1] then
[command block 1] elif [test 2] then
[command block 2] else
[command block 3] fi
Tests
case $VAR in
[pattern 1]) [command 1] ;;
[pattern 2]) [command 2] ;;
*) [command 3] esac while [test] do [command block] done
Loops
until [test] do [command block] done
The command block executes as long as test is true
#!/bin/bash
The command block executes as long as test is false
#!/bin/bash i=0 while [ $i -le 7 ] do
echo $i
let i++ done break continue
Exit a loop
Jump to the next iteration i=0 until [ $i -gt 7 ] do
echo $i
let i++ done
Flow control
Flow control
for I in [list] do [command operating on $I] done
The command executes for each I in list
#!/bin/bash for i in 0 1 2 3 4 5 6 7 do
echo $i
let i++ done
Linux Quick Reference Guide 4 th ed. June 2016 © Daniele Raffo www.crans.org/~raffo
51/150
vi vim gvim vimdiff file1 file2 pico nano emacs gedit ed more less
Vi, text editor
Vi Improved, an advanced text editor
Vim with GUI
Compare two text files
Pico, simple text editor
Nano, simple text editor (a GNU clone of Pico)
GNU Emacs, a GUI text editor
GUI text editor
Line-oriented text editor
Text pager (obsolete)
Text pager
Text processors
h g
G
F
-N
-n
=
CTRL G q
less pager commands
Help
Go to first line in the file
Go to last line in the file
Go to the end of the file, and move forward as the file grows
Show line numbers
Don't show line numbers
Show information about the file
Show current and total line number, byte, and percentage of the file read
Quit
Text processors
Linux Quick Reference Guide 4 th ed. June 2016 © Daniele Raffo www.crans.org/~raffo
52/150
w b e
0 a
A i
I
ESC
CTRL G
Go to Command mode
Insert text before cursor
Insert text after line
Append text after cursor
Append text after line and go to Insert mode
Move to next word
Move to beginning of word
Move to end of word
Move to beginning of line
Show current line and column number
$
1G
G z
RETURN
Move to end of line
Move to line 1 i.e. beginning of file
Move to end of file
Make current line the top line of the screen p
P ma
'a y'a d'a u
.
x
X
7dd
Mark position "a". Marks a-z are local to current file, while marks A-Z are global to a specific file
Go to mark "a". If using a global mark, it also opens the specific file
Copy (yank) from mark "a" to current line, into the buffer
Delete from mark "a" to current line
Paste buffer after current line
Paste buffer before current line yy yyp
Copy current line
Duplicate current line
Delete current character
Delete before current character
D dd
Delete from current character to end of line
Delete current line
Delete 7 lines (almost any command can be prepended by a number to repeat it a number of times)
Undo last command (Vi can undo the last command only, Vim is able to undo several commands)
Repeat last text-changing command
/string
?string
Search for string forward
Search for string backwards n
N
Search for next match of string
Search for previous match of string
:s/s1/s2/
:s/s1/s2/g
:%s/s1/s2/gc
:5,40s/^/#/
Replace the first occurrence of s1 with s2 in the current line
Replace globally every occurrence of s1 with s2 in the current line
Replace globally every occurrence of s1 with s2 in the whole file, asking for confirmation
Add a hash character at the beginning of each line, from line 5 to 40
:wq
:x
ZZ
:q
:q!
!!program
:r file
:X
:w file
Replace line with output from program
Read file and insert it after current line
Encrypt current document. Vi will automatically prompt for the password to encrypt and decrypt
Write to file
Save changes and quit
Quit (only if there are no changes)
Abandon all changes and quit
Vi
Vi
Linux Quick Reference Guide 4 th ed. June 2016 © Daniele Raffo www.crans.org/~raffo
53/150
Option
ai all ap aw bf dir=tmpdir eb ht=8 ic lisp list magic mesg nu opt para=LIlPLPPPQPbpP prompt re remap report ro scroll=11 sh=/bin/bash showmode slow sm sw=8 tags=/usr/lib/tags term terse timeout tl=3 ts=8 wa warn window=24 wm=0
Effect
Turn on auto indentation
Print all option to screen
Print line after commands d c J m :s t u
Automatic write on commands :n ! e# ^^ :rew ^} :tag
Discard control characters from input
Set tmpdir as directory for temporary work files
Precede error messages with a bell
Set terminal tab as 8 spaces
Ignore case when searching
Modify brackets for Lisp compatibility
Show tabs and end-of-line characters
Allow pattern matching with special characters
Enable UNIX terminal messaging
Show line numbers
Speeds output by eliminating automatic Return
Set macro to start paragraphs for { } operators
Prompt : for command input
Simulate smart terminal on dumb terminal
Accept macros within macros
Show largest size of changes on status line
Make file readonly
Set screen size as 11 lines
Set shell escape to /bin/bash
Show current mode on status line
Postpone display updates during inserts
Show matching parentheses when typing
Set shift width to 8 characters
Set path for files checked for tags
Print terminal type
Print terse messages
Eliminate 1-second time limit for macros
Set significance of tags beyond 3 characters (0 = all)
Set tab stops to 8 for text input
Inhibit normal checks before write commands
Warn "No write since last change"
Set text window as 24 lines
Set automatic wraparound 0 spaces from right margin
:set option turn on an option
:set nooption turn off an option
Options can also be permanently set, by including them in ~/.exrc
Vi options
Vi options
Linux Quick Reference Guide 4 th ed. June 2016 © Daniele Raffo www.crans.org/~raffo
54/150
SHOW DATABASES;
SHOW TABLES;
USE CompanyDatabase;
SELECT DATABASE();
SQL
SQL
Show all existing databases
Show all tables from the selected database
Choose which database to use
Show which database is currently selected
CREATE TABLE customers ( cusid INT NOT NULL AUTO_INCREMENT PRIMARY KEY, firstname VARCHAR(32), lastname VARCHAR(32), dob DATE, city VARCHAR(24), zipcode VARCHAR(5));
CREATE TABLE payments ( payid INT NOT NULL AUTO_INCREMENT PRIMARY KEY, date DATE, fee INT, bill VARCHAR(128), cusid INT,
CONSTRAINT FK1 FOREIGN KEY (cusid) REFERENCES customers(cusid));
Create tables
CREATE INDEX lastname_index ON customers(lastname);
ALTER TABLE customers ADD INDEX lastname_index (lastname);
DESCRIBE customers;
SHOW CREATE TABLE customers;
DROP TABLE customers;
DROP DATABASE CompanyDatabase;
ALTER TABLE customers MODIFY city VARCHAR(32);
Create an index for faster searches
Describe the columns of a table
Show the code used to create a table
Delete a table
Delete a database
Modify the type of a column
INSERT INTO customers (firstname,lastname,dob)
VALUES ('Arthur','Dent',1959-08-01), ('Trillian','',1971-03-19);
DELETE FROM customers WHERE firstname LIKE 'Zaphod';
UPDATE customers SET city = 'London' WHERE zipcode = '00789';
Insert a new record in a table
Delete some records in a table
Modify records in a table
Create a view CREATE VIEW cust_view AS
SELECT * FROM customers WHERE city != 'London';
COMMIT;
ROLLBACK;
START TRANSACTION;
BEGIN;
Commit changes to the database
Rollback the current transaction, canceling any changes done during it
Disable autocommit for this transaction, until a COMMIT or ROLLBACK is issued
Linux Quick Reference Guide 4 th ed. June 2016 © Daniele Raffo www.crans.org/~raffo
55/150
SELECT * FROM customers;
SELECT firstname, lastname FROM customers LIMIT 5;
SELECT firstname, lastname FROM customers WHERE zipcode = '00123';
SELECT firstname, lastname FROM customers WHERE zipcode IS NOT NULL;
SELECT * FROM customers ORDER BY lastname, firstname;
SELECT * FROM customers ORDER by zipcode DESC;
SELECT firstname, lastname,
TIMESTAMPDIFF(YEAR,dob,CURRENT_DATE) as AGE FROM customers;
SELECT DISTINCT city FROM customers;
SELECT city, COUNT(*) FROM customers GROUP BY city;
SELECT cusid, SUM(fee) FROM payments GROUP BY cusid;
SELECT cusid, AVG(fee) FROM payments GROUP BY cusid
HAVING AVG(fee)<50;
SELECT MAX(fee) FROM payments;
SELECT COUNT(*) FROM customers;
SELECT cusid FROM payments t1 WHERE fee =
(SELECT MAX(t2.fee) FROM payments t2 WHERE t1.cusid=t2.cusid);
SELECT @maxfee:=MAX(fee) FROM payments;
SELECT cusid FROM payments t1 WHERE fee = @maxfee;
SELECT cusid FROM payments WHERE fee >
ALL (SELECT fee FROM payments WHERE cusid = 4242001;
SELECT * FROM customers WHERE firstname LIKE 'Trill%';
SELECT * FROM customers WHERE firstname LIKE 'F_rd';
SELECT * FROM customers WHERE firstname REGEXP '^Art.*r$';
SELECT firstname, lastname FROM customers WHERE zipcode = '00123'
UNION
SELECT firstname, lastname FROM customers WHERE cusid > 4242001;
SELECT firstname, lastname FROM customers WHERE zipcode = '00123'
INTERSECT
SELECT firstname, lastname FROM customers WHERE cusid > 4242001;
SELECT firstname, lastname FROM customers WHERE zipcode = '00123'
EXCEPT
SELECT firstname, lastname FROM customers WHERE cusid > 4242001;
SQL SELECTs
SQL SELECTs
Select all columns from the customers table
Select first and last name of customers, showing 5 records only
Select first and last name of customers whose zip code is 00123
Select first and last name of customers with a recorded zip code
Select customers in alphabetical order by last name, then first name
Select customers, sorting them by zip code in reverse order
Select first name, last name, and calculated age of customers
Show all cities but retrieving each unique output record only once
Show all cities and the number of customers in each city. NULL values are not counted
Show all fee payments grouped by customer ID, summed up
Show the average of fee payments grouped by customer ID, where this average is less than 50
Show the highest fee in the table
Show how many rows are in the table
Show the customer ID that pays the highest fee (via a subquery)
Show the customer ID that pays the highest fee (via a user set variable)
Show the customer IDs that pay fees higher than the highest fee paid by customer ID 4242001
Select customers whose first name starts with "Trill"
Select matching customers; the _ matches a single character
Select customers whose first name matches the regex
Select customers that satisfy any of the two requirements
Select customers that satisfy both of the two requirements
Select customers that satisfy the first requirement but not the second
Linux Quick Reference Guide 4 th ed. June 2016 © Daniele Raffo www.crans.org/~raffo
56/150 SQL JOINs
SQL
SELECT customers.name, payments.bill
FROM customers, payments
WHERE customers.cusid = payments.cusid;
SELECT customers.name, payments.bill
FROM customers NATURAL JOIN payments;
MySQL
SELECT customers.name, payments.bill
FROM customers
[ JOIN | INNER JOIN | CROSS JOIN ] payments
ON customers.cusid = payments.cusid;
SELECT customers.name, payments.bill
FROM customers JOIN payments
USING (cusid);
SELECT customers.name, payments.bill
FROM customers
[ JOIN | INNER JOIN | CROSS JOIN ] payments
USING (cusid);
SELECT customers.name, payments.bill
FROM customers JOIN payments
ON customers.cusid = payments.cusid;
SELECT customers.name, payments.bill
FROM customers CROSS JOIN payments;
SELECT customers.name, payments.bill
FROM customers JOIN payments;
(ON clause is missing)
SELECT customers.name, payments.bill
FROM customers LEFT JOIN payments
ON customers.cusid = payments.cusid;
SELECT customers.name, payments.bill
FROM customers RIGHT JOIN payments
ON customers.cusid = payments.cusid;
SQL JOINs
Operation
Perform a join (aka inner
join) of two tables to select data that are in a relationship
Perform a Cartesian product
(aka cross join) of two tables
Perform a left join (aka left
outer join) of two tables, returning records matching the join condition and also records in the left table with unmatched values in the right table
Perform a right join (aka
right outer join) of two tables, returning records matching the join condition and also records in the right table with unmatched values in the left table
Linux Quick Reference Guide 4 th ed. June 2016 © Daniele Raffo www.crans.org/~raffo
57/150 MySQL
MySQL
MySQL is the most used open source RDBMS (Relational Database Management System). It runs on TCP port 3306.
mysqld_safe mysql_install_db (deprecated) mysqld --initialize mysql_secure_installation mysql -u root -p mysql -u root -ps3cr3t mysql -u root -p -e 'CREATE DATABASE MyDatabase'
Start the MySQL server (mysqld) with safety features such as restarting the server if errors occur and logging runtime information to the error logfile. Recommended
Initialize the MySQL data directory, create system tables, and set up an administrative account.
To be run after installing the MySQL server
Set password for root, remove anonymous users, disable remote root login, and remove test database.
To be run after installing the MySQL server
Login to MySQL as root and prompt for the password
Login to MySQL as root with password s3cr3t
Run a SQL command via MySQL mysqldump -u root -p --all-databases > alldbs.sql
Backup all databases to a dump file mysqldump -u root -p MyDatabase > mydb.sql
Backup a database to a dump file mysqldump -u root -p --databases MyDb1 MyDb2 > dbs.sql
Backup several databases to a dump file mysqldump -u root -p MyDatabase t1 t2 > tables.sql
mysql -u root -p < alldbsbak.sql
Backup some tables of a database to a dump file
Restore all databases from a dump file (which contains more than one database) mysql -u root -p MyDatabase < mydbbak.sql
Restore a database from a dump file (which contains one database) mysql_upgrade -u root -p mysqlcheck options mysqlcheck --check db table mysqlcheck --check --databases db1 db2 mysqlcheck --check --all-databases
Check all tables in all databases for incompatibilities with the current version of MySQL
Perform table maintenance. Each table is locked while is being processed. Options are:
--check Check table for errors (default)
--analyze Analyze table
--optimize Optimize table
--repair Repair table; can fix almost all problems
except unique keys that are not unique
Check the specified table of the specified database
Check the specified databases
Check all databases mysqltuner.pl
Review the current MySQL installation configuration for performances and stability
Generate an user-friendly report of MySQL status values mysqlreport (obsolete) mytop innotop
Linux Quick Reference Guide 4 th ed. June 2016
Monitor MySQL processes and queries
Monitor MySQL InnoDB transactions
© Daniele Raffo www.crans.org/~raffo
58/150 MySQL syntax
SELECT Host,User FROM mysql.user;
CREATE USER 'john'@'localhost' IDENTIFIED BY 'p4ssw0rd';
DROP USER 'john'@'localhost';
SET PASSWORD FOR 'john'@'localhost' = PASSWORD('p4ssw0rd');
SET PASSWORD FOR 'john'@'localhost' = '*7E684A3DF6273CD1B6DE53';
SHOW GRANTS FOR 'john'@'localhost';
GRANT ALL PRIVILEGES ON MyDatabase.* TO 'john'@'localhost';
REVOKE ALL PRIVILEGES ON MyDatabase.* FROM 'john'@'localhost';
MySQL syntax
List all MySQL users
Create a MySQL user and set his password
Delete a MySQL user
Set a password for a MySQL user.
The password can be specified either in plaintext or by its hash value
Show permissions for a user
Grant permissions to a user
Revoke permissions from a user; must match the granted permission on the same database or table
Create a MySQL user and set his grants GRANT SELECT ON *.* TO 'john'@'localhost' IDENTIFIED BY 'p4ssw0rd';
GRANT SELECT ON *.* TO 'john'@'localhost' IDENTIFIED BY PASSWORD
'*7E684A3DF6273CD1B6DE53';
FLUSH PRIVILEGES; Reload and commit the grant tables; to be used after any GRANT command
SELECT * INTO OUTFILE '/tmp/mytable.csv'
FIELDS TERMINATED BY ',' OPTIONALLY ENCLOSED BY '"'
LINES TERMINATED BY '\n' FROM MyDatabase.mytable;
Export a table to a CSV file
USE MyDatabase; SOURCE mydbbak.sql;
USE MyDatabase; LOAD DATA LOCAL INFILE 'foofile' INTO TABLE foo;
SELECT * FROM MyDatabase.mytable;
SELECT * FROM MyDatabase.mytable\g
SELECT * FROM MyDatabase.mytable\G
SELECT /*!99999 my comment*/ * FROM MyDatabase.mytable;
\c
\! command
TEE logfile
Restore a database from a dump file
Populate a table with data from file (one record per line, values separated by tabs)
Send a statement to the server
Display result in vertical format, showing each record in multiple rows
Insert a comment in the statement
Cancel current input
Run a shell command
Log all I/O of the current MySQL session to the specified logfile
Linux Quick Reference Guide 4 th ed. June 2016 © Daniele Raffo www.crans.org/~raffo
59/150
SHOW VARIABLES;
SHOW SESSION VARIABLES;
SHOW LOCAL VARIABLES;
SHOW GLOBAL VARIABLES;
SHOW VARIABLES LIKE '%query%';
SHOW VARIABLES LIKE 'hostname';
SELECT @@hostname;
SET sort_buffer_size=10000;
SET @@sort_buffer_size=10000;
SET SESSION sort_buffer_size=10000;
SET LOCAL sort_buffer_size=10000;
SET @@session.sort_buffer_size=10000;
SET @@local.sort_buffer_size=10000;
SET GLOBAL sort_buffer_size=10000;
SET @@global.sort_buffer_size=10000;
SHOW STATUS;
SHOW SESSION STATUS;
SHOW LOCAL STATUS;
SHOW GLOBAL STATUS;
SHOW STATUS LIKE '%wsrep%';
SHOW WARNINGS;
SHOW ERRORS;
SHOW TABLE STATUS;
SHOW ENGINE INNODB STATUS;
SHOW FULL PROCESSLIST;
SHOW CREATE TABLE table;
SHOW CREATE VIEW view;
SELECT VERSION();
SELECT CURDATE();
SELECT CURRENT_DATE;
SELECT CURTIME();
SELECT CURRENT_TIME;
SELECT NOW();
SELECT USER();
\s
MySQL status
MySQL status
Print session variables (affecting the current connection only)
Print global variables (affecting the global operations on the server)
Print session variables that match the given pattern
Print a session variable with the given name
Set a session variable
Set a global variable
Print session status (concerning the current connection only)
Print global status (concerning the global operations on the server)
Print session status values that match the given pattern
Print warnings, errors and notes resulting from the most recent statement in the current session that generated messages
Print errors resulting from the most recent statement in the current session that generated messages
Print information about all tables of the currently selected database e.g. engine (InnoDB or MyISAM), rows, indexes, data length
Print statistics concerning the InnoDB engine
Print the list of threads running on the system
Print the CREATE statement that created the specified table or view
Print the version of the MySQL server
Print the current date
Print the current time
Print the current date and time
Print the current user@hostname that is logged in
Print status information about server and current connection
Linux Quick Reference Guide 4 th ed. June 2016 © Daniele Raffo www.crans.org/~raffo
60/150 MySQL recipes
MySQL recipes
Display the sizes of all databases in the system (counting data + indexes)
SELECT table_schema "Name", sum(data_length+index_length)/1024/1024 "Size in Mb"
FROM information_schema.tables GROUP BY table_schema;
SELECT table_schema "Name", sum(data_length+index_length)/1024/1024 "Size in Mb"
FROM information_schema.tables where table_schema='database';
SELECT ROUND(SUM(LENGTH(field)<40)*100/COUNT(*),2)
FROM table;
SHOW FULL TABLES IN database WHERE TABLE_TYPE LIKE 'VIEW';
Display the size of database
SELECT table_name "Name", round(((data_length)/1024/1024),2) "Data size in Mb", round(((index_length)/1024/1024),2) "Index size in Mb"
FROM information_schema.TABLES WHERE table_schema='database'
ORDER BY table_name;
SELECT CEILING(Total_InnoDB_Bytes*1.2/POWER(1024,2))
"Estimate in Mb" FROM
(SELECT SUM(data_length+index_length) Total_InnoDB_Bytes
FROM information_schema.tables WHERE engine='InnoDB') A;
Display data and index size of all tables of
database
SELECT table_name, table_rows
FROM information_schema.tables WHERE table_schema = 'database';
Print an estimate of the number of rows of each table of database
Get an estimate of how much the MySQL config variable innodb_buffer_pool_size should be, allowing for a database growth of
20%
Kill all connections belonging to user SELECT CONCAT('KILL ',id,';')
FROM information_schema.processlist WHERE user='user'
INTO OUTFILE '/tmp/killuser'; SOURCE /tmp/killuser;
SELECT COUNT(1) SlaveThreadCount
FROM information_schema.processlist WHERE user='system user';
Distinguish between master and slave server; returns 0 on a master, >0 on a slave
Display the percentage of rows on which the
VARCHAR field is shorter than 40 chars
Display the list of views in database dbs="$(mysql -uroot -ppassword -Bse'SHOW DATABASES;')" for db in $dbs do
[operation on $db] done
Perform an operation on each database name
Linux Quick Reference Guide 4 th ed. June 2016 © Daniele Raffo www.crans.org/~raffo
61/150 MySQL operations
MySQL operations
How to resync a master-slave replication
1.
On the master, on terminal 1: mysql -uroot -p
RESET MASTER;
FLUSH TABLES WITH READ LOCK;
SHOW MASTER STATUS;
Note the values of MASTER_LOG_FILE and MASTER_LOG_POS; these values will need to be copied on the slave
2.
On the master, on terminal 2:
3.
On the master, on terminal 1: mysqldump -uroot -p --all-databases > /root/dump.sql
UNLOCK TABLES;
4.
Transfer the dump file from the master to the slave
5.
On the slave: mysql -uroot -p
STOP SLAVE;
SOURCE /root/dump.sql;
RESET SLAVE;
CHANGE MASTER TO MASTER_LOG_FILE='mysql-bin.nnnnnn', MASTER_LOG_POS=mm;
START SLAVE;
SHOW SLAVE STATUS;
How to recover the MySQL root password
1.
Stop the MySQL server
2.
Restart the MySQL server skipping the grant tables: mysqld_safe --skip-grant-tables --skip-networking &
3. Connect to the MySQL server passwordlessly: mysql -uroot
4.
Reload the grant tables:
5.
Change the root password:
FLUSH PRIVILEGES;
SET PASSWORD FOR 'root'@'localhost' = PASSWORD('s3cr3t');
6.
