Creating a New Linux Distro

Reference
http://www.linuxjournal.com/article/7233

Creating Root Account

Assuming you need to create a backup root account, this account can be created via the following steps.

1) Create a new user account as per normal (adduser )
2) Edit the /etc/passwd file to modify the UID and GID of user
From this
dsmadm:x:101:1:This user accound used for NBU :/export/home/dsmadm/:/bin/ksh
To
dsmadm:x:0:0:This user accound used for NBU :/export/home/dsmadm:/bin/ksh

3) Change the file/directory permission for . This is to prevent anyone from putting harmful scripts where you might run them unintentionally. You also need to secure this account as you would a normal "root" account.

chown 0:0 /export/home/dsmadm
chown -R 0:0 /export/home/dsmadm/*
chmod 700 /export/home/dsmadm



=================For Fedora===============

Create extra root user account to your Linux box.

The ‘root’ account with user id 0 is the most powerful user in Linux and Unix system. This article show the step by step to create the duplicate root account that have the same privileges as super user root account on the Linux Fedora Core operating system.

You may want to make replicate of root user account, or to create more than one user account that have the same capabilities as a 'root' user (superuser) account. Why, may be for a root backup user account, incase of something happen to the 'root' user account or may be just for fun :-).

To create another root user account, we need to replicate the 'root' user account characteristic, then make one account that have the same characteristic and capabilities of the 'root' user account.

Let begin by check the 'root' user account.

1. Check user id for ‘root’ user account:

[root@fedora ~]# id root

uid=0(root) gid=0(root) groups=0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel)

Explanations of the command output:

A. uid=0(root) The user id for user 'root' user is 0.

B. gid=0(root) the group id for user ‘root’ is 0.

C. groups=0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel) The user ‘root’ is belong in groups; root, bin, daemon, sys, adm, disk and wheel.

2. Now we take a look at the passwd, shadow and group files that contain ‘root’ user information:

[root@fedora ~]# less /etc/passwd

root:x:0:0:root:/root:/bin/bash

[root@fedora ~]# less /etc/shadow

root:$1$B2BEWv4X$Gb.QPb6I3RwCkEkz13ow21:13080:0:99999:7:::

[root@fedora ~]# less /etc/group

root:x:0:root

bin:x:1:root,bin,daemon

daemon:x:2:root,bin,daemon

sys:x:3:root,bin,adm

adm:x:4:root,adm,daemon

tdisk:x:6:root

wheel:x:10:root

From the information gather above, to create a user that have the same power (superuser power) as a ‘root’ user in Linux system, we need to create a user with same root user uid, gid and group.

3. To create user account that has the same ability (super user) as the ‘root’ user, issue this command:

[root@fedora ~]# adduser -u 0 -o -g 0 -G 0,1,2,3,4,6,10 -M root2

Adduser command explanations:

adduser	-u 0 -o	-g 0	-G 0,1,2,3,4,6,10	-M	root2
Using Linux adduser command to create a new user account or to update default new user information.	Set the value of user id to 0.	Set the initial group number or name to 0	Set supplementary group to: 0 = root 1 = bin 2 = daemon 3 = sys 4 = adm 6 = disk 10 = wheel	'home directory' not created for the user.	User name of the new user account.

Note: you need to have the administrative privilege on the system in order to issue 'adduser' command above.

4. Now add a password for user ‘root2’ by issue the ‘passwd root2’ command, see example below:

[root@fedora ~]# passwd root2

Changing password for user root2.

New UNIX password:

Retype new UNIX password:

passwd: all authentication tokens updated successfully.

Note: you need to have the administrative privilege on the system in order to issue 'passwd' command above.

