Creating Root Account

Assuming you need to create a backup root account, this account can be created via the following steps.

1) Create a new user account as per normal (adduser )
2) Edit the /etc/passwd file to modify the UID and GID of user
From this
dsmadm:x:101:1:This user accound used for NBU :/export/home/dsmadm/:/bin/ksh
To
dsmadm:x:0:0:This user accound used for NBU :/export/home/dsmadm:/bin/ksh

3) Change the file/directory permission for . This is to prevent anyone from putting harmful scripts where you might run them unintentionally. You also need to secure this account as you would a normal "root" account.

chown 0:0 /export/home/dsmadm
chown -R 0:0 /export/home/dsmadm/*
chmod 700 /export/home/dsmadm



=================For Fedora===============

Create extra root user account to your Linux box.

The ‘root’ account with user id 0 is the most powerful user in Linux and Unix system. This article show the step by step to create the duplicate root account that have the same privileges as super user root account on the Linux Fedora Core operating system.

You may want to make replicate of root user account, or to create more than one user account that have the same capabilities as a 'root' user (superuser) account. Why, may be for a root backup user account, incase of something happen to the 'root' user account or may be just for fun :-).

To create another root user account, we need to replicate the 'root' user account characteristic, then make one account that have the same characteristic and capabilities of the 'root' user account.

Let begin by check the 'root' user account.

1. Check user id for ‘root’ user account:

[root@fedora ~]# id root

uid=0(root) gid=0(root) groups=0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel)

Explanations of the command output:

A. uid=0(root) The user id for user 'root' user is 0.

B. gid=0(root) the group id for user ‘root’ is 0.

C. groups=0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel) The user ‘root’ is belong in groups; root, bin, daemon, sys, adm, disk and wheel.

2. Now we take a look at the passwd, shadow and group files that contain ‘root’ user information:

[root@fedora ~]# less /etc/passwd

root:x:0:0:root:/root:/bin/bash

[root@fedora ~]# less /etc/shadow

root:$1$B2BEWv4X$Gb.QPb6I3RwCkEkz13ow21:13080:0:99999:7:::

[root@fedora ~]# less /etc/group

root:x:0:root

bin:x:1:root,bin,daemon

daemon:x:2:root,bin,daemon

sys:x:3:root,bin,adm

adm:x:4:root,adm,daemon

tdisk:x:6:root

wheel:x:10:root

From the information gather above, to create a user that have the same power (superuser power) as a ‘root’ user in Linux system, we need to create a user with same root user uid, gid and group.

3. To create user account that has the same ability (super user) as the ‘root’ user, issue this command:

[root@fedora ~]# adduser -u 0 -o -g 0 -G 0,1,2,3,4,6,10 -M root2

Adduser command explanations:

adduser	-u 0 -o	-g 0	-G 0,1,2,3,4,6,10	-M	root2
Using Linux adduser command to create a new user account or to update default new user information.	Set the value of user id to 0.	Set the initial group number or name to 0	Set supplementary group to: 0 = root 1 = bin 2 = daemon 3 = sys 4 = adm 6 = disk 10 = wheel	'home directory' not created for the user.	User name of the new user account.

Note: you need to have the administrative privilege on the system in order to issue 'adduser' command above.

4. Now add a password for user ‘root2’ by issue the ‘passwd root2’ command, see example below:

[root@fedora ~]# passwd root2

Changing password for user root2.

New UNIX password:

Retype new UNIX password:

passwd: all authentication tokens updated successfully.

Note: you need to have the administrative privilege on the system in order to issue 'passwd' command above.