Stop the MySQL server and restart it normally
Linux Quick Reference Guide 4 th ed. June 2016 © Daniele Raffo www.crans.org/~raffo
62/150 X Window
Display Manager
xdm
X
Display
Manager
X Window
Display Managers
Configuration files
/etc/x11/xdm/Xaccess
/etc/x11/xdm/Xresources
Control inbound requests from remote hosts
Configuration settings for X applications and the login screen
/etc/x11/xdm/Xservers
/etc/x11/xdm/Xsession
/etc/x11/xdm/Xsetup_0
/etc/x11/xdm/xdm-config
Display Manager greeting screen
Association of X displays with local X server software, or with X terminals via XDMCP
Defined in /etc/x11/xdm/Xresources by the line: xlogin*greeting: \
Debian GNU/Linux (CLIENTHOST)
Script launched by xdm after login
Script launched before the graphical login screen
Association of all xdm configuration files gdm kdm
GNOME
Display
Manager
KDE
Display
Manager
/etc/gdm/gdm.conf or /etc/gdm/custom.conf
/etc/kde/kdm/kdmrc
Configured via gdmsetup
Configured via kdm_config
/etc/init.d/xdm start
/etc/init.d/gdm start
/etc/init.d/kdm start xorgconfig (Debian)
Xorg -configure (Red Hat) xorgcfg (Debian) system-config-display (Red Hat)
X -version xdpyinfo xwininfo xhost + 10.3.3.3
xhost - 10.3.3.3
switchdesk gde gnome-shell --version
/etc/X11/xorg.conf
~/.Xresources
$DISPLAY
/etc/inittab
/etc/sysconfig/desktop
Start the X Display Manager
Configure X (text mode)
Configure X (graphical mode)
Show which version of X is running
Display information about the X server
Display information about windows
Add or remove 10.3.3.3 to the list of hosts allowed to make X connections to the local machine
Switch to the GDE Display Manager at runtime
Show which version of GNOME is running
Configuration file for X
Configuration settings for X applications, in the form
program*resource: value
Environment variable defining the display name of the X server, in the form
hostname:displaynumber.screennumber
Instruct init to launch XDM at runlevel 5: x:5:respawn:/usr/X11R6/bin/xdm -nodaemon
Define GNOME as the default Display Environment and Display Manager: desktop="gde" displaymanager="gdm"
Linux Quick Reference Guide 4 th ed. June 2016 © Daniele Raffo www.crans.org/~raffo
63/150
xdotool xdotool getwindowfocus xdotool selectwindow xdotool key --window 12345678 Return xprop xrandr xrandr -q xrandr --output eDP1 --right-of VGA1 xsel xsel -b < file xsel -b -a < file2 xsel -b -o mkfontdir xset fp+ /usr/local/fonts xfs fc-cache
X Window tools
X Window tools
X automation tool
Get the ID of the currently focused window (usually the terminal where this command is typed)
Pop up a X cursor and get the ID of the window selected by it
Simulate a Return keystroke inside window ID 12345678
X property displayer
Show screen(s) size and resolution
Extend the screen on an additional VGA physical screen situated to the left
Manipulate the X selection (primary, secondary, and clipboard)
Put the contents of a file in the X clipboard
Append the contents of a file to the X clipboard
Output onscreen the contents of the X clipboard
Catalog the newly installed fonts in the new directory
Dynamically add the new installed fonts in /usr/local/fonts to the X server
Start the X font server
Install fonts and build font information cache
Linux Quick Reference Guide 4 th ed. June 2016 © Daniele Raffo www.crans.org/~raffo
64/150 X11 keysim codes
Main
BackSpace ff08
Tab ff09
Linefeed ff0a
Clear ff0b
Return ff0d
Pause ff13
Scroll_Lock ff14
Sys_Req ff15
Escape ff1b
Delete ffff
Cursor control
Home ff50
Left ff51
Up ff52
Right ff53
Down ff54
Prior ff55
Page_Up ff55
Next ff56
Page_Down ff56
End ff57
Begin ff58
Misc functions
Select ff60
Print ff61
Execute ff62
Insert ff63
Undo ff65
Redo ff66
Menu ff67
Find ff68
Cancel ff69
Help ff6a
Break ff6b
Mode_switch ff7e script_switch ff7e
Num_Lock ff7f
Modifiers
Shift_L ffe1
Shift_R ffe2
Control_L ffe3
Control_R ffe4
Caps_Lock ffe5
Shift_Lock ffe6
Meta_L ffe7
Meta_R ffe8
Alt_L ffe9
Alt_R ffea
Super_L ffeb
Super_R ffec
Hyper_L ffed
Hyper_R ffee
Latin 1
space 0020 exclam 0021 quotedbl 0022 numbersign 0023 dollar 0024 percent 0025 ampersand 0026 apostrophe 0027 quoteright 0027 parenleft 0028 parenright 0029 asterisk 002a plus 002b comma 002c minus 002d period 002e slash 002f
0 - 9 0030 - 0039 colon 003a semicolon 003b less 003c equal 003d greater 003e question 003f at 0040
A - Z 0041 - 005a bracketleft 005b backslash 005c bracketright 005d asciicircum 005e underscore 005f grave 0060 quoteleft 0060 a - z 0061 - 007a braceleft 007b bar 007c braceright 007d asciitilde 007e nobreakspace 00a0 exclamdown 00a1 cent 00a2 sterling 00a3 currency 00a4 yen 00a5 brokenbar 00a6 section 00a7 diaeresis 00a8 copyright 00a9 ordfeminine 00aa guillemotleft 00ab notsign 00ac hyphen 00ad registered 00ae macron 00af degree 00b0 plusminus 00b1 twosuperior 00b2 threesuperior 00b3 acute 00b4 mu 00b5 paragraph 00b6 periodcentered 00b7 cedilla 00b8 onesuperior 00b9 masculine 00ba guillemotright 00bb onequarter 00bc onehalf 00bd threequarters 00be questiondown 00bf
Agrave 00c0
Aacute 00c1
Acircumflex 00c2
Atilde 00c3
Adiaeresis 00c4
Aring 00c5
AE 00c6
Ccedilla 00c7
Egrave 00c8
Eacute 00c9
Ecircumflex 00ca
Ediaeresis 00cb
Igrave 00cc
Iacute 00cd
Icircumflex 00ce
Idiaeresis 00cf
ETH 00d0
Eth 00d0
Ntilde 00d1
Ograve 00d2
Oacute 00d3
Ocircumflex 00d4
Otilde 00d5
Odiaeresis 00d6 multiply 00d7
Oslash 00d8
Ooblique 00d8
Ugrave 00d9
Uacute 00da
Ucircumflex 00db
Udiaeresis 00dc
Yacute 00dd
THORN 00de
Thorn 00de ssharp 00df agrave 00e0 aacute 00e1 acircumflex 00e2 atilde 00e3 adiaeresis 00e4 aring 00e5 ae 00e6 ccedilla 00e7 egrave 00e8 eacute 00e9 ecircumflex 00ea ediaeresis 00eb igrave 00ec iacute 00ed icircumflex 00ee idiaeresis 00ef eth 00f0 ntilde 00f1 ograve 00f2 oacute 00f3 ocircumflex 00f4 otilde 00f5 odiaeresis 00f6 division 00f7 oslash 00f8 ooblique 00f8 ugrave 00f9 uacute 00fa ucircumflex 00fb udiaeresis 00fc yacute 00fd thorn 00fe ydiaeresis 00ff
X11 keysim codes
Latin 2
Aogonek 01a1 breve 01a2
Lstroke 01a3
Lcaron 01a5
Sacute 01a6
Scaron 01a9
Scedilla 01aa
Tcaron 01ab
Zacute 01ac
Zcaron 01ae
Zabovedot 01af aogonek 01b1 ogonek 01b2 lstroke 01b3 lcaron 01b5 sacute 01b6 caron 01b7 scaron 01b9 scedilla 01ba tcaron 01bb zacute 01bc doubleacute 01bd zcaron 01be zabovedot 01bf
Racute 01c0
Abreve 01c3
Lacute 01c5
Cacute 01c6
Ccaron 01c8
Eogonek 01ca
Ecaron 01cc
Dcaron 01cf
Dstroke 01d0
Nacute 01d1
Ncaron 01d2
Odoubleacute 01d5
Rcaron 01d8
Uring 01d9
Udoubleacute 01db
Tcedilla 01de racute 01e0 abreve 01e3 lacute 01e5 cacute 01e6 ccaron 01e8 eogonek 01ea ecaron 01ec dcaron 01ef dstroke 01f0 nacute 01f1 ncaron 01f2 odoubleacute 01f5 rcaron 01f8 uring 01f9 udoubleacute 01fb tcedilla 01fe abovedot 01ff
This is an excerpt of keysymdef.h which defines keysym codes (i.e. characters or functions associated with each key in X11) as XK_key and the key hex value. These keys can be used as argument for the xdotool key command.
Linux Quick Reference Guide 4 th ed. June 2016 © Daniele Raffo www.crans.org/~raffo
65/150 /etc/passwd
/etc/passwd
5
6
3
4
7
1
2
/etc/passwd User accounts
root:x:0:0:/root:/bin/bash bin:x:1:1:/bin:/bin/bash jdoe:x:500:100:John Doe,,555-1234,,:/home/jdoe:/bin/bash
1 2 3 4 5 6 7
Login name
Hashed password (obsolete), or x if password is in /etc/shadow
UID – User ID
GID – Default Group ID
GECOS field – Information about the user: Full name, Room number, Work phone, Home phone, Other
Home directory of the user
Login shell (can be set to /bin/false to prevent a user from logging in)
5
6
3
4
7
8
9
1
2
/etc/shadow User passwords
root:$6$qk8JmJHf$X9GfOZ/i9LZP4Kldu6.D3cx2pXA:15537:0:99999:7::: bin:*:15637:0:99999:7::: jdoe:!$6$YOiH1otQ$KxeeUKHExK8e3jCUdw9Rxy3Wu53:15580:0:99999:7::15766:
1 2 a b c 3 4 5 6 7 8 9
Login name
Hashed password (a ! prefix if the account is locked, * if account is disabled, ! or !! if no password is set).
Composed of the following subfields:
a
Hashing algorithm: 1 = MD5, 2a = Blowfish, 5 = SHA256, 6 = SHA512 (recommended)
b
Random salt, up to 16 chars long. Has the purpose of thwarting password cracking via a rainbow table attack
c
String obtained by hashing the user's plaintext password concatenated to the stored salt
Date of last password change (in number of days since 1 January 1970)
Days before password may be changed; if 0, user can change the password at any time
Days after which password must be changed
Days before password expiration that user is warned
Days after password expiration that account is disabled
Date of account disabling (in number of days since 1 January 1970)
Reserved field root:x:0:root jdoe:x:501 staff:x:530:jdoe,asmith
1 2 3 4
/etc/group Group accounts
1
Group name
2
3
4
Encrypted password, or x if password is in /etc/gshadow
GID – Group ID
Group members (if this is not their Default Group) root::root:root
/etc/gshadow Group passwords
1
Group name jdoe:!:: staff:0cfz7IpLhW19i::root,jdoe
1 2 3 4
2
3
Encrypted password, or ! if no password set (default)
Group administrators
4
Group members
/etc/shadow and /etc/gshadow are mode 000 and therefore readable only by the root user.
Linux Quick Reference Guide 4 th ed. June 2016 © Daniele Raffo www.crans.org/~raffo
66/150
useradd -m jdoe useradd -mc "John Doe" jdoe useradd -ms /bin/ksh jdoe useradd -D usermod -c "Jonas Doe" jdoe usermod -L jdoe usermod -U jdoe userdel -r jdoe chfn jdoe chsh jdoe passwd jdoe passwd -l jdoe passwd -S jdoe chage -E 2013-02-14 jdoe chage -d 13111 jdoe chage -d 0 jdoe chage -M 30 jdoe chage -m 7 jdoe chage -W 15 jdoe chage -I 3 jdoe chage -l jdoe groupadd staff groupmod -n newstaff staff groupdel staff gpasswd staff gpasswd -a jdoe staff gpasswd -d jdoe staff gpasswd -A jdoe staff adduser deluser addgroup delgroup
(Debian)
User management
User management
Create a user account, creating and populating his homedir from /etc/skel
Create a user account, specifying his full name
Create a user account, specifying his login shell
Show default values for user account creation, as specified in /etc/login.defs and
/etc/default/useradd
Modify the GECOS field of a user account
Lock a user account
Unlock a user account
Delete a user and his homedir
Change the GECOS field of a user
(usermod accepts many useradd options)
Change the login shell of a user
Change the password of a user
Lock a user account
Get information about a user account.
Prints username, account status (L=locked, P=password, NP=no password), date of last password change, min age, max age, warning period, inactivity period in days
Change the password expiration date; account will be locked at that date
Change the date (in number of days since 1 January 1970) of last password change
Force the user to change password at his next login
Change the max number of days during which a password is valid
Change the min number of days between password changes
Change the number of days before password expiration that the user will be warned
Change the number of days after password expiration before the account is locked
List password aging information for a user
Create a group
Change a group name
Delete a group
Set or change the password of a group
Add a user to a group
Delete a user from a group
Add a user to the list of administrators of the group
User-friendly front-ends for user and group management system-config-users (Red Hat)
GUI for user and group management
Linux Quick Reference Guide 4 th ed. June 2016 © Daniele Raffo www.crans.org/~raffo
/etc/nologin
/etc/login.defs
whoami id id -u id user who w last lastb fail2ban
67/150 UID and GID
UID and GID
UID 0 is assigned to the superuser.
UIDs from 0 to 99 should * be reserved for static allocation by the system and not be created by applications.
UIDs from 100 to 499 should * be reserved for dynamic allocation by the superuser and post-install scripts.
UIDs for user accounts start from 500 (Red Hat) or 1000 (SUSE, Debian).
* as recommended by the Linux Standard Base core specifications
A process has an effective, saved, and real UID and GID:
Effective UID Used for most access checks, and as the owner for files created by the process. An unprivileged process can change its effective UID only to either its saved UID or its real UID.
Saved UID
Real UID
Used when a process running with elevated privileges needs to temporarily lower its privileges. The process changes its effective UID (usually root) to a unprivileged one, and its privileged effective UID is copied to the saved UID. Later, the process can resume its elevated privileges by resetting its effective
UID back to the saved UID.
Used to identify the real owner of the process and affect the permissions for sending signals. An unprivileged process can signal another process only if the sender’s real or effective UID matches the receiver's real or saved UID. Child processes inherit the credentials from the parent, so they can signal each other.
/var/log/auth.log
/var/log/pwdfail
If this file exists, login and sshd deny login to the system.
Useful to prevent users to log in when doing system maintenance
Definition of default values (UID and GID ranges, mail directory, account validity, password encryption method, and so on) for user account creation
Print your username (as effective UID)
Print your real and effective UID and GID, and the groups you are a member of
Print your effective UID
Print UID, GID, and groups information about an user
Print the list of users logged into the system
Print the list of users logged into the system, and what they are doing
Print the list of users that logged in and out. Searches through the file /var/log/wtmp
Print the list of bad login attempts. Searches through the file /var/log/btmp
Scan authentication logs and temporarily ban IP addresses (via firewall rules) that have too many failed password logins
Logfile containing user logins and authentication mechanisms
Logfile containing failed authentication attempts
Linux Quick Reference Guide 4 th ed. June 2016 © Daniele Raffo www.crans.org/~raffo
68/150
runuser -u jdoe command su jdoe su -c "fdisk -l" su su -l sudo fdisk -l sudo -uroot fdisk -l sudo !!
sudoedit /etc/passwd sudo -e /etc/passwd visudo gksu -u root -l gksudo -u root gparted
su and sudo
su and sudo
Run a command as user jdoe. Can be launched only by the superuser
Run a shell as user jdoe. If user is not specified, assume root
Pass a single command to the shell
Ensure that the spawned shell is a login shell, hence running login scripts and setting the correct environment variables. Recommended option
Run a command as root. Sudo commands are logged via syslog on
/var/log/auth.log (Debian) or /var/log/secure (Red Hat)
Run again the last command, but this time as root
Edit a protected file. It is recommended to use this instead of allowing users to sudo text editors as root, which will cause security problems if the editor spawns a shell
Edit /etc/sudoers, the configuration file that specifies access rights to sudo
GUI front-ends to su and sudo used to run a X Window command as root. Will pop up a requester prompting the user for root's password
Linux Quick Reference Guide 4 th ed. June 2016 © Daniele Raffo www.crans.org/~raffo
69/150 Terminals
Write interactively a message to the terminal of user jdoe (must be logged in)
Write interactively a message to the terminal of all logged in users
Write a message to the terminal of user jdoe (must be logged in)
Write a message to the terminal of all logged in users
Open an interactive chat session with user jdoe (must be logged in)
Allow the other users to message you via write, wall, and talk
Terminals
write jdoe wall echo "Hello" | write jdoe echo "Hello" | wall talk jdoe mesg y chmod g+w $(tty) mesg n chmod g-w $(tty) mesg
Disallow the other users to message you via write, wall, and talk
Display your current message permission status mesg works by enabling/disabling the group write permission of your terminal device, which is owned by system group tty.
The root user is always able to message users.
screen screen -S sessionname screen command screen -list screen -r pid.tty.host screen -r sessionowner/pid.tty.host screen -R screen -d -R sessionname
CTRL A
Screen manager that multiplexes a single virtual VT100/ANSI terminal between multiple processes or shells. Useful to be able later to reattach to a remote SSH session lost because of timeout.
This command starts an interactive shell screen session
Start a screen session with the specified session name
Start the specified command in a screen session; session will end when command exits
Show the list of detached screen sessions
Resume a detached screen session
Resume the last detached screen session
Detach a remote screen session and reattach your current terminal to it
Send a command to the window manager:
0 ... 9 Switch between screen sessions c Create a new screen session
? Show help chvt n
CTRL ALT Fn
Switch to /dev/ttyn , making it the foreground terminal vlock away tty
Lock the virtual console (terminal)
Print your terminal device (e.g. /dev/tty1, /dev/pts/1)
Linux Quick Reference Guide 4 th ed. June 2016 © Daniele Raffo www.crans.org/~raffo
70/150 cron
cron is used for repeated scheduled execution of commands.
If /etc/cron.allow exists, only users listed therein can access the service.
If /etc/cron.deny exists, all users except those listed therein can access the service.
If none of these files exist, all users can access the service.
It is not necessary to restart crond after the modification of a crontab file, as the changes will be reloaded automatically.
cron
crontab -e crontab -l crontab -e -u jdoe
/etc/crontab
/etc/cron.d/
/etc/cron.hourly/
/etc/cron.daily/
/etc/cron.weekly/
/etc/cron.monthly/
/var/spool/cron/user
Edit your user crontab file
List the contents of your crontab file
Edit the crontab file of another user (command available only to the superuser)
System-wide crontab file; this is the list of commands to execute periodically
Directory containing commands to execute periodically, one command per file
(which must have the same syntax as /etc/crontab)
Scripts placed in these directories will be automatically executed on the specified periods
Crontab of user
/etc/crontab
# m h dom mon dow user command
25 6 * * 1 root foo.sh
*/5 16 * * * root /opt/myscript.sh
0,30 7 25 12 * jdoe /home/jdoe/bar.sh
3 17 * * 1-5 root baz.sh every Monday at 6:25 AM from 4:00 to 4:55 PM every 5 minutes everyday at 7:00 and 7:30 AM on 25 th December at 5:03 PM everyday, from Monday to Friday
m h dom mon
minutes hours day of month (1-31) month (1-12 or jan-dec)
dow user
day of week (0-7 or sun-sat; 0=7=Sunday)
User as whom the command will be executed
command
Command that will be executed at the specified times
The crond daemon checks /etc/crontab every minute and runs the command as the specified user at the specified times.
Each user may also set his own crontab scheduling, which will result in a file /var/spool/cron/user; this user's crontab file has the same format as the system-wide crontab file, except that the user field is not present.
/etc/anacrontab
# period delay job-identifier command
7 10 cron.weekly /opt/myscript.sh
If the job has not been run in the last 7 days, wait 10 minutes and then execute the command
period delay job-identifier command
period, in days, during which the command was not executed delay to wait, in minutes, before execution of the command job identifier in anacron messages; should be unique for each anacron job command that will be executed
Anacron jobs are run by crond, and permit the execution of periodic jobs on a machine that is not always powered on, such as a laptop.
Only the superuser can schedule anacron jobs, which have a granularity of one day (vs one minute for cron jobs).
The file /var/spool/anacron/job_identifier contains the date of the last execution of the specified anacron job.
Linux Quick Reference Guide 4 th ed. June 2016 © Daniele Raffo www.crans.org/~raffo
71/150
at is used for scheduled execution of commands that must run only once.
If /etc/at.allow exists, only users listed therein can access the service.
If /etc/at.deny exists, all users except those listed therein can access the service.
If none of these files exist, no user except root can access the service.
at 5:00pm tomorrow myscript.sh
at -f mylistofcommands.txt 5:00pm tomorrow echo "rm file" | at now+2 minutes at -l atq at -d 3 atrm 3
Execute a command once at the specified time (absolute or relative)
List the scheduled jobs
Remove job number 3 from the list
at
at
Linux Quick Reference Guide 4 th ed. June 2016 © Daniele Raffo www.crans.org/~raffo
bc cal units banner figlet sensors beep speaker-test on_ac_power ipcalc pwgen cloc
72/150 Utilities
Utilities
Calculator
Calendar
Converter of quantities between different units
Print a message in large letters
Print sensor chips information (e.g. temperature)
Produce a beep from the machine's speakers
Speaker test tone generator for the ALSA (Advanced Linux Sound Architecture) framework
Return an exit code of 0 (true) if the machine (e.g. a laptop) is currently connected to AC power,
1 if it runs battery-powered
IP addresses calculator
Password generator
Count lines of source code and comments on a project' files gnome-terminal
GNOME shell terminal (GUI application)
Linux Quick Reference Guide 4 th ed. June 2016 © Daniele Raffo www.crans.org/~raffo
73/150 Localization
LANG
LANGUAGE
LC_CTYPE
LC_NUMERIC
LC_TIME
LC_COLLATE
LC_MONETARY
LC_MESSAGES
LC_PAPER
LC_NAME
LC_ADDRESS
LC_TELEPHONE
LC_MEASUREMENT
LC_IDENTIFICATION
LC_ALL
Localization
Locale environment variables
Language, stored in /etc/default/locale .
When scripting, LANG=C should be set because this specifies the minimal locale environment for C translation, and guarantees a standard collation and formats for the execution of scripts
Character classification and case conversion
Non-monetary numeric formats
Date and time formats
Alphabetical order
Monetary formats
Language and encoding of system messages and user input
Paper size
Personal name formats
Geographic address formats
Telephone number formats
Measurement units (metric or others)
Metadata about locale
Special variable overriding all others
These locale variables are in the format
language_territory.encoding e.g.
en_US.UTF-8
The list of supported locales is stored in
/usr/share/i18n/SUPPORTED locale locale-gen it_IT.UTF-8 apt-get install manpages-it language-pack-it iconv -f IS6937 -t IS8859 filein > fileout
Show locale environment variables
Generate a locale by compiling a list of locale definition files
Install a different locale (system messages and manpages)
Convert a text file from a codeset to another
ISO/IEC-8859 is a standard for 8-bit encoding of printable characters.
The first 256 characters in ISO/IEC-8859-1 (Latin-1) are identical to those in Unicode.
UTF-8 encoding can represent every character in the Unicode set, and was designed for backward compatibility with ASCII.
Linux Quick Reference Guide 4 th ed. June 2016 © Daniele Raffo www.crans.org/~raffo
74/150
date date -d "9999 days ago" date -d "1970/01/01 + 4242" date +"%F %H:%M:%S" date -s "20130305 23:30:00" date 030523302013
System time
System time
Show current date and time
Calculate a date and show it
Convert a number of days (4242) passed since the Unix Epoch in a canonical date
Show current date in the format specified
Set the date
Set the date, in the format MMDDhhmmYYYY timedatectl timedatectl set-time 2013-03-05 timedatectl set-time 23:30 timedatectl list-timezones
Show current date and time
Set the date
List all possible timezones zdump GMT
Show current date and time in the GMT timezone tzselect tzconfig dpkg-reconfigure tzdata (Debian) timedatectl set-timezone tz (Red Hat)
Set the timezone
/etc/timezone (Debian)
/etc/localtime (Red Hat)
Timezone
Timezone, a symlink to the appropriate timezone file in /usr/share/zoneinfo/ ntpd ntpd -q ntpd -g ntpd -n -g -q
NTP daemon, keeps the clock in sync with Internet time servers
Synchronize the time once and quit
Force NTP to start even if clock is off by more than the panic threshold (1000 secs)
Start NTP as a non-daemon, force set the clock, and quit
Print the list of peers for the time server ntpq -p timeserver ntpdate timeserver ntpdate -b timeserver
Synchronizes the clock with the specified time server
Brutally set the clock, without waiting for a slow adjusting ntpdate -q timeserver
Query the time server without setting the clock
The ntpdate command is deprecated and will be phased out in future Linux releases.
hwclock --show hwclock -r
Show the hardware clock hwclock --hctosys hwclock -s hwclock --systohc hwclock -w hwclock --utc hwclock --localtime
Set the system time from the hardware clock
Set the hardware clock from system time
Indicate that the hardware clock is kept in Coordinated Universal Time
Indicate that the hardware clock is kept in local time
Linux Quick Reference Guide 4 th ed. June 2016 © Daniele Raffo www.crans.org/~raffo
75/150
Syslog logging facility: syslogd rsyslogd (Ubuntu 14) klogd
Daemon logging events from user processes
Daemon logging events from kernel processes
Syslog
Syslog
Facility
Creator of the message auth or
security† authpriv cron daemon kern lpr mail mark (for syslog internal use) news syslog user uucp local0 ... local7 (custom)
/etc/syslog.conf
# facility.level action
*.info;mail.none;authpriv.none /var/log/messages authpriv.* /var/log/secure mail.* /var/log/maillog
*.alert root
*.emerg * local5.* @10.7.7.7
local7.* /var/log/boot.log
Level
Severity of the message filename
Action
Destination of the message message is written into a logfile emerg or panic† (highest) alert crit err or error† warning or warn† notice info debug (lowest) none (facility disabled)
@hostname user1,user2,user3
* message is sent to a logger server (via UDP port 514) message is sent to users' consoles message is sent to all logged-in users' consoles
† = deprecated logger -p auth.info "Message" Send a message to syslogd with the specified facility and priority man 3 syslog Show the syslog manpage listing facilities and levels logrotate tail -f /var/log/messages less +F /var/log/messages
Rotate logs (by gzipping, renaming, and eventually deleting old logfiles) according to
/etc/logrotate.conf
Print the end of the message log file, moving forward as the file grows (i.e. read logs in real-time)
/var/log/messages
/var/log/syslog
/var/log/kern.log
System and kernel logfiles
In Systemd there is no /var/log/messages ; instead, the command journalctl must be used to view the kernel logs.
Linux Quick Reference Guide 4 th ed. June 2016 © Daniele Raffo www.crans.org/~raffo
76/150
MUA
(Mail User Agent)
mailclient of sender
MTA
(Mail Transfer Agent)
SMTP server of sender
MTA
(Mail Transfer Agent) remote host
MDA
(Mail Delivery Agent) mailserver of recipient
e.g. Pine, Mutt e.g. Sendmail, Exim, Postfix, qmail e.g. Procmail, SpamAssassin
MUA
(Mail User Agent) mailclient of recipient
~/.forward
/etc/aliases
/etc/mail/aliases
/var/spool/mail/user
/var/log/mail.log (Debian)
/var/log/maillog (Red Hat)
Mail address(es) to which forward the user's mail, or mail commands
Aliases database for users on the local machine. Each line has syntax alias: user
Inbox for user on the local machine
Mail logs mail mailx
Commands to send mail mailx -s "Subject" \
-S smtp="mailserver.foobar.com:25" \ [email protected] < messagefile uuencode binaryfile | mail [email protected]
mutt -a binaryfile -- [email protected] < /dev/null
Send a mail message to [email protected], using an external SMTP server
Send a binary file to [email protected] (not recommended because many mailclients will display the received attachment inline)
Send a binary file to [email protected] using the Mutt MUA mbox
Maildir
Mailbox formats
Each mail folder is a single file, storing multiple email messages.
Advantages: universally supported, fast search inside a mail folder.
Disadvantages: issues with file locking, possible mailbox corruption.
Each mail folder is a directory, and contains the subdirectories /cur, /new, and /tmp.
Each email message is stored in its own file with an unique filename ID.
$HOME/Mail/myfolder
The process that delivers an email message writes it to a file in the tmp/ directory, and then moves it to new/. The moving is commonly done by hard linking the file to new/ and then unlinking the file from tmp/, which guarantees that a MUA will not see a partially written message as it never looks in tmp/.
When the MUA finds mail messages in new/ it moves them to cur/.
Advantages: fast location/retrieval/deletion of a specific mail message, no file locking needed, can be used with NFS.