5. Check id for user root2 by issue the ‘id root2’ command, see example below:

[root@fedora ~]# id root2

uid=0(root) gid=0(root) groups=0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel)

6. Now recheck the passwd, shadow and group files that contain ‘root2’ user informations to confirm the changes:

[root@fedora ~]# less /etc/passwd

root:x:0:0:root:/root:/bin/bash

root2:x:0:0::/home/root2:/bin/bash

[root@fedora ~]# less /etc/shadow

root:$1$B2BRWv4X$Gb.MPc6I3RwCkEkT13ow21:13080:0:99999:7:::

root2:$1$bQHGH4cX$TtsV/WVdFe5cIsHWjzc.N1:13112:0:99999:7:::

[root@fedora ~]# less /etc/group

root:x:0:root,root2

bin:x:1:root,bin,daemon,root2

daemon:x:2:root,bin,daemon,root2

sys:x:3:root,bin,adm,root2

adm:x:4:root,adm,daemon,root2

disk:x:6:root,root2

wheel:x:10:root,root2

7. Everything should be ok, now try to login to system with newly created ‘root2’ account, see example:

login as: root2

root2@10.7.0.211's password:

Last login: Thu Nov 24 23:48:49 2005 from 10.7.0.112

Could not chdir to home directory /home/root2: No such file or directory

-bash-3.00#

-bash-3.00#

-bash-3.00# su –

[root@fedora ~]#

8. Make sure that you execute the su command with hyphen ( su - ) to get the PATH of the user that you become to... below is the example of the su command with hyphen and without hyphen.

Loggin in as user tenouk, then execute $PATH as example below.

[tenouk@fedora ~]$ $PATH

-bash: /usr/lib/qt-3.3/bin:/usr/kerberos/bin:/usr/local/bin:/bin:/usr/bin:/home/ tenouk/bin: No such file or directory

[tenouk@tenouk ~]$

Use the su command to change to root user as example below and then execute $PATH as example below.

[tenouk@fedora ~]$ su root

Password:

[root@fedora tenouk]# $PATH

bash: /usr/kerberos/sbin:/usr/lib/qt-3.3/bin:/usr/kerberos/bin:/usr/local/bin:/b in:/usr/bin:/home/tenouk/bin: No such file or directory

[root@fedora tenouk]#

Then try use the su - command and verify with the $PATH as example below.

[root@tenouk tenouk]# su - root

[root@tenouk ~]# $PATH

-bash: /usr/lib/qt-3.3/bin:/usr/kerberos/sbin:/usr/kerberos/bin:/usr/local/sbin: /usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin:/root/bin: No such file or director y

[root@tenouk ~]#

Note: The execution of su command, without the hypen ( - ) you inherit the PATH of the current user. Use the su command, with hyphen ( su - ) to get the default PATH of the root user.

Step-by-step how to procedure above tested on:

Operating System: GNU/Linux Fedora Core 4

Kernel Name: Linux

Kernel Release: 2.6.11-1.1369_FC4

Kernel Version: #1 Thu Jun 2 22:55:56 EDT 2005

Machine Hardware: i686

Machine Processor: i686

Hardware Platform: i386

Shell: GNU bash, version 3.00.16(1)-release (i386-redhat-linux-gnu)

Installation Type: Full Installation (Custom)

SELinux: Disable

Ref: http://www.labtestproject.com/create_root_user_account

Ophcrack

Tools used to create USB Ophcrack:

• Windows Computer (Windows XP is used here)
• 512 MB or larger portable device (USB stick)
• Ophcrack Live CD and usboph.zip

Creating bootable USB Ophcrack:

1. First, create a "New Directory" to house your work
2. Download Ophcrack Live CD to the new directory
3. Download and extract usboph.zip to the new directory
4. Click fixoph.bat and follow the onscreen instructions
5. Copy all the files from the Ophcrack directory to your USB device
6. From your USB device, click makeboot.bat and follow the instructions to make the drive bootable
7. Reboot your PC and set your BIOS boot menu to boot from the USB device

If all goes well, you should be booting from the USB stick into a mini SLAX environment. Ophcrack is launched automatically after boot.

----------------------------------------------------------------------------------

How to fix Could not find kernel image: linux error:

Use the following troubleshooting guide to assist in fixing the error.

1. Make sure that the syslinux.cfg file exists on the USB flash drive. Depending on which version of linux you have installed to your flash drive, the syslinux.cfg file should be found at the root of the drive or within the /boot/syslinux or /syslinux directory
2. If a file named isolinux.cfg exists and syslinux.cfg does not, rename isolinux.cfg to syslinux.cfg
3. If the syslinux.cfg file does exist and your still encountering the error, open the syslinux.cfg file with a text editor and make sure that the paths to your kernel and initrd files are correct.