5. Check id for user root2 by issue the ‘id root2’ command, see example below:

[root@fedora ~]# id root2

uid=0(root) gid=0(root) groups=0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel)

6. Now recheck the passwd, shadow and group files that contain ‘root2’ user informations to confirm the changes:

[root@fedora ~]# less /etc/passwd

root:x:0:0:root:/root:/bin/bash

root2:x:0:0::/home/root2:/bin/bash

[root@fedora ~]# less /etc/shadow

root:$1$B2BRWv4X$Gb.MPc6I3RwCkEkT13ow21:13080:0:99999:7:::

root2:$1$bQHGH4cX$TtsV/WVdFe5cIsHWjzc.N1:13112:0:99999:7:::

[root@fedora ~]# less /etc/group

root:x:0:root,root2

bin:x:1:root,bin,daemon,root2

daemon:x:2:root,bin,daemon,root2

sys:x:3:root,bin,adm,root2

adm:x:4:root,adm,daemon,root2

disk:x:6:root,root2

wheel:x:10:root,root2

7. Everything should be ok, now try to login to system with newly created ‘root2’ account, see example:

login as: root2

root2@10.7.0.211's password:

Last login: Thu Nov 24 23:48:49 2005 from 10.7.0.112

Could not chdir to home directory /home/root2: No such file or directory

-bash-3.00#

-bash-3.00#

-bash-3.00# su –

[root@fedora ~]#

8. Make sure that you execute the su command with hyphen ( su - ) to get the PATH of the user that you become to... below is the example of the su command with hyphen and without hyphen.

Loggin in as user tenouk, then execute $PATH as example below.

[tenouk@fedora ~]$ $PATH

-bash: /usr/lib/qt-3.3/bin:/usr/kerberos/bin:/usr/local/bin:/bin:/usr/bin:/home/ tenouk/bin: No such file or directory

[tenouk@tenouk ~]$

Use the su command to change to root user as example below and then execute $PATH as example below.

[tenouk@fedora ~]$ su root

Password:

[root@fedora tenouk]# $PATH

bash: /usr/kerberos/sbin:/usr/lib/qt-3.3/bin:/usr/kerberos/bin:/usr/local/bin:/b in:/usr/bin:/home/tenouk/bin: No such file or directory

[root@fedora tenouk]#

Then try use the su - command and verify with the $PATH as example below.

[root@tenouk tenouk]# su - root

[root@tenouk ~]# $PATH

-bash: /usr/lib/qt-3.3/bin:/usr/kerberos/sbin:/usr/kerberos/bin:/usr/local/sbin: /usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin:/root/bin: No such file or director y

[root@tenouk ~]#

Note: The execution of su command, without the hypen ( - ) you inherit the PATH of the current user. Use the su command, with hyphen ( su - ) to get the default PATH of the root user.

Step-by-step how to procedure above tested on:

Operating System: GNU/Linux Fedora Core 4

Kernel Name: Linux

Kernel Release: 2.6.11-1.1369_FC4

Kernel Version: #1 Thu Jun 2 22:55:56 EDT 2005

Machine Hardware: i686

Machine Processor: i686

Hardware Platform: i386

Shell: GNU bash, version 3.00.16(1)-release (i386-redhat-linux-gnu)

Installation Type: Full Installation (Custom)

SELinux: Disable

Ref: http://www.labtestproject.com/create_root_user_account

Microsoft Clustering

Clustering Basics

Before I can really talk about what a quorum is and what it does, you need to know a little bit about how a cluster works. Microsoft server products support two main types of clustering; server clusters and network load balancing (NLB). The design philosophy behind these two types of servers couldn’t be more different, but the one thing that both designs share is the concept of a virtual server.

There are several different meanings to the term virtual server, but in clustering it has a specific meaning. It means that users (and other computers) see the cluster as a single machine even though it is made up of multiple servers. The single machine that the users see is the virtual server. The physical servers that make up the virtual server are known as cluster nodes.

Network Load Balancing

These two different types of clusters have two completely different purposes. Network Load Balancing is known as a share all cluster. It gets this name because an application can run across all of the cluster’s nodes simultaneously. In this type of cluster, each server runs its own individual copy of an application. It is possible that each server can link to a shared database though.

Network Load Balancing clusters are most often used for hosting high demand Web sites. In a network load balancing architecture, each of the cluster’s nodes maintains its own copy of the Web site. If one of the nodes were to go down, the other nodes in the cluster pick up the slack. If performance starts to dwindle as demand increases, just add additional servers to the cluster and those servers will share the workload. A Network Load Balancing cluster distributes the current workload evenly across all of the cluster’s active nodes. Users access the virtual server defined by the cluster, and the user’s request is serviced by the node that is the least busy.