Disadvantages: some filesystems may not efficiently handle a large number of small files, searching text inside all mail messages is slow
$HOME/Mail/myfolder/
Linux Quick Reference Guide 4 th ed. June 2016 © Daniele Raffo www.crans.org/~raffo
77/150 SMTP
220 smtp.example.com ESMTP Postfix
HELO abc.example.org
250 Hello abc.example.org, glad to meet you
MAIL FROM: [email protected]
250 Ok
RCPT TO [email protected]
250 Ok
RCPT TO [email protected]
250 Ok
DATA
354 End data with <CR><LF>.<CR><LF>
From: Alice <[email protected]>
To: Bob <[email protected]>
Cc: Eve <[email protected]>
Date: Wed, 13 August 2014 18:02:43 -0500
Subject: Test message
This is a test message.
.
250 OK id=1OjReS-0005kT-Jj
QUIT
221 Bye
SMTP commands
HELO abc.example.org
EHLO abc.example.org
MAIL FROM: [email protected]
RCPT TO: [email protected]
DATA
QUIT
RSET
HELP
NOOP
VRFY [email protected]
EXPN mailinglist
SMTP
Initiate the conversation and identify client host to server
Like HELO, but tell server to use Extended SMTP
Specify mail sender
Specify mail recipient
Specify data to send. Ended with a dot on a single line
Disconnect
List all available commands
Empty command
Verify the existence of an email address (this command should not be implemented, for security reasons)
Check mailing list membership
first digit
1
4
5
2
3
SMTP response codes
Command accepted, but not processed until client sends confirmation
Command successfully completed
Command accepted, but not processed until client sends more information
Command failed due to temporary errors
Command failed due to permanent errors
second digit
2
5
0
1
Syntax error or command not implemented
Informative response in reply to a request for information
Connection response in reply to a data transmission
Status response in reply to a mail transfer operation
third digit
450
451
452
500
501
502
503
504
211
214
220
221
250
251
354
421
550
551
552
553
554
Specifies further the response
System status or help reply
Help message
The server is ready
The server is ending the conversation
The requested action was completed
The specified user is not local, but the server will forward the mail message
Reply to the DATA command. After getting this, start sending the message body
The mail server will be shut down, try again later
The mailbox that you are trying to reach is busy, try again later
The requested action was not done. Some error occurred in the mail server
The requested action was not done. The mail server ran out of system storage
The last command contained a syntax error or the command line was too long
The parameters or arguments in the last command contained a syntax error
The last command is not implemented in the mail server
The last command was sent out of sequence
One of the parameters of the last command is not implemented by the server
The mailbox that you are trying to reach can't be found or you don't have access rights
The specified user is not local; part of message text will contain a forwarding address
The mailbox that you are trying to reach has run out of space, try again later
The mail address that you specified was not syntactically correct
The mail transaction has failed for unknown causes
Linux Quick Reference Guide 4 th ed. June 2016 © Daniele Raffo www.crans.org/~raffo
78/150 Sendmail
Sendmail
Sendmail is distributed as a monolithic binary file.
Previous versions used to run SUID root, which caused many security problems; recent versions run SGID smmsp, the group that has write access on the mail queue.
Sendmail uses smrsh, a restricted shell, to run some external programs.
/etc/mail/submit.cf
/etc/mail/sendmail.cf
Sendmail local mail transfer configuration file
Sendmail MTA configuration file
The .cf configuration files must not be edited by hand and are generated from editable .mc text files via the m4 command, e.g. m4 /etc/mail/submit.mc > /etc/mail/submit.cf
/etc/mail/access.db
/etc/mail/local-host-names.db
/etc/mail/virtusertable.db
/etc/mail/mailertable.db
/etc/mail/domaintable.db
Access control file to allow or deny access to systems or users
List of domains that must be considered as local accounts
Map for local accounts, used to distribute incoming email
Routing table, used to dispatch emails from remote systems
Domain table, used for transitions from an old domain to a new one
Map for local accounts, used to specify a different sender for outgoing mail
/etc/mail/genericstable.db
/etc/mail/genericsdomain.db
Local FQDN
The .db database files must not be edited by hand and are generated from editable text files via the makemap command, e.g. makemap hash /etc/mail/access.db < /etc/mail/access
/var/spool/mqueue/ Temporary mailqueue files (where nnn is the Message ID): dfnnn qfnnn
Qfnnn
Mail body
Message envelope with headers and routing information
Message envelope if abandoned hfnnn tfnnn lfnnn nfnnn xfnnn
Message envelope if held / quarantined by a milter (i.e. mail filter)
Temporary file
Lock file
Backup file
Transcript of delivery attempts newaliases sendmail -bi mailq sendmail -bp sendmail -bt sendmail -q hoststat purgestat mailstats praliases
Update the aliases database; must be run after any change to /etc/aliases
Examine the mail queue
Run Sendmail in test mode
Force a queue run
Print statistics about remote hosts usage
Clear statistics about remote host usage
Print statistics about the mailserver
Display email aliases
Linux Quick Reference Guide 4 th ed. June 2016 © Daniele Raffo www.crans.org/~raffo
79/150
Exim is a free MTA, distributed under open source GPL license.
/etc/exim.conf
/usr/local/etc/exim/configure (FreeBSD)
Exim4 configuration file exim4 -bp exim4 -M messageID exim4 -Mrm messageID exim4 -Mvh messageID exim4 -Mvb messageID exim4 -Mvc messageID exim4 -qf domain exim4 -Rff domain exim4 -bV exinext exigrep exicyclog
Examine the mail queue
Attempt delivery of message
Remove a message from the mail queue
See the headers of a message in the mail queue
See the body of a message in the mail queue
See a message in the mail queue
Force a queue run of all queued messages for a domain
Attempt delivery of all queued messages for a domain
Show version and other info
Give the times of the next queue run
Search through Exim logfiles
Rotate Exim logfiles
Exim
Exim
Linux Quick Reference Guide 4 th ed. June 2016 © Daniele Raffo www.crans.org/~raffo
80/150 Postfix
Postfix
Postfix is a fast, secure, easy to configure, open source MTA intended as a replacement for Sendmail. It is implemented as a set of small helper daemons, most of which run in a chroot jail with low privileges. The main ones are: master
Postfix master daemon, always running; starts the other daemons when necessary nqmgr smtpd smtp bounce cleanup local virtual
Queue manager for incoming and outgoing mail, always running
SMTP daemon for incoming mail
SMTP daemon for outgoing mail
Manager of bounce messages
Daemon that verifies the syntax of outgoing messages before they are handed to the queue manager
Daemon that handles local mail delivery
Daemon that handles mail delivery to virtual users
/var/spool/postfix/incoming
/var/spool/postfix/active
/var/spool/postfix/deferred
/var/spool/postfix/bounce
/var/spool/postfix/defer
/var/spool/postfix/trace
Incoming queue.
All new mail entering the Postfix queue is written here by the cleanup daemon.
Under normal conditions this queue is nearly empty
Active queue.
Contains messages ready to be sent. The queue manager places messages here from the incoming queue as soon as they are available
Deferred queue.
A message is placed here when all its deliverable recipients are delivered, and for some recipients delivery failed for a transient reason. The queue manager scans this queue periodically and puts some messages into the active queue for a retry
Message delivery status report about why mail is bounced (non-delivered mail)
Message delivery status report about why mail is delayed (non-delivered mail)
Message delivery status report (delivered mail) postfix reload postconf -e 'mydomain = example.org' postconf -l postconf -m postconf -v postmap dbtype:textfile postmap hash:/etc/postfix/transport postalias newaliases postsuper
Reload configuration
Edit a setting in the Postfix configuration
List supported mailbox lock methods
List supported database types
Increase logfile verbosity
Manage Postfix lookup tables, creating a hashed map file of database type dbtype from textfile
Regenerate the transport database
Convert /etc/aliases into the aliases database file /etc/aliases.db
Operate on the mail queue
Linux Quick Reference Guide 4 th ed. June 2016 © Daniele Raffo www.crans.org/~raffo
81/150 Postfix configuration
mydomain = example.org
myorigin = $mydomain
Postfix configuration
/etc/postfix/main.cf Postfix main configuration file
This system's domain
Domain from which all sent mail will appear to originate myhostname = foobar.$mydomain inet_interfaces = all proxy_interfaces = 1.2.3.4
mynetworks = 10.3.3.0/24 !10.3.3.66
mydestination = $myhostname, localhost,
$mydomain, example.com,
hash:/etc/postfix/otherdomains relayhost = 10.6.6.6
This system's hostname
Network interface addresses that this system receives mail on.
Value can also be localhost, all, or loopback-only
Network interface addresses that this system receives mail on by means of a proxy or NAT unit
Networks the SMTP clients are allowed to connect from
Domains for which Postfix will accept received mail.
Value can also be a lookup database file e.g. a hashed map relay_domains = $mydestination virtual_alias_domains = virtualex.org
virtual_alias_maps = /etc/postfix/virtual or virtual_alias_domains = hash:/etc/postfix/virtual
Relay host to which Postfix should send all mail for delivery, instead of consulting DNS MX records
Sources and destinations for which mail will be relayed.
Can be empty if Postfix is not intended to be a mail relay
Set up Postfix to handle mail for virtual domains too.
The /etc/postfix/virtual file is a hashed map, each line of the file containing the virtual domain email address and the destination real domain email address: [email protected] [email protected] [email protected] kim.smith
@virtualex.org root
The last line is a catch-all specifying that all other email messages to the virtual domain are delivered to the root user on the real domain mailbox_command = /usr/bin/procmail Use Procmail as MDA
A line beginning with whitespace or tab is a continuation of the previous line.
A line beginning with a # is a comment. The # is not a comment delimiter if it is not placed at the beginning of a line.
service
/etc/postfix/master.cf Postfix master daemon configuration file
# service type private unpriv chroot wakeup maxproc command + args smtp inet n - - - - smtpd pickup fifo n - - 60 1 pickup cleanup unix n - - - 0 cleanup qmgr fifo n - - 300 1 qmgr rewrite unix - - - - - trivial-rewrite bounce unix - - - - 0 bounce defer unix - - - - 0 bounce flush unix n - - 1000? 0 flush smtp unix - - - - - smtp showq unix n - - - - showq error unix - - - - - error local unix - n n - - local virtual unix - n n - - virtual lmtp unix - - n - - lmtp
Name of the service
type private
Transport mechanism used by the service
Whether the service is accessible only by Postfix daemons and not by the whole system. Default is yes
unprivileged
Whether the service is unprivileged i.e. not running as root. Default is yes
chroot
Whether the service is chrooted. Default is yes
wakeup maxproc
How often the service needs to be woken up by the master daemon. Default is never
Max number of simultaneous processes providing the service. Default is 50
command
Command used to start the service
The - indicates that an option is set to its default value.
Linux Quick Reference Guide 4 th ed. June 2016 © Daniele Raffo www.crans.org/~raffo
82/150
Procmail is a regex-based MDA whose main purpose is to preprocess and sort incoming email messages.
It is able to work both with the standard mbox format and the Maildir format.
To have all email processed by Procmail, the ~/.forward file may be edited to contain:
"|exec /usr/local/bin/procmail || exit 75"
Procmail
Procmail
/etc/procmailrc
~/.procmailrc
procmail -h formail lockfile mailstat
System-wide recipes
User's recipes
List all Procmail flags for recipes
Utility for email filtering and editing
Utility for mailbox file locking
Utility for generation of reports from Procmail logs
/etc/procmailrc and ~/.procmailrc Procmail recipes
PATH=$HOME/bin:/usr/bin:/bin:/usr/sbin:/sbin
MAILDIR=$HOME/Mail
DEFAULT=$MAILDIR/Inbox
LOGFILE=$HOME/.procmaillog
Common parameters, non specific to Procmail
:0h: or :0:
* ^From: .*(alice|bob)@foobar\.org
$DEFAULT
Flag: match headers (default) and use file locking (highly recommended when writing to a file or a mailbox in mbox format)
Condition: match the header specifying the sender address
Destination: default mailfolder
:0:
* ^From: .*owner@listserv\.com
* ^Subject:.*Linux
$MAILDIR/Geekstuff1
:0
* ^From: .*owner@listserv\.com
* ^Subject:.*Linux
$MAILDIR/Geekstuff2/
Conditions: match sender address and subject headers
Destination: specified mailfolder, in mbox format
Flag: file locking not necessary because using Maildir format
Conditions: match sender address and subject headers
Destination: specified mailfolder, in Maildir format
# Blacklisted by SpamAssassin
:0
* ^X-Spam-Status: Yes
/dev/null
:0B:
* hacking
$MAILDIR/Geekstuff
:0HB:
* hacking
$MAILDIR/Geekstuff
:0:
* > 256000
| /root/myprogram
:0fw
* ^From: .*@foobar\.org
| /root/myprogram
:0c
* ^Subject:.*administration
:0:
$MAILDIR/Forwarded
Flag: file locking not necessary because blackholing to /dev/null
Condition: match SpamAssassin's specific header
Destination: delete the message
Flag: match body of message instead of headers
Flag: match either headers or body of message
Condition: match messages larger than 256 Kb
Destination: pipe message through the specified program
Flags: use the pipe as a filter (modifying the message), and tell
Procmail to wait that the filter finished processing the message
Flag: copy the message and proceed with next recipe
Destination: forward to specified email address, and (as ordered by the next recipe) save in the specified mailfolder
Linux Quick Reference Guide 4 th ed. June 2016 © Daniele Raffo www.crans.org/~raffo
83/150 Courier POP
The Courier MTA provides modules for ESMTP, IMAP, POP3, webmail, and mailing list services in a single framework.
Courier POP
The courier-authlib service must be launched first, then the desired mail service e.g. courier-imap for the IMAP service.
/usr/lib/courier-imap/etc/ or
/etc/courier/ imapd imapd-ssl pop3d pop3d-ssl
Courier IMAP daemon configuration
Courier IMAPS daemon configuration
Courier POP3 daemon configuration
Courier POP3S daemon configuration
/usr/lib/courier-imap/share/ mkimapdcert mkpop3dcert makealiases
Directory for public and private keys
Generate a certificate for the IMAPS service
Generate a certificate for the POP3 service
Create system aliases in /usr/lib/courier/etc/aliases.dat , which is made by processing a /usr/lib/courier/etc/aliases/system text file: root : postmaster mailer-daemon : postmaster
MAILER-DAEMON : postmaster uucp : postmaster postmaster : admin
ADDRESS=0
/usr/lib/courier-imap/etc/pop3d Courier POP configuration file
Address to listen on. 0 means all addresses
PORT=127.0.0.1.900,192.168.0.1.900
POP3AUTH="LOGIN CRAM-MD5 CRAM-SHA1"
Port number connections are accepted on. Accept connections on port 900 on IP addresses 127.0.0.1 and 192.168.0.1
POP authentication advertising SASL (Simple Authentication and
Security Layer) capability, with CRAM-MD5 and CRAM-SHA1
POP3AUTH_TLS="LOGIN PLAIN"
MAXDAEMONS=40
MAXPERIP=4
PIDFILE=/var/run/courier/pop3d.pid
TCPDOPTS="-nodnslookup -noidentlookup"
Also advertise SASL PLAIN if SSL is enabled
Maximum number of POP3 servers started
Maximum number of connections to accept from the same IP address
PID file
Miscellaneous couriertcpd options that shouldn't be changed
LOGGEROPTS="-name=pop3d"
POP3_PROXY=0
PROXY_HOSTNAME=myproxy
DEFDOMAIN="@example.com"
POP3DSTART=YES
MAILDIRPATH=Maildir courierlogger options
Enable or disable proxying
Override value from gethostname() when checking if a proxy connection is required
Optional default domain. If the username does not contain the first character of DEFDOMAIN, then it is appended to the username. If
DEFDOMAIN and DOMAINSEP are both set, then DEFDOMAIN is appended only if the username does not contain any character from DOMAINSEP
Flag intended to be read by the system startup script
Name of the maildir directory
Linux Quick Reference Guide 4 th ed. June 2016 © Daniele Raffo www.crans.org/~raffo
84/150 Courier IMAP
Courier IMAP
ADDRESS=0
/usr/lib/courier-imap/etc/imapd Courier IMAP configuration file
Address to listen on. 0 means all addresses
PORT=127.0.0.1.900,192.168.0.1.900
AUTHSERVICE143=imap
Port number connections are accepted on. Accept connections on port 900 on IP addresses 127.0.0.1 and 192.168.0.1
Authenticate using a different service parameter depending on the connection's port. This only works with authentication modules that use the service parameter, such as PAM
MAXDAEMONS=40
MAXPERIP=20
PIDFILE=/var/run/courier/imapd.pid
TCPDOPTS="-nodnslookup -noidentlookup"
Maximum number of IMAP servers started
Maximum number of connections to accept from the same IP address
File where couriertcpd will save its process ID
Miscellaneous couriertcpd options that shouldn't be changed
LOGGEROPTS="-name=imapd"
DEFDOMAIN="@example.com"
IMAP_CAPABILITY="IMAP4rev1 UIDPLUS \
CHILDREN NAMESPACE THREAD=ORDEREDSUBJECT \
THREAD=REFERENCES SORT QUOTA IDLE"
IMAP_KEYWORDS=1 courierlogger options
Optional default domain. If the username does not contain the first character of DEFDOMAIN, then it is appended to the username. If
DEFDOMAIN and DOMAINSEP are both set, then DEFDOMAIN is appended only if the username does not contain any character from DOMAINSEP
Specifies what most of the response should be to the CAPABILITY command
IMAP_ACL=1
SMAP_CAPABILITY=SMAP1
IMAP_PROXY=0
IMAP_PROXY_FOREIGN=0
IMAP_IDLE_TIMEOUT=60
IMAP_CHECK_ALL_FOLDERS=0
IMAP_UMASK=022
IMAP_ULIMITD=131072
Enable or disable custom IMAP keywords. Possible values are:
0 disable keywords
1 enable keywords
2 enable keywords with a slower algorithm
Enable or disable IMAP ACL extension
Enable the experimental Simple Mail Access Protocol extensions
Enable or disable proxying
Proxying to non-Courier servers. Re-sends the CAPABILITY command after logging in to remote server. May not work with all IMAP clients
How often, in seconds, the server should poll for changes to the folder while in IDLE mode
Enable or disable server check for mail in every folder
Set the umask of the server process. This value is passed to the umask command. This feature is mostly useful for shared folders, where the file permissions of the messages may be important
Set the upper limit of the size of the data segment of the server process, in Kb. This value is passed to the ulimit -d command.
This feature is used as an additional safety check that should stop any potential DoS attacks that exploit any kind of a memory leak to exhaust all the available memory on the server
IMAP_USELOCKS=1
IMAP_SHAREDINDEXFILE=\
/etc/courier/shared/index
IMAP_TRASHFOLDERNAME=Trash
IMAP_EMPTYTRASH=Trash:7,Sent:30
IMAP_MOVE_EXPUNGE_TO_TRASH=0
HEADERFROM=X-IMAP-Sender
MAILDIRPATH=Maildir
Enable or disable dot-locking to support concurrent multiple access to the same folder. Strongly recommended when using shared folders
Index of all accessible folders.
Normally, this setting should not be changed
Name of the trash folder
Purge folders i.e. delete all messages from the specified folders after the specified number of days
Enable or disable moving expunged messages to the trash folder
(instead of straight deleting them)
Make the return address, $SENDER, being saved in the
X-IMAP-Sender mail header. This header gets added to the sent message (but not in the copy of the message saved in the folder)
Name of the mail directory
Linux Quick Reference Guide 4 th ed. June 2016 © Daniele Raffo www.crans.org/~raffo
85/150 Dovecot login
Dovecot login
Dovecot is an open source, security-hardened, fast and efficient IMAP and POP3 server.
By default it uses PAM authentication. The script mkcert.sh can be used to create self-signed SSL certificates.
base_dir = /var/run/dovecot/ protocols = imaps pop3s listen = *, [::] disable_plaintext_auth = yes shutdown_clients = yes log_path = /dev/stderr info_log_path = /dev/stderr syslog_facility = mail login_chroot = yes login_user = dovecot login_process_size = 64 login_processes_count = 3 login_max_processes_count = 128 login_max_connections = 256 login_greeting = Dovecot ready.
login_trusted_networks = \
10.7.7.0/24 10.8.8.0/24 mbox_read_locks = fcntl mbox_write_locks = dotlock fcntl maildir_stat_dirs = no dbox_rotate_size = 2048 dbox_rotate_min_size = 16
/etc/dovecot.conf Dovecot configuration file
Base directory where to store runtime data
Protocols to serve. If Dovecot should use dovecot-auth, this can be set to none
Network interfaces to accept connections on.
Here, listen to all IPv4 and IPv6 interfaces
Disable LOGIN command and all other plaintext authentications unless
SSL/TLS is used (LOGINDISABLED capability)
Kill all IMAP and POP3 processes when Dovecot master process shuts down. If set to no, Dovecot can be upgraded without forcing existing client connections to close login_dir = /var/run/dovecot/login login_process_per_connection = yes
!include /etc/dovecot/conf.d/*.conf
!include_try /etc/dovecot/extra.conf
Log file to use for error messages, instead of sending them to syslog.
Here, log to stderr
Log file to use for informational and debug messages. Default value is the same as log_path
Syslog facility to use if logging to syslog
Directory where the authentication process places authentication UNIX sockets, to which the login process needs to be able to connect
Chroot login process to the login_dir
User to use for the login process. This user is used to control access for authentication process, and not to access mail messages
Maximum login process size, in Mb
If yes, each login is processed in its own process (more secure); if no, each login process processes multiple connections (faster)
Number of login processes to keep for listening for new connections
Maximum number of login processes to create
Maximum number of connections allowed per each login process.
This setting is used only if login_process_per_connection = no; once the limit is reached, the process notifies master so that it can create a new login process
Greeting message for clients
Trusted network ranges (usually IMAP proxy servers).
Connections from these IP addresses are allowed to override their IP addresses and ports, for logging and authentication checks. disable_plaintext_auth is also ignored for these networks
Locking methods to use for locking mailboxes in mbox format.
Possible values are: dotlock Create mailbox.lock file; oldest and NSF-safe method dotlock_try Same as dotlock, but skip if failing fcntl Recommended; works with NFS too if lockd is used flock May not exist in all systems; doesn't work with NFS lockf May not exist in all systems; doesn't work with NFS
Option for mailboxes in Maildir format. If no (default), the LIST command returns all entries in the mail directory beginning with a dot.
If yes, returns only entries which are directories
Maximum and minimum file size, in Kb, of a mailbox in dbox format until it is rotated
Include configuration file
Include optional configuration file, do not give error if file not found
Linux Quick Reference Guide 4 th ed. June 2016 © Daniele Raffo www.crans.org/~raffo
86/150 Dovecot mailboxes
Dovecot mailboxes
/etc/dovecot.conf Dovecot configuration file
mail_location = \ mbox:~/mail:INBOX=/var/spool/mail/%u or mail_location = maildir:~/Maildir
Mailbox location, in mbox or Maildir format. Variables:
%u username
%n user part in user@domain, same as %u if there is no domain
%d domain part in user@domain, empty if there is no domain
%h home directory namespace shared {
separator = /
prefix = shared/%%u/
location = maildir:%%h/Maildir:\
INDEX=~/Maildir/shared/%%u
Definition of a shared namespace, for accessing other users' mailboxes that have been shared.
Private namespaces are for users' personal emails.
Public namespaces are for shared mailboxes managed by root user
Hierarchy separator to use. Should be the same for all namespaces; it depends on the underlying mail storage format
Prefix required to access this namespace; must be different for each.
Here, mailboxes are visible under shared/user@domain/ ; the variables
%%n, %%d and %%u are expanded to the destination user
Mailbox location for other users' mailboxes; it is in the same format as mail_location which is also the default for it.
%variable and ~/ expand to the logged in user's data;
%%variable expands to the destination user's data
inbox = no
hidden = no
subscriptions = no
list = children
There can be only one INBOX, and this setting defines which namespace has it
Define whether the namespace is hidden i.e. not advertised to clients via NAMESPACE extension
Namespace handles its own subscriptions; if set to no, the parent namespace handles them and Dovecot uses the default namespace for saving subscriptions. If prefix is empty, this should be set to yes
Show the mailboxes under this namespace with LIST command, making the namespace visible for clients that do not support the
NAMESPACE extension.
Here, lists child mailboxes but hide the namespace prefix; list the namespace only if there are visible shared mailboxes
} mail_uid = 666 mail_gid = 666 mail_privileged_group = mail
UID and GID used to access mail messages mail_access_groups = tmpmail lock_method = fcntl first_valid_uid = 500 last_valid_uid = 0 first_valid_gid = 1 last_valid_gid = 0 max_mail_processes = 512 mail_process_size = 256 valid_chroot_dirs = mail_chroot = mailbox_idle_check_interval = 30
Group to enable temporarily for privileged operations; currently this is used only with INBOX when its initial creation or a dotlocking fails
Supplementary groups to grant access to for mail processes; typically these are used to set up access to shared mailboxes
Locking method for index files. Can be fcntl, flock, or dotlock
Valid UID range for users; default is 500 and above. This makes sure that users cannot login as daemons or other system users.