Source:

http://www.pendrivelinux.com

Checking Password Policies in Linux

To check the list of users of  linux machine, check the password or shadow password file.

cat /etc/shadow

cat /etc/passwd

cat /etc/group

cat /etc/aliases

cat /etc/sudoers

To check the policy of a user

chage -l

chage -I -1 -m 9 -M 100 -E -1

Forensics: Filesystem Mount

To see the list of devices detected  by linux, type

ls /dev

Usually, hard disk partitions are labeled sda, sda1, hda, etc

To mount these partitions, first make a path where these partitions are to be accessed.

Eg mkdir  /mnt/mywindrive or sudo mkdir /mnt/mywindrive

Then, associate the device with the mount location.

sudo mount -o ro -t auto /dev/sda1 /mnt/mywindrive

*Taken from Unix and Linux Forensic Analysis DVD Toolkit 

Linux Run Levels

Linux Run-Levels

By Joshua Erdman
Digital Foundation, inc.

Linux has 7 different run levels (or operating modes):

rc0.d - System Halted
rc1.d - Single User Mode
rc2.d - Single User Mode with Networking
rc3.d - Multi-User Mode - boot up in text mode
rc4.d - Not yet Defined
rc5.d - Multi-User Mode - boot up in X Windows
rc6.d - Shutdown & Reboot
Each mode has it's own list of settings for what services to start and what services to shutdown. Not only does this list contain what is supposed to be running, but also what order each service should be started in - a feature many Linux lovers like to point out that Windows lacks..

chkconfig - will list all the registered services and display thier status at each different run level.

Most of the time when your server boots up it will start in runlevel 3 or 5 depending on what it is set to. This setting can be found in the file /etc/inittab

If you ever want to change what mode your server defaults to on bootup, just edit that file, but NEVER change it to runlevel 6 or 0. This will cause your server to shutdown on bootup or if you set it to runlevel 6 it will continuously reboot. I guess this could make a great prank on a friend's workstation.

RC.D Directory Explanation

In the folder: /etc/rc.d are all the run level folders starting from rc1.d to rc6.d and including init.d

It is in each of these rc#.d folders where the service run settings are kept. If you change directory into /etc/rc.d/rc3.d all the files that start with a capital S are the services that will start at this runlevel. All the files that start with a K are the services that will be killed at that runlevel.

The reason why services that are not supposed to run are still listed is because it is popular to switch a server from one run level to another instead of just booting into the needed run level. That way you can take your server offline (single user mode) and then apply a patch or do a file restore.

Let's take a closer look at these files that are inside the rc#.d folders. Notice that they are symbolic links to the script file located in /etc/rc.d/init.d This makes things very easy. All the commands to start, stop, or reload a service are handled by these scripts. So when a server is to go into a specific run level it can find the correct script and knows whether to start it based on its name and link path.


*we can easily change root password by running in single user mode
Boot Linux into single-user mode
Reboot the machine.
Press the ESC key while GRUB is loading to enter the menu.
If there is a 'recovery mode' option, select it and press 'b' to boot into single user mode.
Otherwise, the default boot configuration should be selected. Press 'e' to edit it.
Highlight the line that begins with 'kernel'. Press 'e' again to edit this line.
At the end of the line, add an additional parameter: 'single'. Hit return to make the change and press 'b' to boot.
Change the admin password
The system should load into single user mode and you'll be left at the command line automatically logged in as root. Type 'passwd' to change the root password or 'passwd someuser' to change the password for your "someuser" admin account.

Virtual Hosts on Apache2

This is a very useful feature of Apache2. Imagine if you have multiple domain names and wish to reduce hosting cost by hosting all the web sites on a single server, now you can do it through virtual hosting.

Basically, this features enables multiple domains such as

www.example.com

www.example.net

www.example.org

to point to the same machine (i.e. IP) and yet their hosting directory are different on the machine.

Eg, you may store files related to www.example.com in /var/www/example.com , www.example.net in /var/www/example.net, etc...

This is to enable easy management of each site affecting the other sites that are also hosted on the same machine.

There are 4 steps to doing this

1) Edit /etc/host so that the DNS resolution is pointing to the correct machine.

Of course, in production, this means updating your domain name service to point to your server machine.

2) Create the directories for the sites (eg /var/www/example.com, etc) and copy the files to the respective directories.