Server Clusters

The other type of cluster is simply known as a server cluster. A server cluster is known as a share nothing architecture. This type of cluster is appropriate for applications that can not be distributed across multiple servers. For example, you couldn’t run a database server across multiple nodes because each node would receive updates independently, and the databases would not be synchronized.

In a server cluster, only one node is active at a time. The other node or nodes are placed in a sort of stand by mode. They are waiting to take over if the active node should fail.

As you may recall, I said that server clusters are used for applications that can not be distributed across multiple nodes. The reason that it is possible for a node to take over running an application when the active node fails is because all of the nodes in the cluster are connected to a shared storage mechanism. This shared storage mechanism might be a RAID array, it might be a storage area network, or it might be something else. The actual media type is irrelevant, but the concept of shared storage is extremely important in understanding what a quorum is. In fact, server clusters is the only type of clustering that uses quorums. Network load balancing does not use quorums. Therefore, the remainder of this discussion will focus on server clusters.

What is a Quorum?

OK, now that I have given you all of the necessary background information, let’s move on to the big question. What is a quorum? To put it simply, a quorum is the cluster’s configuration database. The database resides in a file named \MSCS\quolog.log. The quorum is sometimes also referred to as the quorum log.

Although the quorum is just a configuration database, it has two very important jobs. First of all, it tells the cluster which node should be active. Think about it for a minute. In order for a cluster to work, all of the nodes have to function in a way that allows the virtual server to function in the desired manner. In order for this to happen, each node must have a crystal clear understanding of its role within the cluster. This is where the quorum comes into play. The quorum tells the cluster which node is currently active and which node or nodes are in stand by.

It is extremely important for nodes to conform to the status defined by the quorum. It is so important in fact, that Microsoft has designed the clustering service so that if a node can not read the quorum, that node will not be brought online as a part of the cluster.

The other thing that the quorum does is to intervene when communications fail between nodes. Normally, each node within a cluster can communicate with every other node in the cluster over a dedicated network connection. If this network connection were to fail though, the cluster would be split into two pieces, each containing one or more functional nodes that can not communicate with the nodes that exist on the other side of the communications failure.

When this type of communications failure occurs, the cluster is said to have been partitioned. The problem is that both partitions have the same goal; to keep the application running. The application can’t be run on multiple servers simultaneously though, so there must be a way of determining which partition gets to run the application. This is where the quorum comes in. The partition that “owns” the quorum is allowed to continue running the application. The other partition is removed from the cluster.

Types of Quorums

So far in this article, I have been describing a quorum type known as a standard quorum. The main idea behind a standard quorum is that it is a configuration database for the cluster and is stored on a shared hard disk, accessible to all of the cluster’s nodes.

In Windows Server 2003, Microsoft introduced a new type of quorum called the Majority Node Set Quorum (MNS). The thing that really sets a MNS quorum apart from a standard quorum is the fact that each node has its own, locally stored copy of the quorum database.

At first, each node having its own copy of the quorum database might not seem like a big deal, but it really is because it opens the doors to long distance clustering. Standard clusters are not usually practical over long distances because of issues involved in accessing a central quorum database in an efficient manner. However, when each node has its own copy of the database, geographically dispersed clusters become much more practical.

Although MNS quorums offer some interesting possibilities, they also have some serious limitations that you need to be aware of. The key to understanding MNS is to know that everything works based on majorities. One example of this is that when the quorum database is updated, each copy of the database needs to be updated. The update isn’t considered to have actually been made until over half of the databases have been updated ((number of nodes / 2) +1). For example, if a cluster has five nodes, then three nodes would be considered the majority. If an update to the quorum was being made, the update would not be considered valid until three nodes had been updated. Otherwise if two or fewer nodes had been updated, then the majority of the nodes would still have the old quorum information and therefore, the old quorum configuration would still be in effect.

The other way that a MNS quorum depends on majorities is in starting the nodes. A majority of the nodes ((number of nodes /2) +1) must be online before the cluster will start the virtual server. If fewer than the majority of nodes are online, then the cluster is said to “not have quorum”. In such a case, the necessary services will keep restarting until a sufficient number of nodes are present.