Denying root login is hardcoded to Dovecot and cannot be bypassed
Valid GID range for users; default is non-root/wheel. Users having non-valid primary GID are not allowed to login
Maximum number of running mail processes. When this limit is reached, new users are not allowed to login
Maximum mail process size, in Mb
List of directories under which chrooting is allowed for mail processes
Default chroot directory for mail processes. Usually not needed as
Dovecot does not allow users to access files outside their mail directory
When IDLE command is running, mailbox is checked once in a while to see if there are any new mails or other changes. This setting defines the minimum time to wait between these checks, in seconds
Linux Quick Reference Guide 4 th ed. June 2016 © Daniele Raffo www.crans.org/~raffo
87/150 Dovecot POP and IMAP
protocol pop3 {
listen = *:110
Dovecot POP and IMAP
/etc/dovecot.conf Dovecot configuration file
Block with options for the POP3 protocol
Network interfaces to accept POP3 connections on
login_executable = /usr/libexec/dovecot/pop3-login
mail_executable = /usr/libexec/dovecot/pop3
Location of the POP3 login executable
Location of the POP3 mail executable
pop3_no_flag_updates = no
pop3_lock_session = no
pop3_uidl_format = %08Xu%08Xv
If set to no, do not try to set mail messages non-recent or seen with POP3 sessions, to reduce disk I/O.
With Maildir format do not move files from new/ to cur/, with mbox format do not write Status- headers
Whether to keep the mailbox locked for the whole POP3 session
POP3 UIDL (Unique Mail Identifier) format to use
} protocol imap {
listen = *:143
ssl_listen = *:993
login_executable = /usr/libexec/dovecot/imap-login
mail_executable = /usr/libexec/dovecot/imap
mail_max_userip_connections = 10
imap_idle_notify_interval = 120
Block with options for the IMAP protocol
Network interfaces to accept IMAP and IMAPS connections on
Location of the IMAP login executable
Location of the IMAP mail executable
Maximum number of IMAP connections allowed for a user from each IP address
How many seconds to wait between "OK Still here" notifications when client is IDLE
} ssl = yes ssl_cert_file = /etc/ssl/certs/dovecot-cert.pem
ssl_key_file = /etc/ssl/private/dovecot-key.pem
ssl_key_password = b1gs3cr3t ssl_ca_file = /etc/dovecot/cafile.pem
ssl_verify_client_cert = yes ssl_cipher_list = ALL:!LOW:!SSLv2
verbose_ssl = yes
SSL/TLS support.
Possible values are yes, no, required
Location of the SSL certificate
Location of private key
Password of private key, if it is password-protected.
Since /etc/dovecot.conf is usually world-readable, it is better to place this setting into a root-owned 0600 file instead and include it via the setting
!include_try /etc/dovecot/dovecot-passwd.conf .
Alternatively, Dovecot can be started with dovecot -p b1gs3cr3t
List of trusted SSL certificate authorities; the file contains the CA certificates followed by the CRLs
Request client to send a certificate
List of SSL ciphers to use
Show protocol level SSL errors
Linux Quick Reference Guide 4 th ed. June 2016 © Daniele Raffo www.crans.org/~raffo
88/150 Dovecot authentication
Dovecot authentication
auth_process_size = 256
/etc/dovecot.conf Dovecot configuration file
auth_executable = /usr/libexec/dovecot/dovecot-auth Location of the authentication executable
Max authentication process size, in Mb auth_username_chars = abcde ... VWXYZ01234567890.-_@ auth_realms =
List of allowed characters in the username. If the username entered by user contains a character not listed in here, the login automatically fails. This is to prevent an user exploiting any potential quote escaping vulnerabilities with SQL/LDAP databases
List of realms for SASL authentication mechanisms that need them. If empty, multiple realms are not supported auth_default_realm = example.org
auth_anonymous_username = anonymous auth_verbose = no auth_debug = no auth_failure_delay = 2
Default realm/domain to use if none was specified
Username to assign to users logging in with ANONYMOUS
SASL mechanism
Whether to log unsuccessful authentication attempts and the reasons why they failed
Whether to enable more verbose logging (e.g. SQL queries) for debugging purposes
Delay before replying to failed authentications, in seconds auth default {
mechanisms = plain login cram-md5
passdb passwd-file {
args = /etc/dovecot.deny
deny = yes
}
passdb pam {
args = cache_key=%u%r dovecot
}
Accepted authentication mechanisms
Deny login to the users listed in /etc/dovecot.deny (file contains one user per line)
PAM authentication block.
Enable authentication matching (username and remote IP address) for PAM.
System users e.g. NSS or /etc/passwd passdb passwd {
blocking = yes
args =
}
passdb shadow {
blocking = yes
args =
}
passdb bsdauth {
cache_key = %u
args =
}
passdb sql {
args = /etc/dovecot/dovecot-sql.conf
}
passdb ldap {
args = /etc/dovecot/dovecot-ldap.conf
}
socket listen {
master {
path = /var/run/dovecot/auth-master
mode = 0600
user =
group =
}
client {
path = /var/run/dovecot/auth-client
mode = 0660
}
}
}
Shadow passwords for system users e.g. NSS or
/etc/passwd
PAM-like authentication for OpenBSD
SQL database
LDAP database
Export the authentication interface to other programs.
Master socket provides access to userdb information; it is typically used to give Dovecot's local delivery agent access to userdb so it can find mailbox locations. The default user/group is the one who started dovecot-auth
(i.e. root).
The client socket is generally safe to export to everyone.
Typical use is to export it to the SMTP server so it can do
SMTP AUTH lookups using it
Linux Quick Reference Guide 4 th ed. June 2016 © Daniele Raffo www.crans.org/~raffo
89/150
Active mode (default)
1. Client connects to FTP server on port 21 (control channel) and sends second unprivileged port number
2. Server acknowledges
3. Server connects from port 20 (data channel) to client's second unprivileged port number
4. Client acknowledges
Passive mode (more protocol-compliant, because it is the client that initiates the connection)
1. Client connects to FTP server on port 21 and requests passive mode via the PASV command
2. Server acknowledges and sends unprivileged port number via the PORT command
3. Client connects to server's unprivileged port number
4. Server acknowledges
FTP
FTP
Very Secure FTP
Pure-FTP ftp lftp
FTP servers
A hardened and high-performance FTP implementation. The vsftpd daemon operates with multiple processes that run as a non-privileged user in a chrooted jail.
A free, easy-to-use FTP server.
pure-ftpd
Pure-FTP daemon pure-ftpwho
Show clients connected to the Pure-FTP server pure-mrtginfo pure-statsdecode pure-pw pure-pwconvert
Show connections to the Pure-FTP server as a MRTG graph
Show Pure-FTP log data
Manage Pure-FTP virtual accounts
Convert the system user database to a Pure-FTP virtual accounts database pure-quotacheck pure-uploadscript
Manage Pure-FTP quota database
Run a command on the Pure-FTP server to process an uploaded file
FTP clients
Standard FTP client.
A sophisticated FTP client with support for HTTP and BitTorrent.
lftp ftpserver.domain.org
Connect to a FTP server and tries an anonymous login
Linux Quick Reference Guide 4 th ed. June 2016 © Daniele Raffo www.crans.org/~raffo
90/150 vsftpd
vsftpd
listen=NO local_enable=YES chroot_local_user=YES
/etc/vsftpd/vsftpd.conf Very Secure FTP server configuration file
Run vsftpd in standalone mode (i.e. not via inetd)?
Allow local system users (i.e. in /etc/passwd) to log in?
Chroot local users in their home directory?
write_enable=YES anonymous_enable=YES anon_root=/var/ftp/pub anon_upload_enable=YES
Allow FTP commands that write on the filesystem (i.e.
STOR, DELE, RNFR, RNTO, MKD, RMD, APPE and SITE)?
Allow anonymous logins? If yes, anonymous and ftp are accepted as logins
After anonymous login, go to directory /var/ftp/pub
Allow anonymous uploads?
chown_uploads=YES chown_username=ftp anon_world_readable_only=NO ssl_enable=YES force_local_data_ssl=NO force_local_logins_ssl=YES allow_anon_ssl=YES ssl_tlsv1=YES ssl_tlsv2=NO ssl_tlsv3=NO rsa_cert_file=/etc/pki/tls/certs/vsftpd.pem
rsa_private_key_file=/etc/pki/tls/certs/vsftpd.pem
Change ownership of anonymously uploaded files?
Change ownership of anonymously uploaded files to user ftp
Allow anonymous users to only download files which are world readable?
Enable SSL?
Encrypt local data?
Force encrypted authentication?
Allow anonymous users to use SSL?
Versions of SSL/TLS to allow
Location of certificate file
Location of private key file
Linux Quick Reference Guide 4 th ed. June 2016 © Daniele Raffo www.crans.org/~raffo
91/150
cupsd
CUPS
CUPS (Common Unix Printing System) daemon.
Administration of printers is done via web interface on http://localhost:631
CUPS
/etc/cups/cupsd.conf
/etc/cups/printers.conf
/etc/printcap
/var/spool/cups/
/var/log/cups/error_log
/var/log/cups/page_log
/etc/init.d/cupsys start
CUPS configuration file
Database of available local CUPS printers
Database of printer capabilities, for old printing applications
Printer spooler for data awaiting to be printed
CUPS error log
Information about printed pages
Start the CUPS service gnome-cups-manager cupsenable printer0 cupsdisable printer0 cupsaccept printer0 cupsreject -r "Rejected" printer0 cupstestppd LEXC510.ppd
cupsaddsmb printer0
Run the CUPS Manager graphical application
Enable a CUPS printer
Disable a CUPS printer
Accept a job sent on a printer queue
Reject a job sent on a printer queue, with an informational message
Test the conformance of a PPD file to the format specification
Export a printer to Samba (for use with Windows clients) cups-config --cflags cups-config --datadir cups-config --ldflags cups-config --libs cups-config --serverbin cups-config --serverroot lpq lpq -P printer0 lpq jdoe lprm -P printer0 5 lprm -P printer0 jdoe lprm -P printer0 lpc a2ps file.txt
ps2pdf file.ps
mpage file.ps
gv file.ps
Show the necessary compiler options
Show the default CUPS data directory
Show the necessary linker options
Show the necessary libraries to link to
Show the default CUPS binaries directory that stores filters and backends
Show the default CUPS configuration file directory lpstat lpadmin lpadmin -p printer0 -P LEXC750.ppd
lp -d printer0 file
Show CUPS status information
Administer CUPS printers
Specify a PPD (Adobe PostScript Printer Description) file to associate to a printer
Print a file on the specified printer
View the default print queue
View a specific print queue
View the print queue of a specific user
Delete a specific job from a printer queue
Delete all jobs from a specific user from a printer queue
Delete all jobs from a printer queue
Manage print queues
Convert a text file to PostScript
Convert a file from PostScript to PDF
Print a PostScript document on multiple pages per sheet on a PostScript printer
View a PostScript document (the gv software is derived from GhostView)
Linux Quick Reference Guide 4 th ed. June 2016 © Daniele Raffo www.crans.org/~raffo
92/150 IP addressing
IP addressing
Classful
Private
Reserved
Class A (Unicast)
Class B (Unicast)
Class C (Unicast)
Class D (Multicast)
Class E (Experimental)
Private Class A
Private Class B
Private Class C
Source
Loopback
Autoconf
TEST-NET
6to4 relay anycast
Device benchmarks
IPv4 classful addressing (assigned by IANA)
Address range
0.0.0.0 – 127.255.255.255
first octet: 0XXX XXXX
128.0.0.0 – 191.255.255.255
first octet: 10XX XXXX
192.0.0.0 – 223.255.255.255
first octet: 110X XXXX
224.0.0.0 – 239.255.255.255
first octet: 1110 XXXX
240.0.0.0 – 255.255.255.255
first octet: 1111 XXXX
10.0.0.0 – 10.255.255.255
172.16.0.0 – 172.31.255.255
192.168.0.0 – 192.168.255.255
0.0.0.0 – 0.255.255.255
127.0.0.0 – 127.255.255.255
169.254.0.0 – 169.254.255.255
192.0.2.0 – 192.0.2.255
192.88.99.0 – 192.88.99.255
198.18.0.0 – 198.19.255.255
IPv4 address: 32-bit long, represented divided in four octets (dotted-quad). e.g. 193.22.33.44
4 × 10 9 total addresses
Prefix
/8
/16
/24
/4
/4
10.0.0.0/8
172.16.0.0/12
192.168.0.0/16
0.0.0.0/8
127.0.0.0/8
169.254.0.0/16
192.0.2.0/24
192.88.99.0/24
198.18.0.0/15
Number of addresses
128 networks ×
16,777,216 addresses
16,384 networks ×
65,536 addresses
2,097,152 networks ×
256 addresses
268,435,456
268,435,456
16,777,216
1,048,576
65,536
16,777,216
16,777,216
65,536
256
256
131,072
Reference
RFC 791
RFC 791
RFC 791
RFC 3171
RFC 1166
RFC 1918
RFC 1918
RFC 1918
RFC 1700
RFC 1700
RFC 3330
RFC 3330
RFC 3068
RFC 2544
Unicast
Link-local
Multicast
IPv6 addressing
64-bit network prefix (>= 48-bit routing prefix + <= 16-bit subnet id) + 64-bit interface identifier
A 48-bit MAC address is transformed into a 64-bit EUI-64 by inserting ff:fe in the middle.
A EUI-64 is then transformed into a IPv6 interface identifier by inverting the 7 th most significant bit. fe80:0000:0000:0000 + 64-bit interface identifier ff + 4-bit flag + 4-bit scope field + 112-bit group ID
IPv6 address: 128-bit long, represented divided in eight 16-bit groups (4 hex digits).
e.g. 2130:0000:0000:0000:0007:0040:15bc:235f which can also be written as 2130::7:40:15bc:235f
Leading zeros in each group can be deleted. A single chunk of one or more adjacent 0000 groups can be deleted.
3 × 10 38 total addresses
Linux Quick Reference Guide 4 th ed. June 2016 © Daniele Raffo www.crans.org/~raffo
93/150 Subnetting
Prefix: /24
Netmask: .0
00000000
1 subnet
254 hosts each
254 total hosts
.0
Prefix: /25
Netmask: .128
10000000
2 subnets
126 hosts each
252 total hosts
VLSM chart - Last octet subnetting (CIDR notation)
Prefix: /26
Netmask: .192
11000000
4 subnets
62 hosts each
248 total hosts
Prefix: /27
Netmask: .224
11100000
8 subnets
30 hosts each
240 total hosts
Prefix: /28
Netmask: .240
11110000
16 subnets
14 hosts each
224 total hosts
Prefix: /29
Netmask: .248
11111000
32 subnets
6 hosts each
192 total hosts
.0
.0
.8
.0
.16
.16
.24
.0
.32
.32
.40
.32
.48
.48
.56
.0
.64
.64
.72
.64
.80
.80
.88
.64
.96
.96
.104
.96
.112
.112
.120
.128
.128
.192
.128
.160
.192
.224
.128
.144
.160
.176
.192
.208
.224
.240
.192
.200
.208
.216
.224
.232
.240
.248
.160
.168
.176
.184
.128
.136
.144
.152
Subnetting
.176
.180
.184
.188
.192
.196
.200
.204
.144
.148
.152
.156
.160
.164
.168
.172
.208
.212
.216
.220
.224
.228
.232
.236
.240
.244
.248
.252
.104
.108
.112
.116
.120
.124
.128
.132
.136
.140
.64
.68
.72
.76
.80
.84
.88
.92
.96
.100
.32
.36
.40
.44
.48
.52
.56
.60
.0
.4
.8
.12
.16
.20
.24
.28
Prefix: /30
Netmask: .252
11111100
64 subnets
2 hosts each
128 total hosts
Each block of a column identifies a subnet, whose range of valid hosts addresses is [network address +1 — broadcast address -1] inclusive.
The network address of the subnet is the number shown inside a block.
The broadcast address of the subnet is the network address of the block underneath -1 or, for the bottom block, .255.
Linux Quick Reference Guide 4 th ed. June 2016 © Daniele Raffo www.crans.org/~raffo
94/150
Most common well-known ports
Port number Service
20 TCP
21 TCP
FTP (data)
FTP (control)
22 TCP
23 TCP
25 TCP
53 TCP/UDP
67 UDP
68 UDP
80 TCP
SSH
Telnet
SMTP
DNS
BOOTP/DHCP (server)
BOOTP/DHCP (client)
HTTP
110 TCP
119 TCP
123 UDP
139 TCP/UDP
143 TCP
161 UDP
443 TCP
465 TCP
POP3
NNTP
NTP
Microsoft NetBIOS
IMAP
SNMP
HTTPS (HTTP over SSL/TLS)
SMTP over SSL
993 TCP
995 TCP
IMAPS (IMAP over SSL)
POP3S (POP3 over SSL)
1-1023: privileged ports, used server-side
1024-65535: unprivileged ports, used client-side
The full list of well-known ports is in /etc/services
Network services
Network services
7
6
5
4
3
2
1
Protocol stack models
ISO/OSI
Application
Presentation
Session
Transport
Network
Data Link
Physical
TCP/IP
Application
Transport
Internet
Network Access e.g. HTTP, SMTP, POP, SSH e.g. TCP, UDP e.g. IPv4, IPv6, ICMP e.g. Ethernet, Wi-Fi, PPP
Note: many network services are run by the xinetd super server.
Linux Quick Reference Guide 4 th ed. June 2016 © Daniele Raffo www.crans.org/~raffo
95/150 Network config commands
Network config commands
Display configuration of all network interfaces ip a ip addr ip addr show ifconfig -a ip link show eth0 ifconfig eth0 ip addr add dev eth0 10.1.1.1/8 ifconfig eth0 10.1.1.1 netmask 255.0.0.0 broadcast 10.255.255.255
ifconfig eth0 hw ether 45:67:89:ab:cd:ef ip link set eth0 up ifconfig eth0 up ifup eth0 ip link set eth0 down ifconfig eth0 down ifdown eth0 dhclient eth0 pump dhcpcd eth0 (SUSE)
Display configuration of eth0
Configure IP address of eth0
Configure MAC address of eth0
Activate eth0
Shut down eth0
Request an IP address via DHCP ip neigh arp -a ip neigh show 10.1.0.6
arp 10.1.0.6
ip neigh add 10.1.0.7 lladdr 01:23:45:67:89:ab dev eth0 arp -s 10.1.0.7 01:23:45:67:89:ab ip neigh del 10.1.0.7 dev eth0 arp -d 10.1.0.7
ip neigh flush all hostname hostname -f hostname mylinuxbox hostnamectl set-hostname --static "mylinuxbox" (RHEL 7) hostnamectl (RHEL 7)
Show the ARP cache table
Show the ARP cache entry for a host
Add a new ARP entry for a host
Delete a ARP entry
Delete the ARP table for all interfaces
Get the hostname
Get the FQDN (Fully Qualified Domain Name)
Set the hostname
Get the hostname, OS, and other information
/etc/init.d/networking restart (Debian)
/etc/init.d/network restart (Red Hat) brctl command bridge
Restart network services
Manage the Ethernet bridge configuration in the Linux kernel ethtool option device ethtool eth0
Query or control network driver and hardware settings
View hardware settings of eth0
Linux Quick Reference Guide 4 th ed. June 2016 © Daniele Raffo www.crans.org/~raffo
96/150
iwlist wlan0 scan iwlist wlan0 freq iwlist wlan0 rate iwlist wlan0 txpower iwlist wlan0 key iwgetid wlan0 option iwconfig wlan0 iwconfig wlan0 option iw dev wlan0 station dump rfkill list rfkill unblock n
Wireless networking
Wireless networking
List all wireless devices in range, with their quality of signal and other information
Display transmission frequency settings
Display transmission speed settings
Display transmission power settings
Display encryption settings
Print NWID, ESSID, AP/Cell address or other information about the wireless network that is currently in use
Display configuration of wireless interface wlan0
Configure wireless interface wlan0
On a wireless card configured in AP Mode, display information (e.g. MAC address, tx/rx, bitrate, signal strength) about the clients
List installed wireless devices
Enable wireless device number n hcidump -i device Display raw HCI (Host Controller Interface) data exchanged with a Bluetooth device
Linux Quick Reference Guide 4 th ed. June 2016 © Daniele Raffo www.crans.org/~raffo
97/150
dig example.org
dig @10.7.7.7 -t MX example.org
dig -x 203.0.113.1
host example.org
host example.org 10.7.7.7
host 192.168.13.13
nslookup example.org (deprecated) whois example.org
ping 10.0.0.2
fping -a 10.0.0.2 10.0.0.7 10.0.0.8
bing 10.0.0.10 10.0.0.11
traceroute 10.0.0.3
tracepath 10.0.0.3
mtr 10.0.0.3
telnet 10.0.0.4 23 ftp 10.0.0.5
wget –-no-clobber –-html-extension \
--page-requisites --convert-links \
--recursive --domains example.org \
--no-parent www.example.org/foobar curl -XPUT 10.0.0.6 -d'data' curl -o file.html www.example.org/file.html
Network tools
Network tools
Perform a DNS lookup for the specified domain or hostname.
Returns information in BIND zone file syntax; uses an internal resolver and hence does not honor /etc/resolv.conf
Perform a DNS lookup for the MX record of the domain example.org, querying nameserver 10.7.7.7
Perform a reverse DNS lookup for the IP address 203.0.113.1
Perform a DNS lookup for the specified domain or hostname.
Does honor /etc/resolv.conf
Perform a DNS lookup for the domain example.org, querying nameserver 10.7.7.7
Perform a reverse DNS lookup for the IP address 192.168.13.13
Perform a DNS lookup for the specified domain or hostname
Query the WHOIS service for an Internet resource, usually a domain name
Test if a remote host can be reached and measure the round-trip time to it (by sending an ICMP ECHO_REQUEST datagram and expecting an ICMP ECHO_RESPONSE)
Ping multiple hosts in parallel and report which ones are alive
Calculate point-to-point throughput between two remote hosts
Print the route, hop by hop, packets trace to a remote host
(by sending a sequence of ICMP ECHO_REQUEST datagrams with increasing TTL values, starting with TTL=1)
Simpler traceroute traceroute and ping combined
Establish a telnet connection to the specified host and port
(if port is omitted, use default port 23)
Establish an interactive FTP connection with host 10.0.0.5
Download a whole website www.example.org/foobar
Send a HTTP PUT command with data to 10.0.0.6
Download a file via HTTP
Linux Quick Reference Guide 4 th ed. June 2016 © Daniele Raffo www.crans.org/~raffo
98/150
netstat netstat –-tcp netstat -t netstat -l netstat -a netstat -n netstat -p netstat -i netstat -s netstat -r netstat -c ss ss -t -a nmap 10.0.0.1
nmap -sS 10.0.0.1
nmap -sP 10.0.0.1
nmap -sU 10.0.0.1
nmap -sV 10.0.0.1
nmap -p 1-65535 10.0.0.1
nmap -O 10.0.0.1
ngrep nload iptraf iptraf-ng netserver netperf iperf -s iperf -c server
Network monitoring
Network monitoring
Display network connections
Display active TCP connections
Display only listening sockets
Display all listening and non-listening sockets
Display network connections, without resolving hostnames or portnames
Display network connections, with PID and name of program to which each socket belongs
Display network interfaces
Display protocol statistics
Display kernel routing tables (equivalent to route -e)
Display network connections continuously
Display socket statistics (similar to netstat)
Display all TCP sockets
Scan for open ports (TCP SYN scan) on remote host 10.0.0.1
Do a ping sweep (ICMP ECHO probes) on remote host
Scan UDP ports on remote host
Do a service and version scan on open ports
Scan all ports (1-65535) on remote host, not only the common ports
Find which operating system is running on remote host (OS fingerprinting)
Filter data payload of network packets matching a specified regex
Display a graph of the current network usage
IP LAN monitor (ncurses UI)
Run a network performance benchmark server
Do network performance benchmarks by connecting to netserver
Run a network throughput benchmark server
Perform network throughput tests in client mode, by connecting to an iperf server
Linux Quick Reference Guide 4 th ed. June 2016 © Daniele Raffo www.crans.org/~raffo
99/150
tcpdump -ni eth0 tcpdump ip host 10.0.0.2 tcp port 25 tcpdump ether host '45:67:89:ab:cd:ef' tcpdump 'src host 10.0.0.2 and \
(tcp port 80 or tcp port 443)' tcpdump -ni eth0 not port 22 tcpdump -vvnn -i eth0 arp tcpdump ip host 10.0.0.2 and \ not 10.0.0.9
tcpdump
tcpdump
Sniff all network traffic on interface eth0, suppressing DNS resolution
Sniff network packets on TCP port 25 from and to 10.0.0.2
Sniff traffic from and to the network interface having MAC address
45:67:89:ab:cd:ef
Sniff HTTP and HTTPS traffic having as source host 10.0.0.2
Sniff all traffic on eth0 except that belonging to the SSH connection
Sniff ARP traffic on eth0, on maximum verbosity level, without converting host IP addresses and port numbers to names
Sniff IP traffic between 10.0.0.2 and any other host except 10.0.0.9
dhcpdump -i eth0 Sniff all DHCP packets on interface eth0
Linux Quick Reference Guide 4 th ed. June 2016 © Daniele Raffo www.crans.org/~raffo
100/150 netcat
netcat
Netcat, "the Swiss Army knife of networking", a very flexible generic TCP/IP client/server nc ncat (Red Hat) netcat (SUSE) nc -z 10.0.0.7 22 ncat 10.0.0.7 22 nc -l -p 25
Scan for a listening SSH daemon on remote host 10.0.0.7
nc 10.0.0.7 389 < file echo "GET / HTTP/1.0\r\n\r\n" | nc 10.0.0.7 80
Push the content of file to port 389 on remote host 10.0.0.7
Connect to web server 10.0.0.7 and issue a HTTP GET while true; \ do nc -l -p 80 -q 1 < page.html; done while true; \ do echo "<html><body><h1>WWW</h1></body></html>" \
| ncat -l -p 80; done
Start a minimal web server, serving the specified HTML page to any connected client nc -v -n -z -w1 -r 10.0.0.7 1-1023 echo "" | nc -v -n -w1 10.0.0.7 1-1023
Listen for connections on port 25 (i.e. mimic a SMTP server).