3) Edit /etc/apache2/conf.d/virtual.conf (create if the does not exist)

The file should contain the following line

NameVirtualHost *

4) Individual host configuration files are stored at /etc/apache2/sites-available. Create your host configuration files in /etc/apache2/sites-available, then create a symbolic link to those files in the sites-enabled directory - this will cause them to be actually loaded/read.

The symbolic links can be created using the Debian utility command, a2ensite and a2dissite to enable and disable the sites.

Example of content of the /etc/apache2/sites-available/www.example.com

#
#  Example.com (/etc/apache2/sites-available/www.example.com)
#

      ServerAdmin webmaster@example.com
      ServerName  www.example.com
      ServerAlias example.com

      # Indexes + Directory Root.
      DirectoryIndex index.html
      DocumentRoot /home/www/www.example.com/htdocs/

      # CGI Directory
      ScriptAlias /cgi-bin/ /home/www/www.example.com/cgi-bin/
      
              Options +ExecCGI
      


      # Logfiles
      ErrorLog  /home/www/www.example.com/logs/error.log
      CustomLog /home/www/www.example.com/logs/access.log combined


Lastly, run (sudo) a2ensite www.example.com
Restart Apache2 and test out the URL.

#ref: http://www.debian-administration.org/articles/412

FTP and SFTP

Setting up FTP server on Ubuntu

sudo apt-get install proftpd gproftpd
*gproftpd is the GUI module for proftpd

Configure the default ftp directory through
sudo gedit /etc/proftpd/proftpd.conf
This is basically the configuration file for proftpd. Reminder to check tie user login to their home directory if need be.
To enable anonymous / general login, need to setup a generic ftp login for all users of the system. *anonymous login does NOT require password. We can also the read and write permission for each directory in this file.


sudo /etc/init.d/proftpd restart


Access Control List for FTP
/etc/ftpusers
/etc/ftphosts
/etc/ftpaccess
*ftphosts -> can use ip domain range or *.domainname.com

Enhanced security. Since authentication protocol for FTP is in plaintext, we should enable TLS/SSH login through SFTP to encrypt username and passsword for ftp logins.




Reference
http://ubuntuforums.org/showthread.php?p=429783

Boot script sequence

Start up order of linux
1) /etc/lilo.conf
2) /etc/inittab
3) /etc




Boot sequence in Red Hat
boot/grub stuff
/etc/inittab
/etc/rc.sysinit script
/etc/init.d stuff ->rc0,rc1,rc2,rc3,etc..
/etc/rc.d/rc.local

Runlevel	Scripts Directory (Red Hat/Fedora Core)	State
0	/etc/rc.d/rc0.d/	shutdown/halt system
1	/etc/rc.d/rc1.d/	Single user mode
2	/etc/rc.d/rc2.d/	Multiuser with no network services exported
3	/etc/rc.d/rc3.d/	Default text/console only start. Full multiuser
4	/etc/rc.d/rc4.d/	Reserved for local use. Also X-windows (Slackware/BSD)
5	/etc/rc.d/rc5.d/	XDM X-windows GUI mode (Redhat/System V)
6	/etc/rc.d/rc6.d/	Reboot
s or S		Single user/Maintenance mode (Slackware)
M		Multiuser mode (Slackware)

After the runlevel script is done, the kernel will execute scripts in one of the following directories.

• /etc/rc.d/init.d/ (Red Hat/Fedora )
• /etc/init.d/ (S.u.s.e.)
• /etc/init.d/ (Ubuntu / Debian)

Init Script Activation:

Adding a script to the /etc/rc.d/rc#.d/ directory with either an S or K prefix, adds the script to the boot or shutdown process. The scripts are run in numerical order. S20abc is run before S30xyz. The extensibility to the boot and shutdown procedures of the operating system is one of the strengths of UNIX. The orderly sequential initiation of processes can be coordinated for dependent processes. The orderly shutdown of processes is often required of complex programs such as databases. This is how it is done. Individual processes may be monitored, shutdown and started at any time using these scripts. i.e. /etc/rc.d/rc2.d/httpd start. The modifiers start, stop or status may be used.