One of the most important things to know about MNS is that you must have at least three nodes in the cluster. Remember that a majority of nodes must be running at all times. If a cluster only has two nodes, then the majority is calculated to be 2 ((2 nodes / 2) +1)-2. Therefore, if one node were to fail, the entire cluster would go down because it would not have quorum.

• Section: Articles & Tutorials :: Windows 2003
• Author: Brien M. Posey

Blat

@echo off :: You must change the next 3 values
@echo off
set to=-to username@company.com
set f=-f santa@northpole.com
set server=-server mail.company.com

set subject=-subject "Helloworld"
set body=-body "Good day"
set attach=-attach blat.dll
set html=-html
@echo off :: Here is where we run Blat.
@echo off :: Note, I named the vars the same as Blat's paramaters.


@echo off REM blat soccer.html %to% %f% %subject% %server% %html%
blat %to% %f% %subject% %body% %server% -noh2 -dsn n -hostname bing.com

Windows Batch Files

echo off
set cmd1="date/t"
set cmd2="time/t"

for /F "delims=*" %%z in (filecount.txt) do set/a param3=%%z
set/a param3=%param3%+1
echo %param3% > filecount.txt

for /F "delims=*" %%a in ('%cmd1%') do set param1=%%a
for /F "delims=*" %%b in ('%cmd2%') do set param2=%%b

echo param1 = %param1%
echo param2 = %param2%

echo %param1%, %param2% >> Num_%param3%.txt


--------------------------------END-----------------------------------

A file called filecount.txt must first exist. It should contain a number.

Net and SC Commands

Start windows services from command line
1) net start telnet , net stop "apache2"
2) sc
3) sc query "apache"
4) sc query group=""
5) sc query state= all or sc query statr= inactive *there is a space after =
6) sc query type= driver or sc query type= service
7) sc qc "apache"
8) sc start "apache"

Creating an executable file

The main usage of this is to create an executable file from a batch file to mask certain user credentials used in the batch file. A rather primitive way of obfuscating information but its better than storing a batch file where anyone can see the user credentials in plaintext.

Step 1
Navigate to C:\Windows\System32 and locate the file named IEXPRESS.EXE

Step 2
Double Click to launch IEXPRESS.EXE

Step 3
You will be presented with the initial welcome screen and be given two choices. Select “Create new Self Extraction Directive file.” Click Next.

Step 4
Next you will be presented with the Package Purpose screen. For our purposes select “Extract Files and run an installation command” and click the Next button.

Step 5
You will be presented with the Package Title screen, which will give you the opportunity to give your project a name. If you are so inclined give it a meaningful name. If like me you are never going to come back to this, name it whatever you want.

Step 6
You will next be presented with the Confirmation Prompt Screen. We would like the batch file to just be extracted and run so just choose “No Prompt” and click the Next Button.

Step 7
You are presented with the License Agreement window. If you don’t want your users to have to answer a prompt select “Do not display a license.”

Step 8
The Packaged Files window is where you will select your batch file (or .vbs). Click the Add button and browse to your desired file. Then click next.

Step 9
Here you are presented with a window titled Install Program to Launch. Use the drop down control next to “Install Program and choose the only option that will be present, the .bat or .vbs file that you chose in the previous window.

Step 10
The Show Window screen is next. I didn’t want my users to be prompted in any way so I chose Hidden. Click Next.

Step 11
No Finished Message for my users. Select “No message” and choose Next.

Step 12
The Package Name and Options window is where the new .exe specified. Type in a path or browse to the folder you would like your .exe in, type a name in the file name box and click save. Also check the box that says “Hide File Extraction Progress Animation from User.” If you’re worried about long file names go ahead and click the other box as well.

Step 13
Since we really aren’t installing anything we probably want to tell the Configure Restart window to not restart. So choose the option that says “No restart” and hit Next.

Step 14
This window is where you have a chance to save all of the options you have chosen into a project file so that if necessary you may later return and make modifications. I have no need to retain the file, but if you would like to be able to come back to it, by all means choose “Save Self Extraction Directive (SED) file” and tell it where to put it. As always, click Next.