Send any input received on stdin to the connected client and dump on stdout any data received from the client
Run a TCP port scan against remote host 10.0.0.7.
Probe randomly all privileged ports with a 1-second timeout, without resolving service names, and with verbose output
Retrieve the greeting banner of any network service that might be running on remote host 10.0.0.7
Linux Quick Reference Guide 4 th ed. June 2016 © Daniele Raffo www.crans.org/~raffo
101/150
/etc/hosts
/etc/nsswitch.conf
/etc/host.conf
/etc/resolv.conf
/etc/networks
/etc/network/interfaces (Debian)
/etc/hostname (Debian)
Network config files
Network config files
Mappings between IP addresses and hostnames, for name resolution
127.0.0.1 localhost.localdomain localhost
10.2.3.4 myhost.domain.org myhost
Sources that must be used by various system library lookup functions passwd: files nisplus nis shadow: files nisplus nis group: files nisplus nis hosts: files dns nisplus nis
Sources for name resolution, for systems before glibc2.
Obsolete, superseded by /etc/nsswitch.conf
order hosts,bind multi on
Domain names that must be appended to bare hostnames, and DNS servers that will be used for name resolution search domain1.org domain2.org
nameserver 192.168.3.3
nameserver 192.168.4.4
Mappings between network addresses and names loopback 127.0.0.0
mylan 10.2.3.0
List and configuration of all network interfaces allow-hotplug eth0 iface eth0 inet static
address 10.2.3.4
netmask 255.255.255.0
gateway 10.2.3.254
dns-domain example.com
dns-nameservers 8.8.8.8 4.4.4.4
Hostname of the local machine
/sys/class/net
/etc/services
/etc/protocols
/etc/ethers
List of all network interfaces in the system
List of service TCP/UDP port numbers
List of available protocols
ARP mappings (i.e. MAC to IP addresses)
Linux Quick Reference Guide 4 th ed. June 2016 © Daniele Raffo www.crans.org/~raffo
102/150
/etc/sysconfig/network
/etc/sysconfig/network-scripts/ifcfg-eth0
/etc/sysconfig/network-scripts/ifcfg-eth0:0
/etc/sysconfig/network-scripts/ifcfg-eth0:1
/etc/sysconfig/network-scripts/ifcfg-eth0:2
/etc/sysconfig/network-scripts/route-eth0
Network config files (Red Hat)
Network config files (Red Hat)
Network configuration file
ADDRESS=10.2.3.4
NETMASK=255.255.255.0
GATEWAY=10.2.3.254
HOSTNAME=mylinuxbox.example.org
NETWORKING=yes
Configuration file for network interface eth0.
This file is read by the ifup and ifdown scripts
DEVICE=eth0
TYPE=Ethernet
HWADDR=AA:BB:CC:DD:EE:FF
BOOTPROTO=none
ONBOOT=yes
NM_CONTROLLED=no
IPADDR=10.2.3.4
NETMASK=255.255.255.0
GATEWAY=10.2.3.254
DNS1=8.8.8.8
DNS2=4.4.4.4
USERCTL=no
Configuration files for different interface aliases.
This makes possible to bind multiple IP addresses to a single NIC
Static route configuration for eth0 default 10.2.3.4 dev eth0
10.7.8.0/24 via 10.2.3.254 dev eth0
10.7.9.0/24 via 10.2.3.254 dev eth0
Linux Quick Reference Guide 4 th ed. June 2016 © Daniele Raffo www.crans.org/~raffo
103/150
/etc/hosts.allow
/etc/hosts.deny
TCP Wrapper
TCP Wrapper
Host access control files used by the TCP Wrapper system.
Each file contains zero or more daemon:client lines. The first matching line is considered.
Access is granted when a daemon:client pair matches an entry in /etc/hosts.allow .
Otherwise, access is denied when a daemon:client pair matches an entry in /etc/hosts.deny .
Otherwise, access is granted.
ALL: ALL
ALL: .example.edu
/etc/hosts.allow and /etc/hosts.deny lines syntax
All services to all hosts
ALL: .example.edu EXCEPT host1.example.edu
All services to all hosts of the example.edu domain
All services to all hosts of example.edu, except host1 in.fingerd: .example.com
in.tftpd: LOCAL sshd: 10.0.0.3 10.0.0.4 10.1.1.0/24 sshd: 10.0.1.0/24 sshd: 10.0.1.
Finger service to all hosts of example.com
TFTP to hosts of the local domain only
SSH to the hosts and network specified
SSH to 10.0.1.0/24
SSH to 10.0.1.0/24 sshd: 10.0.1.0/255.255.255.0
in.tftpd: ALL: spawn (/safe_dir/safe_finger \
-l @%h | /bin/mail -s %d-%h root) & portmap: ALL: (echo Illegal RPC request \ from %h | /bin/mail root) &
SSH to 10.0.1.0/24
Send a finger probe to hosts attempting TFTP and notify root user via email
When a client attempts a RPC request via the portmapper (NFS access), echo a message to the terminal and notify root user via email
Linux Quick Reference Guide 4 th ed. June 2016 © Daniele Raffo www.crans.org/~raffo
104/150
Output of command route -en
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
192.168.3.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0
0.0.0.0 192.168.3.1 0.0.0.0 UG 0 0 0 eth0
network or host
destination network or host
Destination
0.0.0.0
host
default route gateway
Gateway
0.0.0.0
*
no gateway needed, network is directly connected
Genmask
network mask
255.255.255.255
rejected route network mask to apply for the destination network destination host
0.0.0.0
U
Flags
G
H
!
D
M
R default route route is up use gateway target is host rejected route dynamically installed by daemon modified from routing daemon reinstate route for dynamic routing
Routing
Routing
ip route route -en route -F netstat -rn ip route show cache route -C ip route add default via 10.1.1.254
route add default gw 10.1.1.254
ip route add 10.2.0.1 dev eth0 ip route add 10.2.0.1 via 10.2.0.254
route add -host 10.2.0.1 gw 10.2.0.254
ip route add 10.2.0.0/16 via 10.2.0.254
route add -net 10.2.0.0 netmask 255.255.0.0 gw 10.2.0.254
ip route delete 10.2.0.1 dev eth0 route del -host 10.2.0.1 gw 10.2.0.254
ip route flush all
Display IP routing table
Display kernel routing cache
Add a default gateway
Add a route for a host
Add a route for a network
Delete a route for a host
Delete the routing table for all interfaces
Linux Quick Reference Guide 4 th ed. June 2016 © Daniele Raffo www.crans.org/~raffo
105/150 iptables
iptables
The Netfilter framework provides firewalling capabilities in Linux. It is implemented by the user-space application programs iptables for IPv4 (which replaced ipchains, which itself replaced ipfwadm) and ip6tables for IPv6.
Iptables is implemented in the kernel and therefore does not have a daemon process or a service.
The ability to track connection state is provided by the ip_conntrack kernel module.
From RHEL 7 onward, iptables has been replaced by the firewalld daemon. To use it anyway, it is necessary to install the package iptables-services which provides a systemd interface for iptables, and disable firewalld.
In Ubuntu, iptables is managed by the ufw service (Uncomplicated Firewall).
/etc/sysconfig/iptables iptables-restore < file iptables-save > file
Default file containing the firewall rules
Load into iptables the firewall rules specified in the file
Save into iptables the firewall rules specified in the file
iptables rules file
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
COMMIT
Delete all rules and open the firewall to all connections
Linux Quick Reference Guide 4 th ed. June 2016 © Daniele Raffo www.crans.org/~raffo
106/150 iptables rules
iptables rules
Iptables uses tables containing sets of chains, which contain sets of rules. Each rule has a target (e.g. ACCEPT).
The "filter" table contains chains INPUT, FORWARD, OUTPUT (built-in chains); this is the default table to which all iptables commands are applied, unless another table is specified via the -t option.
The "nat" table contains chains PREROUTING, OUTPUT, POSTROUTING.
The "mangle" table contains chains PREROUTING, OUTPUT.
When a packet enters the system, it is handed to the INPUT chain. If the destination is local, it is processed; if the destination is not local and IP forwarding is enabled, the packet is handed to the FORWARD chain, otherwise it is dropped.
An outgoing packet generated by the system will go through the OUTPUT chain.
If NAT is in use, an incoming packet will pass at first through the PREROUTING chain, and an outgoing packet will pass last through the POSTROUTING chain.
iptables -A INPUT -s 10.0.0.6 -j ACCEPT iptables -A INPUT -s 10.0.0.7 -j REJECT iptables -A INPUT -s 10.0.0.8 -j DROP iptables -A INPUT -s 10.0.0.9 -j LOG iptables -D INPUT -s 10.0.0.9 -j LOG iptables -D INPUT 42 iptables -F INPUT iptables -F iptables -t mangle -F iptables -t mangle -X
Add a rule to accept all packets from 10.0.0.6
Add a rule to reject all packets from 10.0.0.7 and send back a ICMP response to the sender
Add a rule to silently drop all packets from 10.0.0.8
Add a rule to log via syslog all packets from 10.0.0.9
Delete a specific rule
Delete rule 42 of the INPUT chain
Flush all rules of the INPUT chain
Flush all rules, hence disabling the firewall
Flush all rules of the "mangle" table
Delete all user-defined (not built-in) rules in the "mangle" table iptables -L INPUT iptables -L -n iptables -N mychain iptables -P INPUT DROP
List the rules of the INPUT chain
List all rules, without translating numeric values (IP addresses to FQDNs and port numbers to services)
Define a new chain
Define the chain policy target, which takes effect when no rule matches and the end of the rules list is reached iptables -A OUTPUT -d 10.7.7.0/24 -j DROP iptables -A FORWARD -i eth0 -o eth1 -j LOG iptables -A INPUT -p 17 -j DROP iptables -A INPUT -p udp -j DROP iptables -A INPUT --sport 1024:65535 --dport 53 \
-j ACCEPT iptables -A INPUT -p icmp --icmp-type echo-request \
-m limit --limit 1/s -i eth0 -j ACCEPT iptables -A INPUT -m state --state ESTABLISHED \
-j ACCEPT iptables -A INPUT -m state --state NEW -j ACCEPT iptables -A INPUT -m state --state RELATED -j ACCEPT iptables -A INPUT -m state --state INVALID -j ACCEPT
Add a rule to drop all packets with destination 10.7.7.0/24
Add a rule to log all packets entering the system via eth0 and exiting via eth1
Add a rule to drop all incoming UDP traffic (protocol numbers are defined in /etc/protocols)
Add a rule to accept all packets coming from any unprivileged port and with destination port 53
Add a rule to accept incoming pings through eth0 at a maximum rate of 1 ping/second
Load the module for stateful packet filtering, and add a rule to accept all packets that are part of a communication already tracked by the state module
Add a rule to accept all packets that are not part of a communication already tracked by the state module
Add a rule to accept all packets that are related (e.g.
ICMP responses to TCP or UDP traffic) to a communication already tracked by the state module
Add a rule to accept all packets that do not match any of the states above
Linux Quick Reference Guide 4 th ed. June 2016 © Daniele Raffo www.crans.org/~raffo
107/150 firewalld
firewalld
In firewalld, a network interface (aka interface) or a subnet address (aka source) can be assigned to a specific zone.
To determine to which zone a packet belongs, first the zone of the source is analyzed, then the zone of the interface; if no source or interface matches, the packet is associated to the default zone (which is "public", unless set otherwise).
If the zone is not specified in a command, the command is applied to the default zone.
By default, commands are temporary; adding the --permanent option to a command sets it as permanent, or shows permanent settings only.
Temporary commands are effective immediately but are canceled at reboot, firewall reload, or firewall restart.
Permanent commands are effective only after reboot, firewall reload, or firewall restart. block dmz drop external home internal public trusted work
Firewalld zones (as obtained by firewall-cmd --get-zones)
Rejects incoming connections with an ICMP HOST_PROHIBITED; allows only established connections
Used to expose services to the public; allows only specific incoming connections
Drops all incoming packets; allows only outgoing connections
Used for routing and masquerading; allows only specific connections
Allows only specific incoming connections
Used to define internal networks and allow only private network traffic
Allows only specific incoming connections
Accepts all traffic
Used to define internal networks and allow only private network traffic systemctl status firewalld firewall-cmd --state
Check the status of the firewall firewall-config firewall-cmd --reload firewall-cmd --complete-reload firewall-cmd --runtime-to-permanent
Firewall management GUI
Reload firewall configuration; this applies all permanent changes and cancels all temporary changes. Current connections are not terminated
Reload firewall configuration, stopping all current connections
Transform all temporary changes to permanent firewall-cmd --list-all-zones firewall-cmd --get-default-zone firewall-cmd --set-default-zone=home firewall-cmd --get-active-zones firewall-cmd --get-zones firewall-cmd --get-zone-of-interface=eth0 firewall-cmd --new-zone=test firewall-cmd --zone=home --change-interface=eth0 firewall-cmd --zone=home --change-interface=eth0 --permanent firewall-cmd --zone=home --list-all firewall-cmd --zone=home --list-all --permanent
List all zones and their full settings
Show the default zone
Set "home" as the default zone
Show the active zones i.e. zones bound to either an interface or a source
Show all available zones
Show the zone assigned to eth0
Create a new zone called "test"
Assign temporarily eth0 to the "home" zone
Assign permanently eth0 to the "home" zone
List temporary settings of the "home" zone
List permanent settings of the "home" zone firewall-cmd --zone=home --add-source=10.1.1.0/24 firewall-cmd --zone=home --list-sources
Assign 10.1.1.0/24 to the "home" zone
List sources bound to the "home" zone
Linux Quick Reference Guide 4 th ed. June 2016 © Daniele Raffo www.crans.org/~raffo
108/150
firewall-cmd --zone=trusted --add-service=ssh firewall-cmd --zone=trusted --add-port=22/tcp firewall-cmd --zone=trusted --add-service={ssh,http,https} firewall-cmd --zone=trusted --list-services firewall-cmd --zone=trusted --list-ports firewall-cmd --get-icmptypes firewall-cmd --add-icmp-block=echo-reply firewall-cmd --query-icmp-block=echo-reply firewall-cmd --list-icmp-block
/usr/lib/firewalld/services/service.xml
/etc/firewalld/services/service.xml
firewalld rules
firewalld rules
Add the SSH service to the "trusted" zone
Add the SSH, HTTP, and HTTPS services to the
"trusted" zone
Show temporary and permanent services bound to the "trusted" zone
Show temporary and permanent ports open on the "trusted" zone
Show all known types of ICMP messages
Block a specific ICMP message type
Tell if a specific ICMP message type is blocked
Show the list of blocked ICMP message types
Predefined configuration of service
User-defined configuration of service firewall-cmd --direct --add-rule ipv4 filter INPUT 0 \
-p tcp --dport 22 -j ACCEPT firewall-offline-cmd rule firewall-cmd --direct --get-all-rules
/etc/firewalld/direct.xml
firewall-cmd --permanent --add-rich-rule='rule' firewall-cmd --list-rich-rules man firewalld.richlanguage
firewall-cmd --zone=external --add-masquerade firewall-cmd --zone=external --add-forward-port=\ port=22:proto=tcp:toport=2222
Set up a direct rule (in iptables format) to accept SSH connections
Set up a direct rule when firewalld is not running
Show all direct rules
User-defined direct rules
Set up a rich rule
List all rich rules
Show the manpage about rich rules
Set up masquerading on the "external" zone for machines of the "internal" zone; packets originating from the "internal" zone will get the firewall's IP address as source address
Set up port forwarding from port 22 to 2222 for the "external" zone
Linux Quick Reference Guide 4 th ed. June 2016 © Daniele Raffo www.crans.org/~raffo
109/150
LAN
10.0.0.0/24
NAT routing
NAT routing
Internet eth0
10.0.0.1
Linux box
NAT router eth1
93.184.216.119
SNAT (Source Network Address Translation)
iptables -t nat -A POSTROUTING -s 10.0.0.0/24 -o eth1 \
-j SNAT --to-source 93.184.216.119
Map all traffic leaving the LAN to the external IP address 93.184.216.119
iptables -t nat -A POSTROUTING -s 10.0.0.0/24 -o eth1 \
-j SNAT --to-source 93.184.216.119:93.184.216.127
iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE
Map all traffic leaving the LAN to a pool of external
IP addresses 93.184.216.119-127
Map all traffic leaving the LAN to the address dynamically assigned to eth1 via DHCP
DNAT (Destination Network Address Translation)
iptables -t nat -A PREROUTING -i eth1 -d 93.184.216.119 \
-j DNAT --to-destination 10.0.0.13
Allow the internal host 10.0.0.13 to be publicly reachable via the external address 93.184.216.119
PAT (Port Address Translation)
iptables -t nat -A PREROUTING -i eth1 -d 93.184.216.119 \
-p tcp --dport 80 -j DNAT --to-destination 10.0.0.13:8080
Make publicly accessible a webserver that is located in the LAN, by mapping port 8080 of the internal host 10.0.0.13 to port 80 of the external address 93.184.216.119
iptables -t nat -A PREROUTING -i eth0 -d ! 10.0.0.0/24 \
-p tcp --dport 80 -j REDIRECT --to-ports 3128
Redirect all outbound HTTP traffic originating from the LAN to a proxy running on port 3128 on the
Linux box sysctl -w net.ipv4.ip_forward=1 echo 1 > /proc/sys/net/ipv4/ip_forward
Enable IP forwarding; necessary to set up a Linux machine as a router.
(This command causes other network options to be changed as well.)
Linux Quick Reference Guide 4 th ed. June 2016 © Daniele Raffo www.crans.org/~raffo
110/150
ssh root@remotehost ssh -v root@remotehost ssh -vv root@remotehost ssh -vvv root@remotehost ssh -p 2222 root@remotehost ssh root@remotehost /root/mycommand sftp root@remotehost scp myfile root@remotehost:/tmp/myfile2 scp root@remotehost:/tmp/myfile2 myfile scp jdoe@host1:/tmp/myfile root@host2:/root/myfile2 sshpass -p p455w0rd ssh root@remotehost pssh -i -H "host1 host2 host3" /root/mycommand ssh-keygen -t rsa -b 2048 ssh-keygen -t dsa ssh-keygen -p -t rsa ssh-keygen -q -t rsa -f /etc/ssh/id_rsa -N '' -C '' ssh-keygen -lf /etc/ssh/id_rsa.pub
ssh-agent eval `ssh-agent` ssh-add ssh-add ~/.ssh/id_rsa ssh-copy-id root@remotehost
SSH
SSH
Connect to a remote host via SSH (Secure Shell) and login as the root user
Connect via SSH, specifying increasing levels of verbosity
SSH as root using port 2222 instead of standard port 22
Execute a command on a remote host
FTP-like tool for secure file transfer
Non-interactive secure file copy.
Can transfer files from local to remote, from remote to local, or between two remote hosts
Connect to a remote host using the specified password
Execute a command in parallel on a group of remote hosts
Generate interactively a 2048-bit RSA key pair; will prompt for a passphrase
Generate a DSA key pair
Change passphrase of the private key
Generate a RSA key with no passphrase (for noninteractive use) and no comment
View key length and fingerprint of a public key
Start the SSH Agent daemon that caches decrypted private keys in memory; also echoes to the terminal the environment variables that must be set. The cached keys are automatically used by SSH tools ssh, sftp, and scp
Show the PID of ssh-agent and set appropriate environment variables
Add the default private keys to the ssh-agent cache
Add a specific private key to the ssh-agent cache
Use locally available keys to authorize, via public key authentication, login of root on a remote host.
Copies root's local public key ~/.ssh/id_rsa.pub to
~/.ssh/authorized_keys on the remote host
Linux Quick Reference Guide 4 th ed. June 2016 © Daniele Raffo www.crans.org/~raffo
111/150 SSH operations
SSH operations
SSH port forwarding (aka SSH tunneling)
ssh -L 2525:mail.foo.com:25 [email protected]
Establish a SSH encrypted tunnel from localhost to remote host mail.foo.com, redirecting traffic from local port 2525 to port 25 of remote host mail.foo.com.
Useful if the local firewall blocks outgoing port 25. In this case, port 2525 is used to go out; the application must be configured to connect to localhost on port 2525 (instead of mail.foo.com on port 25) ssh -L 2525:mail.foo.com:25 [email protected]
Establish a SSH encrypted tunnel from localhost to remote host login.foo.com.
Remote host login.foo.com will then forward, unencrypted, all data received over the tunnel on port 2525 to remote host mail.foo.com on port 25
SSH reverse forwarding (aka SSH reverse tunneling)
ssh -R 2222:localhost:22 [email protected]
Establish a SSH encrypted reverse tunnel from remote host login.foo.com back to localhost, redirecting traffic sent to port 2222 of remote host login.foo.com back towards local port 22.
Useful if the local firewall blocks incoming connections so remote hosts cannot connect back to local machine. In this case, port 2222 of login.foo.com is opened for listening and connecting back to localhost on port 22; remote host login.foo.com is then able to connect to the local machine on port 2222 (redirected to local port 22) ssh -D 33333 [email protected]
ssh -X [email protected]
SSH as a SOCKS proxy
The application supporting SOCKS must be configured to connect to localhost on port 33333. Data is tunneled from localhost to login.foo.com, then unencrypted to destination
X11 Forwarding
Enable the local display to execute locally a X application stored on a remote host login.foo.com
How to enable public key authentication
1. On remote host, set PubkeyAuthentication yes in /etc/ssh/sshd_config
2. On local machine, do ssh-copy-id you@remotehost (or copy your public key to the remote host by hand)
How to enable host-based authentication amongst a group of trusted hosts
1. On all hosts, set HostbasedAuthentication yes in /etc/ssh/sshd_config
2. On all hosts, create /etc/ssh/shosts.equiv and enter in this file all trusted hostnames
3. Connect via SSH manually from your machine on each host so that all hosts' public keys go into ~/.ssh/known_hosts
4. Copy ~/.ssh/known_hosts from your machine to /etc/ssh/ssh_known_hosts on all hosts
How to enable SSH Agent
1. Type eval `ssh-agent`
2. Type ssh-add to add the private key to cache, and enter the key's passphrase
How to enable X11 Forwarding
1. On remote host 10.2.2.2, set X11Forwarding yes in /etc/ssh/sshd_config, and make sure that xauth is installed
2. On local host 10.1.1.1, type ssh -X 10.2.2.2, then run on remote host the graphical application e.g. xclock &
It is also possible to enable X11 Forwarding via telnet (but this is insecure and obsolete, and therefore not recommended):
1. On remote host 10.2.2.2, type export DISPLAY=10.1.1.1:0.0
2. On local host 10.1.1.1, type xhost +
3. On local host 10.1.1.1, type telnet 10.2.2.2, then run on remote host the graphical application e.g. xclock &
Linux Quick Reference Guide 4 th ed. June 2016 © Daniele Raffo www.crans.org/~raffo
112/150
/etc/ssh/sshd_config
/etc/ssh/ssh_config
/etc/ssh/ssh_host_key
/etc/ssh/ssh_host_key.pub
/etc/ssh/shosts.equiv
/etc/ssh/ssh_known_hosts
~/.ssh/
~/.ssh/config
~/.ssh/id_rsa
~/.ssh/id_dsa
~/.ssh/id_rsa.pub
~/.ssh/id_dsa.pub
~/.ssh/known_hosts
~/.ssh/authorized_keys
~/.ssh/authorized_keys2 (obsolete)
SSH configuration
SSH configuration
SSH server daemon configuration file
SSH client global configuration file
Host's private key (should be mode 0600)
Host's public key
Names of trusted hosts for host-based authentication
Database of host public keys that were previously accepted as legitimate
User's SSH directory (must be mode 0700)
SSH client user configuration file
User's RSA or DSA private key, as generated by ssh-keygen
User's RSA or DSA public key, as generated by ssh-keygen
Host public keys that were previously accepted as legitimate by the user
Trusted public keys; the corresponding private keys allow the user to authenticate on this host
PermitRootLogin yes
AllowUsers jdoe ksmith
DenyUsers jhacker
AllowGroups geeks
DenyGroups *
PasswordAuthentication yes
PubKeyAuthentication yes
HostbasedAuthentication yes
Protocol 1,2
X11Forwarding yes
/etc/ssh/sshd_config SSH server configuration file
Control superuser login via SSH. Possible values are: yes Superuser can login no Superuser cannot login without-password Superuser cannot login with password forced-commands-only Superuser can only run commands in SSH command line
List of users that can/cannot login via SSH, or * for everybody
List of groups whose members can/cannot login via SSH, or * for all groups
Permit authentication via login and password
Permit authentication via public key
Permit authentication based on trusted hosts
Specify protocols supported by SSH. Value can be 1 or 2 or both
Allow X11 Forwarding
Host *
/etc/ssh/ssh_config and ~/.ssh/config SSH client configuration file
StrictHostKeyChecking yes
List of hosts to which the following directives will apply, or * for all hosts
Ask before adding new host keys to the ~/.ssh/known_hosts file, and refuse to connect if the key for a known host has changed. This prevents MITM attacks
GSSAPIAuthentication yes
ForwardX11Trusted yes
IdentityFile ~/.ssh/id_rsa
Support authentication using GSSAPI
Allow remote X11 clients to fully access the original X11 display
User identity file for authentication. Default values are:
~/.ssh/identity for protocol version 1
~/.ssh/id_rsa and ~/.ssh/id_dsa for protocol version 2
Linux Quick Reference Guide 4 th ed. June 2016 © Daniele Raffo www.crans.org/~raffo
113/150
gpg --gen-key gpg --import alice.asc
gpg --list-keys gpg --list-secret-keys gpg --list-public-keys gpg --export -o keyring_backup.gpg
gpg --export-secret-key -a "You" -o private.key
gpg --export-public-key -a "Alice" -o alice.pub
gpg --edit-key "Alice" gpg -e -u "You" -r "Alice" file.txt
gpg -d file.txt.gpg
GnuPG
Generate a key pair
Import Alice's public key into your keyring
List the keys contained into your keyring
List your private keys contained into your keyring
List the public keys contained into your keyring
Export your whole keyring to a file
Export your private key (username You) to a file
Export Alice's public key to a file
Sign Alice's public key
Encrypt a file (to Alice i.e. with Alice's public key), signing it with your private key
Decrypt a file (with your own public key)
GnuPG
md5sum sha1sum sha224sum sha256sum sha384sum sha512sum
Print a digest of a file generated by the relevant hashing algorithm
Linux Quick Reference Guide 4 th ed. June 2016 © Daniele Raffo www.crans.org/~raffo
114/150
openvpn --genkey --secret keyfile Generate a shared secret keyfile for OpenVPN authentication.
The keyfile must be copied on both server and client
OpenVPN
OpenVPN
openvpn server.conf
openvpn client.conf
Start the VPN on the server side. The encrypted VPN tunnel uses UDP port 1194
Start the VPN on the client side
/etc/openvpn/server.conf
/etc/openvpn/client.conf
Server-side configuration file: dev tun ifconfig server_IP client_IP keepalive 10 60 ping-timer-rem persist-tun persist-key secret keyfile
Client-side configuration file: remote server_public_IP dev tun ifconfig client_IP server_IP keepalive 10 60 ping-timer-rem persist-tun persist-key secret keyfile
Linux Quick Reference Guide 4 th ed. June 2016 © Daniele Raffo www.crans.org/~raffo
115/150
Key
CTRL
CTRL
CTRL
CTRL
A
E
F
B
CTRL
CTRL
CTRL
CTRL
CTRL
ESC T
U
K
H
W
T
SHIFT
SHIFT
CTRL
PAGE UP
PAGE DOWN
L
CTRL
CTRL
CTRL
TAB
P
N
R
CTRL
CTRL
J
M
CTRL
CTRL
CTRL
CTRL
CTRL
Z
C
S
Q
D
CTRL ALT DEL
CTRL
CTRL
CTRL
CTRL
CTRL
CTRL
CTRL
CTRL
ALT
ALT
ALT
ALT
ALT
ALT
ALT
TAB
F7 ... F11
+
-
F1 ... F6
➡
⬅
BACKSPACE
Alternate key
➡
⬅
HOME
END
BACKSPACE
⬆
⬇
RETURN
Function
Move cursor forward one char
Move cursor backward one char
Move cursor to beginning of line
Move cursor to end of line
Delete char to the left of cursor
Delete word to the left of cursor
Delete all chars to the left of cursor
Delete all chars to the right of cursor
Swap current char with previous char
Swap current word with previous word
Key bindings
Key bindings
Scroll up the buffer
Scroll down the buffer
Clear screen (same as clear)
Previous command in history
Next command in history
Reverse history search
Autocomplete file and directory names
Line feed
Carriage return
Pause trasfer to terminal
Resume transfer to terminal
Send a SIGTSTP to put the current job in background
Send a SIGINT to stop the current process
Send a EOF to current process (same as logout)
Send a SIGINT to reboot the machine (same as shutdown -r now), as specified in /etc/inittab and /etc/init/control-alt-delete
Switch between text consoles (same as chvt n)
Switch between X Window consoles
Increase X Window screen resolution
Decrease X Window screen resolution
Switch between X Window tasks
Switch to next workspace
Switch to previous workspace
Reboot the X Window server
Linux Quick Reference Guide 4 th ed. June 2016 © Daniele Raffo www.crans.org/~raffo
116/150 udev
The Hardware Abstraction Layer (HAL) manages device files and provides plug-and-play facilities. The HAL daemon hald maintains a persistent database of devices. udev dynamically generates the device nodes in /dev/ for devices present on the system. udev also provides persistent naming for storage devices in /dev/disk .
When a device is added, removed, or changes state, the kernel sends an uevent received by the udevd daemon which will pass the uevent through a set of rules stored in /etc/udev/rules.d/*.rules and /lib/udev/rules.d/*.rules .
udev
udevadm monitor udevmonitor udevadm info --attribute-walk --name=/dev/sda cat /sys/block/sda/size udevadm test /dev/sdb gnome-device-manager
Show all kernel uevents and udev messages
Print all attributes of device /dev/sda in udev rules key format
Print the size attribute of disk sda in 512-byte blocks.
This information is retrieved from sysfs
Simulate a udev event run for the device and print debug output
Browser for the HAL device manager
/etc/udev/rules.d/*.rules and /lib/udev/rules.d/*.rules udev rules
KERNEL=="hda", NAME="mydisk" Match a device which was named by the kernel as hda; name the device node as mydisk. The device node will be therefore
/dev/mydisk
KERNEL=="hdb", DRIVER=="ide-disk", SYMLINK+="mydisk myhd"
KERNEL=="fd[0-9]*", NAME="floppy/%n", SYMLINK+="%k"
Match a device with kernel name and driver as specified; name the device node with the default name and create two symbolic links
/dev/mydisk and /dev/myhd pointing to
/dev/hdb
Match all floppy disk drives (i.e. fdn); place device node in /dev/floppy/n and create a symlink /dev/fdn to it
SUBSYSTEM=="block", ATTR{size}=="41943040", SYMLINK+="mydisk"
KERNEL=="fd[0-9]*", OWNER="jdoe"
KERNEL=="sda", PROGRAM="/bin/mydevicenamer %k", SYMLINK+="%c"
Match a block device with a size attribute of
41943040; create a symlink /dev/mydisk
Match all floppy disk drives; give ownership of the device file to user jdoe
Match a device named by the kernel as sda; to name the device, use the defined program which takes on stdin the kernel name and output on stdout e.g. name1
name2. Create symlinks /dev/name1 and
/dev/name2 pointing to /dev/sda
KERNEL=="sda", ACTION=="add", RUN+="/bin/myprogram"
KERNEL=="sda", ACTION=="remove", RUN+="/bin/myprogram"
Match a device named by the kernel as sda; run the defined program when the device is connected
Match a device named by the kernel as sda; run the defined program when the device is disconnected
%n = kernel number (e.g. = 3 for fd3)
%k = kernel name (e.g. = fd3 for fd3)
%c = device name as output from program
Linux Quick Reference Guide 4 th ed. June 2016 © Daniele Raffo www.crans.org/~raffo
117/150 Kernel
Kernel
A kernel version number has the form major.minor.patchlevel.
Kernel images are usually gzip-compressed and can be of two types: zImage (max 520 Kb) and bzImage (no size limit).
Kernel modules can be loaded dynamically into the kernel to provide additional functionalities on demand, instead of being included when the kernel is compiled; this reduces memory footprint.
kerneld (daemon) and kmod (kernel thread) facilitate the dynamic loading of kernel modules.
/lib/modules/X.Y.Z/*.ko
/lib/modules/X.Y.Z/modules.dep
/etc/modules.conf
/etc/conf.modules (deprecated)
Kernel modules for kernel version X.Y.Z
Modules dependencies.
This file needs to be recreated (via the command depmod -a) after a reboot or a change in module dependencies
Modules configuration file
/usr/src/linux/
/usr/src/linux/.config
Contains the kernel source code to be compiled
Kernel configuration file freeramdisk mkinitrd initrd_image kernel_version mkinitramfs dracut dbus-monitor dbus-monitor --session dbus-monitor --system
Free the memory used for the initrd image. This command must be run directly after unmounting /initrd
Create a initrd image file (Red Hat)
Create a initrd image file according to the configuration file
/etc/initramfs-tools/initramfs.conf (Debian)
Create initial ramdisk images for preloading modules
Monitor messages going through a D-Bus message bus
Monitor session messages (default)
Monitor system messages
The runtime loader ld.so loads the required shared libraries of the program into RAM, searching in this order:
1.
LD_LIBRARY_PATH Environment variable specifying the list of dirs where libraries should be searched for first
2.
3.
/etc/ld.so.cache
/lib and /usr/lib
Cache file
Default locations for shared libraries
/etc/ld.so.conf
ldconfig ldd program_or_lib
Configuration file used to specify other shared library locations
(other than the default ones /lib and /usr/lib)
Create a cache file /etc/ld.so.cache of all available dynamically linked libraries.
To be run when the system complains about missing libraries
Print library dependencies
Linux Quick Reference Guide 4 th ed. June 2016 © Daniele Raffo www.crans.org/~raffo
118/150
lspci lspci -d 8086: lsusb lsusb -d 8086: lsdev lshw lscpu uname -s uname -n uname -r uname -v uname -m uname -p uname -i uname -o uname -a dmesg dmesg -n 1 journalctl journalctl -n journalctl --since "1 hour ago" journalctl -x journalctl -f journalctl -u sshd.service
evtest
Kernel management
Kernel management
List PCI devices
List all Intel hardware present. PCI IDs are stored in:
/usr/share/misc/pci.ids (Debian)
/usr/share/hwdata/pci.ids (Red Hat)
List USB devices
List all Intel USB devices present. USB IDs are stored in:
/var/lib/usbutils/usb.ids (Debian)
/usr/share/hwdata/usb.ids (Red Hat)
List information about the system's hardware
List system hardware
List information about the CPU architecture
Print the kernel name
Print the network node hostname
Print the kernel release number X.Y.Z
Print the kernel version number
Print the machine hardware name
Print the processor type
Print the hardware platform
Print the operating system
Print all the above information, in that order
Print the messages of the kernel ring buffer
Set the logging level to 1 (= only panic messages)
Query the systemd journal
Query the systemd journal, showing only the 10 most recent lines
Query the systemd journal for events happened in the last hour
Query the systemd journal, adding explanations from the message catalog
Query the systemd journal in real time, scrolling as new entries are added
Query the systemd journal for a specific unit
Monitor and query input device events in /dev/input/eventn
Linux Quick Reference Guide 4 th ed. June 2016 © Daniele Raffo www.crans.org/~raffo
119/150 Kernel compile and patching
Download
Clean
Configure
Kernel compile and patching
Kernel compile
Download kernel source code linux-X.Y.Z.tar.bz2 from http://www.kernel.org to the base of the kernel source tree /usr/src/linux make clean make mrproper
Delete most generated files
Delete all generated files and kernel configuration make distclean make config make menuconfig
Delete temporary files, patch leftover files, and similar
Terminal-based (options must be set in sequence) ncurses UI make xconfig make gconfig
GUI make oldconfig
Create a new config file, based on the options in the old config file and in the source code
Components (e.g. device drivers) can be either:
- not compiled
- compiled into the kernel binary, for support of devices always used on the system or necessary for the system to boot
- compiled as a kernel module, for optional devices
Build
The configuration command creates a /usr/src/linux/.config config file containing instructions for the compile make bzImage make modules make all
Compile the kernel
Compile the kernel modules
Compile kernel and kernel modules
Modules install
make -j2 all will speed up compilation by allocating 2 simultaneous compile jobs make modules_install make install
Install the previously built modules present in
/lib/modules/X.Y.Z
Install the kernel automatically
To install the kernel by hand:
Kernel install
Package
Copy the new compiled kernel and other files into the boot partition cp /usr/src/linux/arch/boot/bzImage /boot/vmlinuz-X.Y.Z (kernel) cp /usr/src/linux/arch/boot/System.map-X.Y.Z /boot cp /usr/src/linux/arch/boot/config-X.Y.Z /boot (config options used for this compile)
Create an entry in GRUB to boot on the new kernel
Optionally, the kernel can be packaged for install on other machines make rpm-pkg make binrpm-pkg make deb-pkg
Build source and binary RPM packages
Build binary RPM package
Builds binary DEB package
Download
Patch
Build
Install
Kernel patching
Download and decompress the patch to /usr/src patch -p1 < file.patch
patch -Rp1 < file.patch
Apply the patch
To remove a patch, you can either apply the patch again or use this command (reverse patch)
Build the patched kernel as explained previously
Install the patched kernel as explained previously
Linux Quick Reference Guide 4 th ed. June 2016 © Daniele Raffo www.crans.org/~raffo
120/150 Kernel modules
Kernel modules
Kernel modules allow the kernel to access functions (symbols) for kernel services e.g. hardware drivers, network stack, or filesystem abstraction.
lsmod insmod module rmmod module modinfo module depmod -a
List the modules that are currently loaded into the kernel
Insert a module into the kernel. If the module requires another module or if it does not detect compatible hardware, insertion will fail
Remove a module from the kernel. If the module is in use by another module, it is necessary to remove the latter first
Display the list of parameters accepted by the module
Probe all modules in the kernel modules directory and generate the file that lists their dependencies
It is recommended to use modprobe instead of insmod/rmmod, because it automatically handles prerequisites when inserting modules, is more specific about errors, and accepts just the module name instead of requiring the full pathname. modprobe module option=value Insert a module into the running kernel, with the specified parameters.
Prerequisite modules will be inserted automatically modprobe -a modprobe -t directory
Insert all modules
Attempt to load all modules contained in the directory until a module succeeds.
This action probes the hardware by successive module-insertion attempts for a single type of hardware, e.g. a network adapter modprobe -r module modprobe -c module modprobe -l
Remove a module
Display module configuration
List loaded modules
Configuration of device drivers
Device drivers support the kernel with instructions on how to use that device.
Device driver compiled into the kernel
Configure the device driver by passing a kernel parameter in the GRUB menu: kernel /vmlinuz ro root=/dev/vg0/root vga=0x33c
Device driver provided as a kernel module
Edit module configuration in /etc/modprobe.conf or /etc/modprobe.d/ (Red Hat): alias eth0 3c59x
Specify that eth0 uses the 3c59x.ko driver module options 3c509 irq=10,11 Assign IRQ 10 and 11 to 3c509 devices
Linux Quick Reference Guide 4 th ed. June 2016 © Daniele Raffo www.crans.org/~raffo
121/150
File
/proc/bus
/proc/cpuinfo
/proc/devices
/proc/dma
/proc/filesystems
/proc/interrupts
/proc/ioports
/proc/loadavg
/proc/mdstat
/proc/meminfo
/proc/modules
/proc/mounts
/proc/n/
/proc/n/cmdline
/proc/n/cwd
/proc/n/environ
/proc/n/exe
/proc/n/fd
/proc/n/root
/proc/n/status
/proc/net/dev
/proc/partitions
/proc/swaps
/proc/sys/
/proc/sys/kernel/
/proc/sys/net/
/proc/uptime
/proc/version
/proc pseudo filesystem
Information stored (viewable via cat)
Buses (e.g. PCI, USB, PC Card)
CPUs information
Drivers currently loaded
DMA channels in use
Filesystems supported by the system
Current IRQs (Interrupt Requests)
I/O addresses in use
System load averages
Information about RAID arrays and devices
Total and free memory
Kernel modules currently loaded
Mounted partitions
Information about process with PID n
Command by which the process was launched
Symlink to process' working directory
Values of environment variables of process
Symlink to process' executable
Files currently opened by the process
Symlink to process' filesystem root
Status of process
Network interface statistics
Drive partition information
Size of total and used swap areas sysfs: exposes tunable kernel parameters
Kernel information and parameters
Network information and parameters
Time elapsed since boot
Linux version
/proc filesystem
/proc filesystem
Equivalent command
procinfo uptime free lsmod mount ps n lsof -p n swapon -s uptime uname -a
/proc/sys is the only writable branch of /proc and can be used to tune kernel parameters on-the-fly.
All changes will be lost after system shutdown.
sysctl fs.file-max cat /proc/sys/fs/file-max sysctl -w "fs.file-max=100000" echo "100000" > /proc/sys/fs/file-max sysctl -a sysctl -p
Get the maximum allowed number of open files
Set the maximum allowed number of open files to 100000
List all available kernel tuning options
Apply all tuning settings listed in /etc/sysctl.conf .
This command is usually run at boot by the system initialization script and therefore permits to make permanent changes to the kernel
Linux Quick Reference Guide 4 th ed. June 2016 © Daniele Raffo www.crans.org/~raffo
122/150 System recovery
System recovery
If the kernel has been booted in emergency mode and init has not been run, some initial configuration is necessary e.g.
mount /proc mount -o remount,rw / mount -a
If mounting the filesystems fails: mknod /dev/sda mknod /dev/sda1 fdisk -l /dev/sda fsck -y /dev/sda1 mount -t ext3 /dev/sda1 /mnt/sysimage chroot /mnt/sysimage
To install a package using an alternative root directory (useful if the system has been booted from a removable media): rpm -U --root /mnt/sysimage package.rpm
To install GRUB on the specified directory (which must contain /boot/grub/): grub-install –-root-directory=/mnt/sysimage /dev/sda
An alternative metod is to chroot /mnt/sysimage before installing GRUB via grub-install /dev/sda .
Run sync and unmount all filesystems before exiting the shell, to ensure that all changes have been written on disk.
How to reset the root password (RHEL 7)
2. Edit the line with linux16, removing the rhgb and quiet parameters and adding rd.break at the end.
4. Remount the filesystem as writable:
5. Change the filesystem root:
6. Modify the root password:
7. Force SELinux to relabel context on next boot:
8. Remount the filesystem as readonly:
9. Exit the chroot environment:
10. Resume system boot: mount -o remount,rw /sysroot chroot /sysroot passwd root touch /.autorelabel
mount -o remount,ro /sysroot exit exit
Linux Quick Reference Guide 4 th ed. June 2016 © Daniele Raffo www.crans.org/~raffo
123/150 DNS
DNS
BIND dnsmasq djbdns
PowerDNS
DNS implementations
Berkeley Internet Name Domain system, is the standard DNS server for UNIX
Lightweight DNS, DHCP and TFTP server for a small network
Security-hardened DNS server that also includes DNS debugging tools
Alternative open-source DNS server named ndc rndc
BIND Name Daemon
Name Daemon Controller for BIND 8
Remote Name Daemon Controller for BIND 9, uses a shared key to communicate securely with named dnswalk example.org.
DNS debugger rndc reconfig rndc reload example.org
rndc freeze example.org
rndc thaw example.org
rndc tsig-list
DNSSEC was designed to secure the DNS tree and hence prevent cache poisoning.
The TSIG (Transaction SIGnature) standard, that authenticates communications between two trusted systems, is used to sign zone transfers and DDNS (Dynamic DNS) updates. dnssec-keygen -a dsa -b 1024 \
-n HOST dns1.example.org
Generate a TSIG key with DNSSEC algorithm nnn and key fingerprint fffff.
This will create two key files
Kdns1.example.org.+nnn+fffff.key
Kdns1.example.org.+nnn+fffff.private which contain a key number that has to be inserted both in /etc/named.conf and
/etc/rndc.conf rndc-confgen -a
Reload BIND configuration and new zones
Reload the zone example.org
Suspend updates for the zone example.org
Resume updates for the zone example.org
List all currently active TSIG keys dnssec-signzone example.org
named -u named -g named named -t /var/cache/bind
Generate a /etc/rndc.key key file: key "rndc-key" {
algorithm hmac-md5;
secret "vyZqL3tPHsqnA57e4LT0Ek==";
}; options {
default-key "rndc-key";
default-server 127.0.0.1;
default-port 953;
};
This file is automatically read both by named and rndc
Sign the zone example.org
Run BIND as user/group named (both must be created if needed) instead of root
Run BIND in a chroot jail /var/cache/bind
(actually is the chroot command that starts the named server)
Linux Quick Reference Guide 4 th ed. June 2016 © Daniele Raffo www.crans.org/~raffo
124/150 DNS configuration
DNS configuration
/etc/named.conf DNS server configuration file
controls {
inet 127.0.0.1 allow {localhost;} keys {rndckey;};
}; key "rndc-key" { // TSIG key
algorithm dsa;
secret "HYZur46fftdUQ43BJKI093t4t78lkp";
}; acl "mynetwork" {10.7.0.0/24;}; // Alias definition
// Built-in ACLs: any, none, localhost, localnets options {
directory "/var/named"; // Working directory
version "0.0"; // Hide version number by replacing it with 0.0
listen-on port 53 {10.7.0.1; 127.0.0.1;}; // Port and own IP addresses to listen on
blackhole {172.17.17.0/24;}; // IPs whose packets are to be ignored
allow-query {mynetwork;}; // IPs allowed to do iterative queries
allow-query-on {any;}; // Local IPs that can accept iterative queries
allow-query-cache {any;}; // IPs that can get an answer from cache
allow-recursion {mynetwork;}; // IPs to accept recursive queries from (typically
// own network's IPs). The DNS server does the full
// resolution process on behalf of these client IPs,
// and returns a referral for the other IPs
allow-recursion-on {mynetwork;}; // Local IPs that can accept recursive queries
allow-transfer {10.7.0.254;}; // Zone transfer is restricted to these IPs (slaves);
// on slave servers, this option should be disabled
allow-update {any;}; // IPs to accept DDNS updates from
recursive-clients 1000; // Max number of simultaneous recursive lookups
dnssec-enable yes; // Enable DNSSEC
dialup no; // Not a dialup connection: external zone maintenance
// (e.g. sending heartbeat packets, external zone transfers)
// is then permitted
forward first; // Site-wide cache: bypass the normal resolution
forwarders {10.7.0.252; 10.7.0.253;}; // method by querying first these central DNS
// servers if they are available
};
// Define the root name servers zone "." {
type hint;
file "root.cache";
}
// Configure system to act as a master server for the example.org domain zone "example.org" IN {
type master;
file "master/example.org.zone"; // Zone file for the example.org domain
}; zone "240.123.224.in-addr.arpa" IN { // Configure reverse lookup zone (for 224.123.240.0/24)
type master;
file "slave/example.org.revzone";
};
// Configure system to act as a slave server for the example2.org domain zone "example2.org" IN {
type slave;
file "slave/example2.org.zone"; // Slave: do not edit this zone file!
masters {10.7.0.254;};
}; zone "0.7.10.in-addr.arpa" IN { // Configure reverse lookup zone (for 10.7.0.0/24)
type slave;
file "slave/10.7.0.revzone";
masters {10.7.0.254;};
};
Linux Quick Reference Guide 4 th ed. June 2016 © Daniele Raffo www.crans.org/~raffo
125/150 DNS zone file
DNS zone file
/var/named/master/example.org.zone DNS zone file for the example.org zone
$TTL 86400 ; TTL (1 day)
$ORIGIN example.org.
example.org IN SOA dns1.example.org. help.example.org. ( ; Master DNS server is dns1.example.org
2014052300 ; serial ; For problems contact [email protected]
28800 ; refresh (8 hours)
7200 ; retry (2 hours)
604800 ; expire (1 week)
600 ) ; negative TTL (10 mins)
IN NS dns1.example.org.
IN NS dns2.example.org.
IN MX 10 mail1.example.org.
IN MX 20 mail2.example.org.
dns1 IN A 224.123.240.3
dns2 IN A 224.123.240.4
mail1 IN A 224.123.240.73
mail2 IN A 224.123.240.77
foo IN A 224.123.240.12
bar IN A 224.123.240.13
www IN A 224.123.240.19
baz IN CNAME bar subdomain IN NS ns1.subdomain.example.org. ; Glue records
IN NS ns2.subdomain.example.org.
ns1.subdomain.example.org. IN A 224.123.240.201
ns2.subdomain.example.org. IN A 224.123.240.202
/var/named/master/example.org.revzone DNS reverse zone file for the example.org zone
$TTL 86400 ; TTL (1 day) example.org IN SOA dns1.example.org. help.example.org. (
2014052300 ; serial
28800 ; refresh (8 hours)
7200 ; retry (2 hours)
604800 ; expire (1 week)
600 ) ; negative TTL (10 mins)
12.240.123.224.in-addr.arpa IN PTR foo
13.240.123.224.in-addr.arpa IN PTR bar
19.240.123.224.in-addr.arpa IN PTR www
SOA
$TTL
$ORIGIN
Resource Records
How long to cache a positive response
Suffix appended to all names not ending with a dot.
Useful when defining multiple subdomains inside the same zone
Start Of Authority for the example.org zone serial Serial number. Must be increased after each edit of the zone file refresh retry expire
How frequently a slave server refreshes its copy of zone data from the master
How frequently a slave server retries connecting to the master
How long a slave server relies on its copy of zone data. After this time period expires, the slave server is not authoritative anymore for the zone unless it can contact a master
A
PTR
CNAME
negative TTL How long to cache a non-existent answer
Address: maps names to IP addresses. Used for DNS lookups.
Pointer: maps IP addresses to names. Used for reverse DNS lookups.
Each A record must have a matching PTR record
Canonical Name: specifies an alias for a host with an A record (even in a different zone).
Discouraged as it causes multiple lookups; it is better to use multiple A records instead
NS
MX
Name Service: specifies the authoritative name servers for the zone
Mailserver: specifies address and priority of the servers able to handle mail for the zone
Glue Records are not really part of the zone; they delegate authority for other zones, usually subdomains
Linux Quick Reference Guide 4 th ed. June 2016 © Daniele Raffo www.crans.org/~raffo
126/150 Apache
Apache
apache2ctl (Debian) httpd (Red Hat)
Command to manage the Apache webserver apache2ctl start apache2ctl status apache2ctl fullstatus apache2ctl graceful apache2ctl graceful-stop apache2ctl configtest apache2ctl -M httpd -M
Start the Apache webserver daemon httpd
Display a brief status report
Display a detailed status report
Gracefully restart Apache; currently open connections are not aborted
Gracefully stop Apache; currently open connections are not aborted
Test the configuration file, reporting any syntax error
List all loaded and shared modules
/var/www/html
$HOME/public_html
Default document root directory
Default document root directory for users' websites
Web content must be readable by the user/group the Apache process runs as. For security reasons, it should be owned and writable by the superuser or the webmaster user/group, not the Apache user/group.