Step 15
Here’s where you’re new .exe is born, on the Create Package screen. Explore to the directory you told it to put the file in, click Next and then watch your little .exe’s first moments as it pops into the big digital world.

Step 16
You’re done! Click finish and go try it out. Pin it directly to the start menu. Point a shortcut to it and pin that to the start menu. Most importantly, script it and see how slick it is. If you’re not familiar with how to script start menu pinning the scripting guys will tell you how.

*Ref: http://renegadetech.blogspot.com/2006/07/how-to-convert-bat-file-or-vbs-file.html

Checking Password Policies in Linux

To check the list of users of  linux machine, check the password or shadow password file.

cat /etc/shadow

cat /etc/passwd

cat /etc/group

cat /etc/aliases

cat /etc/sudoers

To check the policy of a user

chage -l

chage -I -1 -m 9 -M 100 -E -1

Windows Admin Tricks

Windows SID

This is basically the internal identifier used by Windows to uniquely determine a user/group/machine.

Local machine administrator SID will always end with -500.

Guest SID will end with -501

User SID will end with -1001 (1001 signifies the first user and will auto increment with subsequent user)

This is how ACL determines if a user is allowed access to files/services/etc.

Net use

1) net use \\192.168.1.2\ipc$ password /u:domain\administrator

2) Useful sid tool (user2sid and sid2user)

user2sid \\caesars administrator

sid2user \\caesars 5 21 124532423423 4234234234234 4235234234-500

whoami /user /groups

Windows Impersonation

Let the server notify the subsystem that it is temporarily adopting the token of the client making the resource request.

*Restricted token is assigned to child processes that has more limited access than the parent token.

The token consist of all the SID that the logged user is a member of.

Eg John Smith, who is a member of group Developers, Webmaster and Requester logs into Windows. The token will consist of John Smith's SID, Developers group SID, Webmaster group SID and Requester group SID.

Assuming John tries to access file A (which is assigned to Developers group). The ACL will check if John's token consist of the Developers group SID. If yes, John will have access to file A.

 

Boot script sequence

Start up order of linux
1) /etc/lilo.conf
2) /etc/inittab
3) /etc




Boot sequence in Red Hat
boot/grub stuff
/etc/inittab
/etc/rc.sysinit script
/etc/init.d stuff ->rc0,rc1,rc2,rc3,etc..
/etc/rc.d/rc.local

Runlevel	Scripts Directory (Red Hat/Fedora Core)	State
0	/etc/rc.d/rc0.d/	shutdown/halt system
1	/etc/rc.d/rc1.d/	Single user mode
2	/etc/rc.d/rc2.d/	Multiuser with no network services exported
3	/etc/rc.d/rc3.d/	Default text/console only start. Full multiuser
4	/etc/rc.d/rc4.d/	Reserved for local use. Also X-windows (Slackware/BSD)
5	/etc/rc.d/rc5.d/	XDM X-windows GUI mode (Redhat/System V)
6	/etc/rc.d/rc6.d/	Reboot
s or S		Single user/Maintenance mode (Slackware)
M		Multiuser mode (Slackware)

After the runlevel script is done, the kernel will execute scripts in one of the following directories.

• /etc/rc.d/init.d/ (Red Hat/Fedora )
• /etc/init.d/ (S.u.s.e.)
• /etc/init.d/ (Ubuntu / Debian)

Init Script Activation:

Adding a script to the /etc/rc.d/rc#.d/ directory with either an S or K prefix, adds the script to the boot or shutdown process. The scripts are run in numerical order. S20abc is run before S30xyz. The extensibility to the boot and shutdown procedures of the operating system is one of the strengths of UNIX. The orderly sequential initiation of processes can be coordinated for dependent processes. The orderly shutdown of processes is often required of complex programs such as databases. This is how it is done. Individual processes may be monitored, shutdown and started at any time using these scripts. i.e. /etc/rc.d/rc2.d/httpd start. The modifiers start, stop or status may be used.