/etc/httpd/conf/httpd.conf (Red Hat)
/etc/apache2/httpd.conf (Debian and SUSE)
Apache configuration file prefork MPM worker MPM
Methods of MPM (Multi-Processing Modules) operation of the Apache webserver
A number of child processes is spawned in advance, with each child serving one connection.
Highly reliable due to Linux memory protection that isolates each child process
Multiple child processes spawn multiple threads, with each thread serving one connection.
More scalable but prone to deadlocks if third-party non-threadsafe modules are loaded
HTTPS
A secure web server (using HTTP over SSL i.e. HTTPS) hands over its public key to the client when the latter connects to it via port 443. The server's public key is signed by a CA (Certification Authority), whose validity is ensured by the root certificates stored into the client's browser.
The openssl command and its user-friendly CA.pl script are the tools of the OpenSSL crypto library that can be used to accomplish all public key crypto operations e.g. generate key pairs, Certificate Signing Requests, self-signed certificates.
Virtual hosting with HTTPS requires assigning an unique IP address for each virtual host; this because the SSL handshake (during which the server sends its certificate to the client's browser) takes place before the client sends the Host: header (which tells which virtual host the client wants to talk to).
A workaround for this is SNI (Server Name Indication) that makes the browser send the hostname in the first message of the SSL handshake. Another workaround is to have all multiple name-based virtual hosts use the same
SSL certificate with a wildcard domain *.example.org.
/etc/ssl/openssl.cnf
/etc/httpd/conf.d/ssl.conf (Red Hat)
Configuration file for OpenSSL
Configuration file for the mod_ssl module
Linux Quick Reference Guide 4 th ed. June 2016 © Daniele Raffo www.crans.org/~raffo
127/150 Apache configuration
ServerName www.mysite.org:80
ServerRoot /etc/httpd
ServerAdmin [email protected]
StartServers 5
Apache configuration
httpd.conf Apache configuration
Server configuration directives
Name and port (if omitted, uses default HTTP port 80) of server
Root directory for config and log files
Contact address that the server includes in any HTTP error messages to the client. Can be an email address or an URL
Number of servers to start initially
Minimum and maximum number of idle child server processes MinSpareServers 5
MaxSpareServers 10
MaxClients 256 (before v2.3.13)
MaxRequestWorkers 256 (after v2.3.13)
ServerLimit 256
ThreadsPerChild 25
ThreadLimit 64
LoadModule mime_module modules/mod_mime.so
Load the module mime_module by linking in the object file or library modules/mod_mime.so
Listen 10.17.1.1:80
Listen 10.17.1.5:8080
Make the server accept connections on the specified IP addresses (optional) and ports
User nobody
Group nobody
Worker MPM: number of threads created by each child process
Worker MPM: max configured value for ThreadsPerChild
DocumentRoot /var/www/html
Alias /image /mydir/pub/image
User and group the Apache process runs as. For security reasons, this should not be root
Main configuration directives
Directory in filesystem that maps to the root of the website
Map the URL http://www.mysite.org/image/ to the directory
/mydir/pub/image in the filesystem. This allows Apache to serve content placed outside of the document root
TypesConfig conf/mime.types
Max number of simultaneous requests that will be served; clients above this limit will get a HTTP error 503 - Service Unavailable.
Prefork MPM: max number of child processes launched to serve requests.
Worker MPM: max total number of threads available to serve requests
Prefork MPM: max configured value for MaxRequestWorkers.
Worker MPM: in conjunction with ThreadLimit, max configured value for MaxRequestWorkers
AddType image/jpeg jpeg jpg jpe
Redirect permanent /foo /bar
Media types file. The path is relative to ServerRoot
Map the specified filename extensions onto the specified content type. These entries adds to or override the entries from the media types file conf/mime.types
Redirect to a URL on the same host. Status can be: permanent return a HTTP status 301 - Moved Permanently temp return a HTTP status 302 - Found
(i.e. the resource was temporarily moved) seeother return a HTTP status 303 - See Other gone return a HTTP status 410 - Gone
If status is omitted, default status temp is used
Redirect /foo http://www.example.com/foo
AccessFileName .htaccess
<Directory "/var/www/html/foobar">
AllowOverride AuthConfig Limit
</Directory>
Redirect to a URL on a different host
Name of the distributed configuration file, which contains directives that apply to the document directory it is in and to all its subtrees
Specify which global directives a .htaccess file can override:
AuthConfig authorization directives for directory protection
FileInfo document type and metadata
Indexes directory indexing
Limit host access control
Options specific directory features
All all directives
None no directive
Linux Quick Reference Guide 4 th ed. June 2016 © Daniele Raffo www.crans.org/~raffo
128/150 Apache virtual hosts
NameVirtualHost *
Apache virtual hosts
httpd.conf Apache configuration
Virtual hosts directives
Specify which IP address will serve virtual hosting. The argument can be an IP address, an address:port pair, or * for all
IP addresses of the server. The argument will be repeated in the relevant <VirtualHost> directive
<VirtualHost *:80>
ServerName www.mysite.org
ServerAlias mysite.org *.mysite.org
DocumentRoot /var/www/vhosts/mysite
</VirtualHost>
<VirtualHost *:80>
ServerAdmin [email protected]
ServerName www.mysite2.org
DocumentRoot /var/www/vhosts/mysite2
ErrorLog /var/www/logs/mysite2
</VirtualHost>
<VirtualHost *:8080>
ServerName www.mysite3.org
DocumentRoot /var/www/vhosts/mysite3
</VirtualHost>
<VirtualHost 10.17.1.5:80>
ServerName www.mysite4.org
DocumentRoot /var/www/vhosts/mysite4
</VirtualHost>
LogFormat "%h %l %u %t \"%r\" %>s %b"
The first listed virtual host is also the default virtual host.
It inherits those main settings that does not override.
This virtual host answers to http://www.mysite.org , and also redirects there all HTTP requests on the domain mysite.org
Name-based virtual host http://www.mysite2.org .
Multiple name-based virtual hosts can share the same IP address; DNS must be configured accordingly to map each name to the correct IP address. Cannot be used with HTTPS
Port-based virtual host answering to connections on port 8080.
In this case the config file must contain a Listen 8080 directive
IP-based virtual host answering to http://10.17.1.5
Logging directives
Specify the format of a log
LogFormat "%h %l %u %t \"%r\" %>s %b" common Specify a nickname (here, "common") for a log format.
This one is the CLF (Common Log Format) defined as such:
%h IP address of the client host
%l Identity of client as determined by identd
%u User ID of client making the request
%t Timestamp the server completed the request
%r Request as done by the user
%s Status code sent by the server to the client
%b Size of the object returned, in bytes
CustomLog /var/log/httpd/access_log common
TransferLog /var/log/httpd/access_log
TransferLog "|rotatelogs access_log 86400"
HostnameLookups Off
Set up a log filename, with the format or (as in this case) the nickname specified
Set up a log filename, with format determined by the most recent LogFormat directive which did not define a nickname
Organize log rotation every 24 hours
Disable DNS hostname lookup to save network traffic.
Hostnames can be resolved later by processing the log file: logresolve <access_log >accessdns_log
Linux Quick Reference Guide 4 th ed. June 2016 © Daniele Raffo www.crans.org/~raffo
129/150 Apache directory protection
Apache directory protection
<Directory "/var/www/html/foobar">
[list of directives]
</Directory>
<Location /foobar>
[list of directives]
</Location>
httpd.conf Apache configuration
Limited scope directives
Limit the scope of the specified directives to the directory
/var/www/html/foobar and its subdirectories
Limit the scope of the specified directive to the URL http://www.mysite.org/foobar/ and its subdirectories
Directory protection directives
<Directory "/var/www/html/protected">
AuthName "Protected zone" Name of the realm. The client will be shown the realm name and prompted to enter an user and password
AuthType Basic
AuthUserFile "/var/www/.htpasswd"
AuthGroupFile "/var/www/.htgroup"
Require valid-user
Allow from 10.13.13.0/24
Type of user authentication: Basic, Digest, Form, or None
User database file. Each line is in the format
user:encrypted_password
To add an user jdoe to the database file, use the command: htpasswd -c /var/www/.htpasswd jdoe
(will prompt for his password)
Group database file. Each line contains a groupname followed by all member usernames: mygroup: jdoe ksmith mgreen
Control who can access the protected resource.
valid-user any user in the user database file user jdoe only the specified user group mygroup only the members of the specified group
Control which host can access the protected resource
Satisfy Any
Order Allow,Deny
Set the access policy concerning user and host control.
All both Require and Allow criteria must be satisfied
Any any of Require or Allow criteria must be satisfied
Control the evaluation order of Allow and Deny directives.
Allow,Deny First, all Allow directives are evaluated; at least one must match, or the request is rejected. Next, all Deny directives are evaluated; if any matches, the request is rejected. Last, any requests which do not match an Allow or a Deny directive are denied
Deny,Allow First, all Deny directives are evaluated; if any match, the request is denied unless it also matches an Allow directive. Any requests which do not match any Allow or
Deny directives are permitted
</Directory>
Linux Quick Reference Guide 4 th ed. June 2016 © Daniele Raffo www.crans.org/~raffo
130/150 Apache SSL/TLS
Apache SSL/TLS
SSLCACertificatePath \
/usr/local/apache2/conf/ssl.crt/
httpd.conf Apache configuration
SSLCertificateFile \
SSL/TLS directives (module mod_ssl)
SSL server certificate
/etc/httpd/conf/ssl.crt/server.crt
SSLCertificateKeyFile \
/etc/httpd/conf/ssl.key/server.key
SSL server private key (for security reasons, this file must be mode 600 and owned by root)
Directory containing the certificates of CAs. Files in this directory are PEM-encoded and accessed via symlinks to hash filenames
SSLCACertificateFile \
/usr/local/apache2/conf/ssl.crt/ca-bundle.crt
SSLCertificateChainFile \
/usr/local/apache2/conf/ssl.crt/ca.crt
SSLEngine on
SSLProtocol +SSLv3 +TLSv1.2
SSLCipherSuite \
ALL:!aDH:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP
ServerTokens Full
Certificates of CAs. Certificates are PEM-encoded and concatenated in a single bundle file in order of preference
Certificate chain of the CAs. Certificates are PEM-encoded and concatenated from the issuing CA certificate of the server certificate to the root CA certificate. Optional
Enable the SSL/TLS Protocol Engine
SSL protocol flavors that the client can use to connect to server. Possible values are:
SSLv2 (deprecated)
SSLv3
TLSv1
TLSv1.1
TLSv1.2
All (all the above protocols)
Cipher suite available for the SSL handshake (key exchange algorithms, authentication algorithms, cipher/encryption algorithms, MAC digest algorithms)
Server response header field to send back to client.
Possible values are:
Prod sends Server: Apache
Major sends Server: Apache/2
Minor sends Server: Apache/2.4
Minimal sends Server: Apache/2.4.2
OS sends Server: Apache/2.4.2 (Unix)
Full (or not specified) sends
Server: Apache/2.4.2 (Unix) PHP/4.2.2 MyMod/1.2
ServerSignature Off
SSLVerifyClient none
Trailing footer line on server-generated documents.
Possible values are:
Off no footer line (default)
On server version number and ServerName
EMail as above, plus a mailto link to ServerAdmin
Certificate verification level for client authentication.
Possible values are: none no client certificate is required require optional the client needs to present a valid certificate the client may present a valid certificate (this option is unused as it doesn't work on all browsers) optional_no_ca the client may present a valid certificate but it doesn't need to be successfully verifiable (this option has not much purpose and is used only for SSL testing)
TraceEnable on Enable TRACE requests
Linux Quick Reference Guide 4 th ed. June 2016 © Daniele Raffo www.crans.org/~raffo
131/150
openssl x509 -text -in certif.crt -noout openssl req -text -in request.csr -noout openssl req -new -key private.key -out request.csr openssl req -new -nodes -keyout private.key \
-out request.csr -newkey rsa:2048 openssl req -x509 -newkey rsa:2048 -nodes \
-keyout private.key -out certif.crt -days validity openssl ca -config ca.conf -in request.csr \
-out certif.crt -days validity -verbose openssl ca -config ca.conf -gencrl -revoke certif.crt \
-crl_reason why openssl ca -config ca.conf -gencrl -out crlist.crl
OpenSSL
OpenSSL
Read a certificate
Read a Certificate Signing Request
Generate a Certificate Signing Request (in PEM format) for the public key of a key pair
Create a 2048-bit RSA key pair and generate a
Certificate Signing Request for it
Generate a new CA private key, create a 2048-bit
RSA key pair and generate a CSR for it
Sign a CSR (to generate a self-signed certificate, the steps are creating a CSR and signing it)
Revoke a certificate
Generate a Certificate Revocation List containing all revoked certificates so far openssl x509 -in certif.pem -outform DER \
-out certif.der openssl pkcs12 -export -in certif.pem \
-inkey private.key -out certif.pfx -name friendlyname cat cert.crt cert.key > cert.pem
openssl dgst -hashfunction -out file.hash file openssl dgst -hashfunction file | cmp -b file.hash openssl dgst -hashfunction -sign private.key \
-out file.sig file openssl dgst -hashfunction -verify public.key \
-signature file.sig file openssl enc -e -cipher -in file -out file.enc -salt openssl enc -d -cipher -in file.enc -out file openssl genpkey -algorithm RSA -cipher 3des \
-pkeyopt rsa_keygen_bits:2048 -out key.pem openssl genrsa -des3 -out key.pem 2048 openssl pkey -text -in private.key -noout openssl rsa -text -in private.key -noout openssl pkey -in old.key -out new.key -cipher openssl rsa -in old.key -out new.key -cipher openssl pkey -in old.key -out new.key
Convert a certificate from PEM to DER
Convert a certificate from PEM to PKCS#12 including the private key
Create a PEM certificate from CRT and private key
Generate the digest of a file
Verify the digest of a file (if there is no output, then digest verification is successful)
Generate the signature of a file
Verify the signature of a file
Encrypt a file
Decrypt a file
Generate a 2048-bit RSA key pair protected by
TripleDES passphrase
Generate a 2048-bit RSA key pair protected by
TripleDES passphrase (older versions of OpenSSL)
Examine a private key
Examine a private key
(older versions of OpenSSL)
Change the passphrase of a private key
Change the passphrase of a private key
(older versions of OpenSSL)
Remove the passphrase from a private key
1. openssl s_client -connect www.website.com:443 > tmpfile
2.
CTRL C
3. openssl x509 -in tmpfile -text
Retrieve and inspect a SSL certificate from a website openssl list-message-digest-commands openssl list-cipher-commands
List all available hash functions
List all available ciphers
Linux Quick Reference Guide 4 th ed. June 2016 © Daniele Raffo www.crans.org/~raffo
132/150
CA.pl -newca
CA.pl -newreq
CA.pl -signreq
CA.pl -pkcs12 "Certificate name"
CA.pl -newcert
CA.pl -newreq-nodes
CA.pl -verify
Create a Certification Authority hierarchy
Generate a Certificate Signing Request
Sign a Certificate Signing Request
Generate a PKCS#12 certificate from a Certificate Signing Request
CA.pl
CA.pl
Generate a self-signed certificate
Generate a Certificate Signing Request, with unencrypted private key
(this is necessary for use in servers, because the private key is accessed in non-interactive mode i.e. without passphrase typing)
Verify a certificate against the Certification Authority certificate for "demoCA"
Linux Quick Reference Guide 4 th ed. June 2016 © Daniele Raffo www.crans.org/~raffo
133/150 Samba (server)
Samba (server)
Samba is a free-software, cross-platform implementation of SMB/CIFS.
SMB (Server Message Block) is Microsoft's proprietary protocol for file and printer sharing, while CIFS (Common Internet File
System) is the public version of SMB.
WINS (Windows Internet Name Service) is a name service used to translate NetBIOS names to IP addresses.
TCP/UDP 137
TCP/UDP 138
TCP/UDP 139
TCP 445
TCP 389
TCP 901 netbios-ns netbios-dgm netbios-ssn microsoft-ds
Commonly used ports in Samba
NetBIOS name service requests and responses
NetBIOS datagram services e.g. server announcements
NetBIOS session service e.g. file and printer sharing
Active Directory - registration and translation of NetBIOS names, network browsing
LDAP
SWAT service
The full list of used ports can be found via the command grep -i netbios /etc/services smbd nmbd
Server Message Block daemon. Provides SMB file and printer sharing, browser services, user authentication, and resource lock. An extra copy of this daemon runs for each client connected to the server
NetBIOS Name Service daemon. Handles NetBIOS name lookups, WINS requests, list browsing and elections.
An extra copy of this daemon runs if Samba functions as a WINS server.
Another extra copy of this daemon runs if DNS is used to translate NetBIOS names
/etc/smb/
/etc/samba/ (RHEL 7 onwards)
/etc/samba/lmhosts
/etc/samba/netlogon
Samba directory
Samba NetBIOS hosts file
User logon directory
Show the version of the Samba server smbd -V smbclient -V testparm smbpasswd jdoe smbpasswd -a ksmith
Check the Samba configuration file and report any error
Change the Samba password of user jdoe
Create a new Samba user ksmith and set his password nmblookup smbserver nmblookup -U winsserver -R WORKGROUP#1B nmblookup -U winsserver -R WORKGROUP#1D net net rpc shutdown -r -S smbserver -U root%password net rpc service list -S smbserver net status sessions net status shares net rpc info net groupmap list
Look up the NetBIOS name of a server and map it to an IP address
Query recursively a WINS server for the Domain Master
Browser for the specified workgroup
Query recursively a WINS server for the Domain Controller for the specified workgroup
Tool for administration of Samba and remote CIFS servers
Reboot a CIFS server
List available services on a CIFS server
Show active Samba sessions
Show Samba shares
Show information about the domain
Show group mappings between Samba and Windows
Linux Quick Reference Guide 4 th ed. June 2016 © Daniele Raffo www.crans.org/~raffo
134/150
smbmount mount.cifs
smbmount //smbserver/share1 /mnt/shares/sh1 \
-o auto,credentials=/etc/smbcreds smbmount //smbserver/share1 /mnt/shares/sh1 \
-o username=jdoe smbstatus smbclient //smbserver/share1 smbclient -L //smbserver -W WORKGROUP -U user cat msg.txt | smbclient -M client -U user
Samba (client)
Samba (client)
Mount a Samba share on a Linux filesystem, using the CIFS filesystem interface
Mount a Samba share checking access upon a credentials file /etc/smbcreds (which should be readable only by root): username = jdoe password = jd03s3cr3t
Mount a Samba share as user jdoe
Display current information about shares, clients connections, and locked files
Access a Samba share on a server (with a FTP-like interface)
List the Samba resources available on a server, belonging to the specified workgroup and accessible to the specified user
Show a message popup on the client machine (using the
WinPopup protocol) credentials=file username=user password=password
Samba mount options
Mount the share as the user defined in the credentials file
Mount the share as user
Specify the mount user's password
Linux Quick Reference Guide 4 th ed. June 2016 © Daniele Raffo www.crans.org/~raffo
135/150 Samba global configuration
[global]
workgroup = MYWORKGROUP
security = user
encrypt passwords = yes
Samba global configuration
/etc/samba/smb.conf Samba configuration
Global server settings: defines parameters applicable for the whole
Samba server and sets the defaults that will be used for the parameters not mentioned in other sections
Make Samba join the specified workgroup
server string = Linux Samba Server %L
hosts allow = 10.9.9.0/255.255.255.0
Describe server to the clients
Allow only the specified machines to connect to the server
Set up user-level authentication
Use encrypted passwords
smb passwd file = /etc/samba/smbpasswd
unix password sync = yes
username map = /etc/samba/smbusers
netbios name = Mysambabox
netbios aliases = Mysambabox1
wins support = yes
Refer to the specified password file for user authentication.
A new user's password will need to be set both in Linux and Samba by using these commands from shell prompt: passwd newuser smbpasswd newuser
When the password of a client user (e.g. under Windows) is changed, change the Linux and Samba password too
Map each Samba server user name to client user name(s).
The file /etc/samba/smbusers is structured as follows: root = Administrator Admin jdoe = "John Doe" kgreen = "Kim Green"
Set NetBIOS name and alias
logon server = yes
log file = /var/log/samba/log.%m
max log size = 1000
syslog only = no
syslog = 0
Make Samba play the role of a WINS server.
Note: There should be only one WINS server on a network
Enable logon support.
Logon script parameters will be defined in a [netlogon] section
Use a separate logfile for each machine that connects
Maximum size of each logfile, in Kb
Whether to log only via Syslog
Log everything to the logfiles /var/log/smb/log.smbd and
/var/log/smb/log.nmbd, and log a minimum amount of information to Syslog. This parameter can be set to a higher value to have Syslog log more information
Mail a backtrace to the sysadmin in case Samba crashes panic action = \
/usr/share/samba/panic-action %d
[netlogon]
comment = Netlogon for Windows clients
path = /home/netlogon
logon script = %U.bat
Section defining a logon script
Specifies a per-user script e.g. /home/netlogon/jdoe.bat will be called when user jdoe logs in.
It is also possible to specify a per-clientname script %m.bat, which will be called when a specific machine logs in.
browseable = no
writeable = no
guest ok = no Guest access to the service (i.e. access without entering a password) is disabled
Section defining a printer accessible via the network [Canon LaserJet 3]
printer name = lp
comment = Canon LaserJet 3 main printer
path = /var/spool/lpd/samba
printable = yes
writeable = no
Linux Quick Reference Guide 4 th ed. June 2016 © Daniele Raffo www.crans.org/~raffo
136/150 Samba share configuration
Samba share configuration
[public]
comment = Public Storage on %L
/etc/samba/smb.conf Samba configuration
Section defining a public share accessible on read/write by anyone
Describe the public share to users
path = /home/samba
browsable = yes
writeable = yes
[homes]
Path of the public share on the server
Whether to show the public share when browsing
Whether to allow all users to write in this directory
Section enabling users that have an account and a home directory on the Samba server to access it and modify its contents from a
Samba client.
The path variable is not set, by default is path=/home/%S
comment = %U's home directory on %L from %m
browseable = no
writeable = yes
[foobar]
path = /foobar
comment = Share Foobar on %L from %m
browsable = yes
writeable = yes
Describe the share to the user
Whether to show the homes share when browsing
Whether to allow the user to write in his home directory
Section defining a specific share
Path of the share on the server
Describe the share to users
Whether to show the share when browsing
Whether to allow the users to write in this share
valid users = jdoe, kgreen, +geeks
invalid users = csmith
read list = bcameron
write list = fcastle
Allow access only to users jdoe and kgreen, and local group geeks
Deny access to user csmith
Allow read-only access to user bcameron
Allow read-write access to user fcastle
Linux Quick Reference Guide 4 th ed. June 2016 © Daniele Raffo www.crans.org/~raffo
137/150 Samba share access and macros
Samba share access and macros
[global]
security = user
guest account = nobody
map to guest = Never
[global]
security = server
Samba share access (defined in the configuration file)
User-level authentication
password server = srv1 srv2
Set up user-level authentication
Map the guest account to the system user nobody (default)
Specify how incoming requests are mapped to the guest account:
Bad User redirect from an invalid user to guest account on server
Bad Password redirect from an invalid password to guest account on server
Never reject unauthenticated users
Server-level authentication
Set up server-level authentication
Authenticate to server srv1, or to server srv2 if srv1 is unavailable
Domain-level authentication
[global]
security = ADS
realm = KRB_REALM
[global]
security = share
[foobar]
path = /foobar
username = quux
only user = yes
Set up domain-level authentication as an Active Directory member server
Join the specified realm.
Kerberos must be installed and an administrator account must be created: net ads join -U Administrator%password
Share-level authentication
Set up share-level authentication
Define a foobar share accessible to any user which can supply quux's password.
The user quux must be created on the system: useradd -c "Foobar account" -d /tmp -m -s /sbin/nologin quux and added to the Samba password file: smbpasswd -a quux
%S
%U
%G
%h
%M
%L
%m
%d
%a
%I
Samba macros
Username
Session username (the username that the client requested, not necessarily the same as the one he got)
Primary group of session username
Samba server hostname
Client hostname
NetBIOS name of the server
NetBIOS name of the client
Process ID of the current server process
Architecture of remote machine
IP address of client machine
%i
%T
%D
%w
Local IP address to which a client connected
Current date and time
Domain or workgroup of the current user
Winbind separator
%$(var) Value of the environment variable var
%p
%S
%P
%u
%g
%H
%N
The substitutes below apply only to the configuration options that are used when a connection has been established:
Name of the current service, if any
Root directory of the current service, if any
Username of the current service, if any
Primary group name of username
Home directory of username
Name of the NIS home directory server as obtained from the NIS auto.map entry.
Same as %L if Samba was not compiled with the --with-automount option
Path of service's home directory as obtained from the NIS auto.map entry.
The NIS auto.map entry is split up as %N:%p
Linux Quick Reference Guide 4 th ed. June 2016 © Daniele Raffo www.crans.org/~raffo
138/150 NFS
A Network File System (NFS) server makes filesystems available to remote clients for mounting.
The portmapper is needed by NFS to map incoming TCP/IP connections to the appropriate NFS RPC calls. Some Linux distributions use rpcbind instead of the portmapper.
For security, the TCP Wrapper should be configured to limit access to the portmapper to NFS clients only: file /etc/hosts.deny should contain portmap: ALL file /etc/hosts.allow should contain portmap: IP_addresses_of_clients
NFS handles user permissions across systems by considering users with same UID and username as the same user.
Group permission is evaluated similarly, by GID and groupname.