The start/stop/status scripts actually reside in the directory:

• /etc/rc.d/init.d/ (Red Hat/Fedora)
• /etc/init.d/ (S.u.s.e. and Ubuntu / Debian)

and are linked to the appropriate directories. These links may be created or destroyed using the chkconfig command. i.e. chkconfig --del httpd will remove the web server from the startup and shutdown process. Inversely chkconfig --add httpd will add it to the startup/shutdown process by generating links from the script in /etc/rc.d/init.d/ to the appropriate /etc/rc.d/rc#.d/ directory. For more information see the LINUX manual page on init.

The rc.local script is the last system script to be executed. This is equivalent to autoexec.bat in windows. This is where most of the customised commands/scripts are located.
Meaning, /etc/init.d is the central depository of all scripts.
Files in rc?.d are symbolic links to /etc/init.d.
Eg if runlevel 3 is selected, scripts in /etc/rc3.d which are symbolic links to scripts in /etc/init.d are executed.

Cron Jobs

Troubleshooting Cron
1) Uncomment the #cron line in /etc/syslog.conf to enable cron logging
2) Restart sysklogd : sudo /etc/init.d/sysklogd restart
3) Add cron jobs through crontab -e
4) Restart cron : sudo /etct/init.d/cron restart

To disable email notification, redirect the output to /dev/null
0 3 * * * /root/backup.sh >/dev/null 2>&1


Special strings to substitute * * * * *

Special string	Meaning
@reboot	Run once, at startup.
@yearly	Run once a year, "0 0 1 1 *".
@annually	(same as @yearly)
@monthly	Run once a month, "0 0 1 * *".
@weekly	Run once a week, "0 0 * * 0".
@daily	Run once a day, "0 0 * * *".
@midnight	(same as @daily)
@hourly	Run once an hour, "0 * * * *".

User crontabs are saved in
/var/spool/cron


*Cron status reporting
Set up Evolution to read mails sent by cron.
Create a new account and select "local delivery mails" from the dropdown box. This will enable Evolution to receive mails sent to /var/mail/


*cron commands are also logged in auth.log

Alternative to cron jobs
If a particular task needs to be schedule to be run once or a few times, an alternative solution would be to use the "at" command. This command basically allows the user to schedule a job at any particular time. Eg to send out an email at 4am next week.

at -f /home/user/atcommand -m now + 7 days

The f options tells the at command to run the content of a file (which is in a script format situated at /home/user/atcommand). The -m options will tell the system to send out an email (which contains the output of the command) to notify the user once the job is done and now + 7 days indicates that this job will be executed 7 days from now.

*make sure that there's either /etc/at.deny or /etc/at.allow file in your system. Else, onyl the root will be able to use the at command. These are basically ACL for at command.

You can query all at command jobs using atq and remove the jobs using atrm


Anacron for systems that are not up and running 24/7.
For each job, Anacron checks whether this job has been executed in the last n days, where n is the period specified for that job. If not, Anacron runs the job's shell command, after waiting for the number of minutes specified as the delay parameter.

After the command exits, Anacron records the date in a special timestamp file for that job, so it can know when to execute it again. Only the date is used for the time calculations. The hour is not used.

When there are no more jobs to be run, Anacron exits.
Only root can schedule anacron jobs. A way to enable other users to do so is by creating an anacron group and enable write permission for this group on /var/spool/anacron (where job timestamps are stored)

"run-parts" executes all the executable files in a directory. For example:
# run-parts /etc/cron.daily

"run-crons" executes all the scripts in the /etc/cron.daily, /etc/cron.hourly, /etc/cron.monthly, and /etc/cron.weekly directories.

*used to find files in directory that is messy, file criteria is *junk*
find /tmp -name '*junk*' -exec ls -l {} \;


To force anacron to be executed hourly, put a script which consist of the following in /etc/cron.hourly
#!/bin/sh
/usr/sbin/anacron -s

Unable to start in Linux GUI

If you ever get an error logging into a linux GUI because the system is complaining that it ran out of space, here are some steps to free up some hard disk space to enable you to login (to do further cleaning)

1) At the GUI login , press Ctrl + Alt + F1 to login in terminal
2) Use df -h to check hard disk utilization information
3) Try deleting files in /home which you know can be deleted.
4) Try deleting files in /tmp
5) mount a USB drive and move some of your files in /home to the USB drive and delete them from the system.