NFS
NFS daemons rpc.nfsd
rpc.mountd
rpc.lockd
rpc.statd
/etc/exports
/var/lib/nfs/xtab
/proc/fs/nfs/exports exportfs -ra exportfs -ua showmount showmount --directories showmount --exports showmount --all showmount -e nfsserver rpcinfo -p nfsserver rpcinfo -t nfsserver nfs rpcinfo -u nfsserver nfs nfsstat
List of the filesystems to be exported (via the command exportfs)
List of exported filesystems, maintained by exportfs
Kernel export table (can be examined via the command cat)
Export or reexport all directories.
When exporting, fills the kernel export table /proc/fs/nfs/exports.
When reexporting, removes those entries in /var/lib/nfs/xtab that are deleted from /etc/exports (therefore synchronizing the two files), and removes those entries from /proc/fs/nfs/exports that are no longer valid
Unexport all directories.
Removes from /proc/fs/nfs/exports all those entries that are listed in
/var/lib/nfs/xtab, and clears the latter file
Show the remote client hosts currently having active mounts
Show the directories currently mounted by a remote client host
Show the filesystems currently exported i.e. the active export list
Show both remote client hosts and directories
Show the shares a NFS server has available for mounting
Probe the portmapper on a NFS server and display the list of all registered
RPC services there
Test a NFS connection by sending a null pseudo request (using TCP)
Test a NFS connection by sending a null pseudo request (using UDP)
Display NFS/RPC client/server statistics.
Options:
server client both
NFS RPC
-sn -sr
-cn
-n
-cr
-r
-s
both
-c
-nr mount -t nfs nfsserver:/share /usr Command to be run on a client to mount locally a remote NFS share.
NFS shares accessed frequently should be added to /etc/fstab e.g.
nfsserver:/share /usr nfs intr 0 0
Linux Quick Reference Guide 4 th ed. June 2016 © Daniele Raffo www.crans.org/~raffo
139/150 /etc/exports
/etc/exports
filesystem Filesystem on the NFS server to be exported to clients
client identity
Client systems allowed to access the exported directory.
Can be identified by hostname, IP address, wildcard, subnet, or @NIS workgroup.
Multiple client systems can be listed, and each one can have different options ro rw
Read-only access (default)
Read and write access. The client may choose to mount read-only anyway
client options
sync async
/etc/exports
/export/ 10.3.3.3(rw)
/export/ *(ro,sync)
/home/ftp/pub client1(rw) *.example.org(ro)
/home/crew @FOOBARWORKGROUP(rw) (ro)
Reply to requests only after the changes made by these requests have been committed to stable storage
Reply to requests without waiting that changes are committed to stable storage.
Improves performances but might cause loss or corruption of data if server crashes root_squash Requests by user root on client will be done as user nobody on server (default) no_root_squash Requests by user root on client will be done as same user root on server all_squash no_all_squash
Requests by a non-root user on client will be done as user nobody on server
Requests by a non-root user on client will be attempted as same user on server (default) soft bg fg tcp udp rsize=nnn wsize=nnn nfsvers=n retry=n timeo=n intr nointr hard
NFS mount options
Size for read transfers (from server to client)
Size for write transfers (from client to server)
Use NFS version n for transport
Keep retrying a mount attempt for n minutes before giving up
A mount attempt times out after n tenths of a second
User can interrupt a mount attempt
User cannot interrupt a mount attempt (default)
The system will try a mount indefinitely (default)
The system will try a mount until an RPC timeout occurs
Try a mount in the foreground, all retries occur in the background
All mount attempts occur in the foreground (default)
Connect using TCP
Connect using UDP
Linux Quick Reference Guide 4 th ed. June 2016 © Daniele Raffo www.crans.org/~raffo
140/150 DHCP
DHCP
A DHCP (Dynamic Host Configuration Protocol) server listens for requests on UDP port 67 and answers to UDP port 68.
The assignment of an IP address to a host is done through a sequence of DHCP messages initiated by the client host:
DHCP Discover, DHCP Offer, DHCP Request, DHCP Acknowledgment.
Because DHCP Discover messages are broadcast and therefore not routed outside a LAN, a DHCP relay agent is necessary for those clients situated outside the DHCP server's LAN. The DHCP relay agent listens to DHCP Discover messages and relays them in unicast to the DHCP server.
/etc/dhcpd.conf
/etc/sysconfig/dhcrelay (SUSE)
/var/lib/dhcpd/dhcpd.leases
Configuration file for the DHCP server
Configuration file for the DHCP relay agent
DHCP current leases
/etc/dhcpd.conf DHCP server configuration
option domain-name-servers 10.2.2.2; option smtp-servers 10.3.3.3; option pop-servers 10.4.4.4; option time-servers 10.5.5.5; option nntp-servers 10.6.6.6;
Global parameters for DNS, mail, NTP, and news servers specification shared-network geek-net {
default-lease-time 86400;
max-lease-time 172800;
option routers 10.0.3.252;
option broadcast-address 10.0.3.255;
subnet 10.0.3.0 netmask 255.255.255.128 {
range 10.0.3.1 10.0.3.101;
}
subnet 10.0.3.128 netmask 255.255.255.128 {
range 10.0.3.129 10.0.3.229;
}
} group {
option routers 10.0.17.252;
option broadcast-address 10.0.17.255;
netmask 255.255.255.0;
host linuxbox1 {
hardware ethernet AA:BB:CC:DD:EE:FF;
fixed-address 10.0.17.42;
option host-name "linuxbox1";
}
host linuxbox2 {
hardware ethernet 33:44:55:66:77:88;
fixed-address 10.0.17.66;
option host-name "linuxbox2";
}
}
Definition of a network
Time, in seconds, that will be assigned to a lease if a client does not ask for a specific expiration time
Maximum time, in seconds, that can be assigned to a lease if a client asks for a specific expiration time
Definition of different subnets in the network, with specification of different ranges of IP addresses that will be leased to clients depending on the client's subnet
Definition of a group
Definition of different hosts to whom static IP addresses will be assigned to, depending on their MAC address
Linux Quick Reference Guide 4 th ed. June 2016 © Daniele Raffo www.crans.org/~raffo
141/150 PAM
PAM
PAM (Pluggable Authentication Modules) is an abstraction layer that allows applications to use authentication methods while being implementation-agnostic.
/etc/pam.d/service
/etc/pam.conf (obsolete) ldd /usr/sbin/service | grep libpam
PAM configuration for service
PAM configuration for all services
Check if service is enabled to use PAM
type control module
auth account password session optional required requisite
/etc/pam.d/service
auth requisite pam_securetty.so
auth required pam_nologin.so
auth required pam_env.so
auth required pam_unix.so nullok account required pam_unix.so
session required pam_unix.so
session optional pam_lastlog.so
password required pam_unix.so nullok obscure min=4 max=8
Authentication module to verify user identity and group membership
Authorization module to determine user's right to access a resource (other than his identity) sufficient
Module to update an user's authentication credentials
Module (run at end and beginning of an user session) to set up the user environment
Module is not critical to the success or failure of service
If this module successes, and no previous module has failed, module stack processing ends successfully. If this module fails, it is non-fatal and processing of the stack continues
If this module fails, processing of the stack continues until the end, and service fails
If this module fails, service fails and control returns to the application that invoked service include pam_nis.so
pam_ldap.so
Include modules from another PAM service file
PAM module and its options, e.g.: pam_unix.so
Standard UNIX authentication module via /etc/passwd and /etc/shadow
Module for authentication via NIS
Module for authentication via LDAP pam_fshadow.so
pam_cracklib.so
pam_limits.so
pam_listfile.so
Module for authentication against an alternative shadow passwords file
Module for password strength policies (e.g. length, case, max n of retries)
Module for system policies and system resource usage limits
Module to deny or allow the service based on an arbitrary text file
Linux Quick Reference Guide 4 th ed. June 2016 © Daniele Raffo www.crans.org/~raffo
142/150 LDAP
LDAP
LDAP (Lightweight Directory Access Protocol) is a simplified version of the X.500 standard and uses TCP port 389.
LDAP permits to organize hierarchically a database of entries, each one of which is identified by an unique DN (Distinguished
Name). Each DN has a set of attributes, each one of which has a value. An attribute may appear multiple times.
dn cn dc
Attribute
givenName sn mail telephoneNumber uid c l st street o ou manager
Most frequently used LDAP attributes
Example
dn: cn=John Doe,dc=example,dc=org
Meaning
Distinguished Name
(not an attribute; identifies the entry) cn: John Doe dc=example,dc=org givenName: John sn: Doe
Common Name
Domain Component
Firstname
Surname mail: [email protected]
telephoneNumber: +1 505 1234 567 uid: jdoe c: US l: San Francisco st: California street: 42, Penguin Road o: The Example Foundation ou: IT Dept manager: cn=Kim Green,dc=example,dc=org
Email address
Telephone number
User ID
Country code
Locality
State or province
Street
Organization
Organizational Unit
Manager ldapsearch -H ldap://ldapserver.example.org \
-s base -b "ou=people,dc=example,dc=com" \
"(sn=Doe)" cn sn telephoneNumber ldappasswd -x -D "cn=Admin,dc=example,dc=org" \
-W -S "uid=jdoe,ou=IT Dept,dc=example,dc=org" ldapmodify -b -r -f /tmp/mods.ldif
ldapadd -h ldapserver.example.org \
-D "cn=Admin" -W -f /tmp/mods.ldif
ldapdelete -v "uid=jdoe,dc=example,dc=org" \
-D "cn=Admin,dc=example,dc=org" -W
Query the specified LDAP server for entries where surname=Doe, and print common name, surname, and telephone number of the resulting entries.
Output is shown in LDIF
Authenticating as Admin, change the password of user jdoe in the OU called IT Dept, on example.org
Modify an entry according to the LDIF file /tmp/mods.ldif
Authenticating as Admin, add an entry by adding the content of the LDIF file /tmp/mods.ldif to the directory.
This command actually invokes ldapmodify -a
Authenticating as Admin, delete the entry of user jdoe dn: cn=John Doe, dc=example, dc=org changetype: modify replace: mail
LDIF (LDAP Data Interchange Format)
This LDIF file will change the email address of jdoe, add a picture, and delete the description attribute for the entry mail: [email protected]
add: jpegPhoto jpegPhoto:< file://tmp/jdoe.jpg
delete: description
-
Linux Quick Reference Guide 4 th ed. June 2016 © Daniele Raffo www.crans.org/~raffo
143/150
slapd
/var/lib/ldap/
/etc/openldap/slapd.conf
/usr/local/etc/openldap/slapd.conf
slapcat -l file.ldif
slapadd -l file.ldif
slapindex
Standalone OpenLDAP daemon
Files constituting the OpenLDAP database
OpenLDAP
OpenLDAP
OpenLDAP configuration file
Dump the contents of an OpenLDAP database to a LDIF file
Import an OpenLDAP database from a LDIF file
Regenerate OpenLDAP's database indexes yum install openldap openldap-clients \ authconfig sssd nss-pam-ldapd authconfig-gtk authconfig --enableldap --enableldapauth \
--ldapserver=ldap://ldapserver \
--ldapbasedn="dc=example,dc=org" \
--enablesssd --update getent group groupname authconfig-gtk system-config-authentication
Install the OpenLDAP client (on RHEL 7)
Set up the LDAP client to connect to a ldapserver.
This will update the configuration files /etc/sssd/sssd.conf and
/etc/openldap/ldap.conf
Get entries about groupname from NSS libraries
OpenLDAP configuration GUI sssd (the System Security Services Daemon) must be running to provide access to OpenLDAP as an authentication and identity provider.
Linux Quick Reference Guide 4 th ed. June 2016 © Daniele Raffo www.crans.org/~raffo
144/150 SELinux
SELinux
Security-Enhanced Linux (SELinux) is a Linux kernel security module that provides a mechanism for supporting access control security policies.
SELinux implements a Mandatory Access Control framework that allows the definition of fine-grained permissions for how
subjects (i.e. processes) interact with objects (i.e. other processes, files, devices, ports, sockets); this improves security with respect to the standard Discretionary Access Control, which defines accesses based on users and groups. The security
context of a file is stored in its extended attributes.
The decisions SELinux takes about allowing or disallowing access are stored in the AVC (Access Vector Cache). setenforce 0 echo 0 > /selinux/enforce setenforce 1 echo 1 > /selinux/enforce getenforce cat /selinux/enforce sestatus -v chcon context file chcon --reference=file0 file restorecon -f file ls -Z ps -eZ getsebool boolean setsebool boolean=value tar --selinux [other args] star -xattr -H=exustar [other args] semanage
/etc/selinux/config
(symlinked in /etc/sysconfig/selinux)
Enter permissive mode
Enter enforcing mode
Display current mode
Change the security context of file to the specified context
Change the security context of file to the same as the reference file file0
Restore the security context of file to the system default
List files and their security context
List processes and their security context
Get the value of a SELinux boolean
Set the value of a SELinux boolean
Create or extract archives that retain the security context of files
/selinux/
/var/log/audit/audit.log
/var/log/messages sealert -a logfile grep nnnnn.mmm:pp logfile | audit2why
Manage SELinux policies
SELinux mode can be configured permanently inside this file.
# This file controls the state of SELinux on the system.
# SELINUX= can take one of these three values:
# enforcing - SELinux security policy is enforced.
# permissive - SELinux prints warnings instead of enforcing.
# disabled - No SELinux policy is loaded.
SELINUX=enforcing
# SELINUXTYPE= can take one of these two values:
# targeted - Only targeted network daemons are protected.
# strict - Full SELinux protection.
SELINUXTYPE=targeted
Pseudo filesystem, created by SELinux, containing commands used by the kernel for its operations.
AVC denials are logged on this file if auditd is running
AVC denials are logged on this file if rsyslogd is running
Analyze a SELinux logfile and display SELinux policy violations
Diagnostic a specific AVC event entry from a SELinux logfile: type=AVC msg=audit(nnnnn.mmm:pp): avc: denied (...)
Linux Quick Reference Guide 4 th ed. June 2016 © Daniele Raffo www.crans.org/~raffo
145/150 KVM
KVM (Kernel-based Virtual Machine) is a virtualization infrastructure for the Linux kernel that allows it to function as an hypervisor.
KVM
/etc/libvirt/qemu/
/var/lib/libvirt/
Directory containing the XML files that define VMs properties.
libvirtd must be restarted after modifying a XML file
Directory containing files related to the VMs virt-manager KVM GUI virt-install --prompt virt-install -n vmname -r 2048 \
--disk path=/var/lib/libvirt/images/vmname.img \
-l /root/vmstuff/inst/ \
-x "ks=/root/vmstuff/kickstart.cfg"
Interactive command-line program to create a VM
Create a VM with 2 Gb of RAM, specifying path of virtual disk, location of installation files, and (as extra argument) Kickstart configuration to use virt-clone --prompt virt-clone -o vmname -n vmclonename virsh virsh list --all virsh start vmname virsh destroy vmname virsh shutdown vmname virsh autostart vmname virsh autostart --disable vmname virsh edit vmname virt-what
Interactive command-line program to clone a VM.
A VM must be shut off or paused before it can be cloned
Clone a VM
Interface for VM management
List all VMs present on the system
Start a VM
Brutally shut down a VM
Gracefully shut down a VM
Set a VM to be automatically started when the system boots.
Done by symlinking the VM to /etc/libvirt/qemu/autostart/
Disable the autostart of a VM at system boot
Edit the XML file defining a VM's properties
Detect whether the current machine is a VM
Kickstart
Kickstart is a method to perform automatic installation and configuration of RHEL machines.
This can be done by specifying inst.ks=hd:/dev/sda:/root/path/ksfile either as a boot option, or an option to the kernel command in GRUB 2.
system-config-kickstart ksvalidator ksfile
/root/anaconda-ks.cfg
ksverdiff -f RHEL6 -t RHEL7
GUI tool to create a Kickstart file
Check the validity of a Kickstart file
Kickstart file describing the current system. This file was automatically generated during the installation of the current system
Show the differences in the Kickstart syntax between RHEL 6 and RHEL 7
Linux Quick Reference Guide 4 th ed. June 2016 © Daniele Raffo www.crans.org/~raffo
146/150 HTML 4.01 (components)
Tag
<h1>...<h6> Heading
<br> Line break
Line break and carriage return
Attributes
align=left|center|right|justify
HTML 4.01 (components)
Heading alignment †
<hr> Horizontal line
align=left|center|right noshade size=npixels width=npixels|percent% align=left|center|right|justify
Line alignment †
Solid rendering instead of 3D †
Line height
Line width
Paragraph or section alignment †
<p> Paragraph
<div> Section
<span> Group
<a> Anchor
Group of elements
Hyperlink charset=encoding coords=left,top,right,bottom|
cx,cy,radius|x1,y1,...,xn,yn href=url hreflang=language name=section
Character encoding of target URL
Coordinates of region; depends on shape
Target URL for the link
Language of document at the target URL
Name of anchor for document bookmarking rel|rev=alternate|stylesheet| start|next|prev|contents|index| glossary|copyright|chapter| section|subsection|appendix| help|bookmark
Relationship between this document and the target URL
(rel) or vice versa (rev) shape=rectangle|circle|polygon Shape of region target=_blank|_parent|_self|_top Destination of target URL type=mimetype MIME type of target URL
<dl>
Definition list
<dt>
Definition term
<dd>
Definition description
Description of a definition term
† = deprecated
Linux Quick Reference Guide 4 th ed. June 2016 © Daniele Raffo www.crans.org/~raffo
147/150 HTML 4.01 (text)
HTML 4.01 (text)
Tag
<i> Italic
<b> Bold
<s>
<strike> Strike-through
<u> Underlined
<big> Bigger
<small> Smaller
<sub> Subscript
<sup> Superscript
<tt> Teletype
<em> Emphasized
<strong> Strong
Strike-through text †
Underlined text †
Monospaced text
Attributes
<del> Deleted
<ins> Inserted
Deleted/inserted text
Source code text
Sample code text
Keyboard key
Variable name
Citation block cite=url
URL to document explaining deletion/insertion datetime=yyyy-mm-dd When the text was deleted/inserted width=ncharacters
Max number of characters per line †
<pre> Preformatted
<code> Code
<samp> Sample
<kbd> Keyboard
<var> Variable
<cite> Citation
<blockquote> Quotation
<q> Short quotation
<address> Address
<abbr> Abbreviation
<acronym> Acronym
<dfn> Definition
Address block cite=url URL to document containing the quote
<font> Font
<bdo> Bidirectional override
<xmp> XMP other tags
Definition term
Font † color=rgb(r,g,b)|#rrggbb|color face=fontname size=[1...7]|[-6...+6] dir=ltr|rtl
Text color
Text font
Text size
Direction of text: left-to-right or rightto-left
Non-formatted text † ; ignores other HTML tags
Attributes common to almost all other tags class=class|style
Class of the element id=id style=styledef title=tooltip dir=ltr|rtl
Unique ID of the element
Inline style definition
Text of the tooltip to display
Direction of text: left-to-right or rightto-left lang=language
Language of the content accesskey=character
Keyboard shortcut for the element tabindex=ntab N of tab for the element
† = deprecated
Linux Quick Reference Guide 4 th ed. June 2016 © Daniele Raffo www.crans.org/~raffo
148/150
Tag
<img>
Image
<map>
Image map
<area>
Area of image map
HTML 4.01 (images)
HTML 4.01 (images)
Attributes
align=top|bottom|left|middle|right alt=alternatetext border=npixels height=npixels|percent% hspace=npixels ismap=url longdesc=url src=url usemap=url vspace=npixels width=npixels|percent% id=id name=name alt=alternatetext coords=left,top,right,bottom|
cx,cy,radius|x1,y1,...,xn,yn href=url nohref=true|false shape=rectangle|circle|polygon target=_blank|_parent|_self|_top
Image alignment with respect to surrounding text †
Description of the image for text-only browsers
Border width around the image †
Image height
Blank space on the left and right side of image †
URL for server-side image map
URL containing a long description of the image
URL of the image
URL for client-side image map
Blank space on top and bottom of image †
Image width
Unique ID for the map tag
Unique name for the map tag
Description of area for text-only browsers
Coordinates of clickable area; depends on shape
Target URL of area
Excludes or includes the area from image map
Shape of area
Destination of target URL
† = deprecated
Linux Quick Reference Guide 4 th ed. June 2016 © Daniele Raffo www.crans.org/~raffo
149/150 HTML 4.01 (tables and lists)
Tag
<table>
Table
<tr>
Table row
<td>
Table cell
<th>
Table header
<ol>
Ordered list
<ul>
Unordered list
<li>
List item
HTML 4.01 (tables and lists)
Attributes
align=left|center|right bgcolor=rgb(r,g,b)|#rrggbb|color border=npixels cellpadding=npixels|percent% cellspacing=npixels|percent% frame=void|above|below| lhs|rhs|hsides|vsides|box|border rules=none|groups|rows|cols|all summary=summary width=npixels|percent% align=left|center|right|justify|char bgcolor=rgb(r,g,b)|#rrggbb|color char=character charoff=npixels|percent% valign=top|middle|bottom|baseline abbr=content align=left|center|right|justify|char axis=category bgcolor=rgb(r,g,b)|#rrggbb|color char=character charoff=npixels|percent% colspan=ncolumns headers=headerid height=npixels nowrap rowspan=nrows scope=col|colgroup|row|rowgroup valign=top|middle|bottom|baseline width=npixels|percent% compact=compact start=firstnumber type=A|a|I|i|1 compact=compact type=disc|square|circle type=disc|square|circle|A|a|I|i|1 value=itemno
Table alignment †
Table background color †
Border width
Space around the content of each cell
Space between cells
Visibility of sides of the table border
Horizontal or vertical divider lines
Summary of the table for text-only browsers
Table width
Horizontal text alignment
Row background color †
Character to align text on, if align=char
Alignment offset to first character, if align=char
Vertical text alignment
Abbreviated content in a cell
Horizontal text alignment
Cell name
Cell background color †
Character to align text on, if align=char
Alignment offset to first character, if align=char
Number of columns this cell spans on
Cell header information for text-only browsers
Cell height †
Text in cell stays on a single line †
Number of rows this cell spans on
Target for cell header information
Vertical text alignment
Cell width †
List must be more compact †
Number to start the list on †
List numbers type †
List must be more compact †
List type †
List item type †
List item value †
† = deprecated
Linux Quick Reference Guide 4 th ed. June 2016 © Daniele Raffo www.crans.org/~raffo
150/150
Dec Hex Char
0 0
NUL
5
6
7
8
3
4
1
2
1
2
3
4
5
6
7
8
SOH
STX
ETX
EOT
ENQ
ACK
BEL
BS
Null
Start of heading
Start of text
End of text
Dec Hex Char
32
33
34
35
End of transmission 36
20
21
22
23
24
space
!
"
#
$
Enquiry
Acknowledge
37
38
25
26
%
&
'
Bell
Backspace
Horizontal tab
Line feed
39
40
41
42
27
28
29
2A
(
)
*
13
14
15
16
9
10
11
12
21
22
23
24
17
18
19
20
25
26
27
28
9
A
B
C
D
E
F
10
11
12
13
14
15
16
17
18
19
1A
1B
1C
TAB
LF
VT
FF
CR
SO
SI
DLE
DC1
DC2
DC3
DC4
NAK
SYN
ETB
CAN
EM
SUB
ESC
FS
Vertical tab
Form feed
Carriage return
Shift out
Shift in
Data link escape
Device control 1
Device control 2
Device control 3
Device control 4
Negative ACK
Synchronous idle
End of Tx block
Cancel
End of medium
Substitute
Escape
File separator
29
30
1D
1E
GS
RS
Group separator
Record separator
61
62
31 1F
US
Unit separator
Characters 0-31 and 127 are non-printable.
63
49
50
51
52
43
44
45
46
47
48
57
58
59
60
53
54
55
56
2B
2C
2D
2E
2F
30
31
32
33
34
35
36
37
38
39
3A
3B
3C
3D
3E
3F
+
,
-
.
/
0
1
2
3
4
5
6
7
8
9
:
;
<
=
>
?
85
86
87
88
81
82
83
84
89 59
90 5A
91 5B
92 5C
93 5D
94 5E
95 5F
55
56
57
58
51
52
53
54
67
68
69
70
71
72
Dec Hex Char
64 40
@
65
66
41
42
A
B
43
44
45
46
47
48
C
D
E
F
G
H
73 49
74 4A
75 4B
76 4C
77 4D
78 4E
79
80
4F
50
I
J
K
L
M
N
O
P
Q
R
S
T
U
V
W
X
Y
Z
[
\
]
^
_
7-bit ASCII table
113 71
114 72
115 73
116 74
117 75
118 76
119 77
120 78
121 79
122 7A
123 7B
124 7C
125 7D
126 7E
127 7F
Dec Hex Char
7-bit ASCII table
96 60
`
97
98
61
62
a b
99 63
100 64
101 65
102 66
103 67
104 68
c d e f g h
105 69
106 6A
107 6B
108 6C
109 6D
110 6E
111 6F
112 70
i j k l m n o p q r s t u v w x y z
{
|
}
~
DEL
Delete
Linux Quick Reference Guide 4 th ed. June 2016 © Daniele Raffo www.crans.org/~raffo
Download
Public link updated
The public link to your chat has been updated. You may view and manage your chat links after registration here.
Document public link
Advertisement
Key features
LVM management
System boot processes
Filesystem operations
Package management
Command line utilities
Networking configuration
Security aspects
Frequently asked questions
LVM (Logical Volume Management) introduces an abstraction between physical and logical storage, permitting versatile filesystem use.
Use the command systemctl rescue or systemctl emergency.
Use the command shutdown -h now, halt or poweroff.