The start/stop/status scripts actually reside in the directory:

• /etc/rc.d/init.d/ (Red Hat/Fedora)
• /etc/init.d/ (S.u.s.e. and Ubuntu / Debian)

and are linked to the appropriate directories. These links may be created or destroyed using the chkconfig command. i.e. chkconfig --del httpd will remove the web server from the startup and shutdown process. Inversely chkconfig --add httpd will add it to the startup/shutdown process by generating links from the script in /etc/rc.d/init.d/ to the appropriate /etc/rc.d/rc#.d/ directory. For more information see the LINUX manual page on init.

The rc.local script is the last system script to be executed. This is equivalent to autoexec.bat in windows. This is where most of the customised commands/scripts are located.
Meaning, /etc/init.d is the central depository of all scripts.
Files in rc?.d are symbolic links to /etc/init.d.
Eg if runlevel 3 is selected, scripts in /etc/rc3.d which are symbolic links to scripts in /etc/init.d are executed.

Cron Jobs

Troubleshooting Cron
1) Uncomment the #cron line in /etc/syslog.conf to enable cron logging
2) Restart sysklogd : sudo /etc/init.d/sysklogd restart
3) Add cron jobs through crontab -e
4) Restart cron : sudo /etct/init.d/cron restart

To disable email notification, redirect the output to /dev/null
0 3 * * * /root/backup.sh >/dev/null 2>&1


Special strings to substitute * * * * *

Special string	Meaning
@reboot	Run once, at startup.
@yearly	Run once a year, "0 0 1 1 *".
@annually	(same as @yearly)
@monthly	Run once a month, "0 0 1 * *".
@weekly	Run once a week, "0 0 * * 0".
@daily	Run once a day, "0 0 * * *".
@midnight	(same as @daily)
@hourly	Run once an hour, "0 * * * *".

User crontabs are saved in
/var/spool/cron


*Cron status reporting
Set up Evolution to read mails sent by cron.
Create a new account and select "local delivery mails" from the dropdown box. This will enable Evolution to receive mails sent to /var/mail/


*cron commands are also logged in auth.log

Alternative to cron jobs
If a particular task needs to be schedule to be run once or a few times, an alternative solution would be to use the "at" command. This command basically allows the user to schedule a job at any particular time. Eg to send out an email at 4am next week.

at -f /home/user/atcommand -m now + 7 days

The f options tells the at command to run the content of a file (which is in a script format situated at /home/user/atcommand). The -m options will tell the system to send out an email (which contains the output of the command) to notify the user once the job is done and now + 7 days indicates that this job will be executed 7 days from now.

*make sure that there's either /etc/at.deny or /etc/at.allow file in your system. Else, onyl the root will be able to use the at command. These are basically ACL for at command.

You can query all at command jobs using atq and remove the jobs using atrm


Anacron for systems that are not up and running 24/7.
For each job, Anacron checks whether this job has been executed in the last n days, where n is the period specified for that job. If not, Anacron runs the job's shell command, after waiting for the number of minutes specified as the delay parameter.

After the command exits, Anacron records the date in a special timestamp file for that job, so it can know when to execute it again. Only the date is used for the time calculations. The hour is not used.

When there are no more jobs to be run, Anacron exits.
Only root can schedule anacron jobs. A way to enable other users to do so is by creating an anacron group and enable write permission for this group on /var/spool/anacron (where job timestamps are stored)

"run-parts" executes all the executable files in a directory. For example:
# run-parts /etc/cron.daily

"run-crons" executes all the scripts in the /etc/cron.daily, /etc/cron.hourly, /etc/cron.monthly, and /etc/cron.weekly directories.

*used to find files in directory that is messy, file criteria is *junk*
find /tmp -name '*junk*' -exec ls -l {} \;


To force anacron to be executed hourly, put a script which consist of the following in /etc/cron.hourly
#!/bin/sh
/usr/sbin/anacron -s

Installing PHP5

Assuming that you already have apache2 installed, the next step is to install PHP5. It is recommended that you install phpmyadmin and mysql as well.
1) Start by selecting and installing your modules through the synaptic package manager.
OR by command line
sudo apt-get install php5 mysql phpmyadmin
*please install PHP5.gd is you intend to use drupal
2) To enable PHP5, sudo a2enmod PHP5 and restart apache2
3) Test whether php pages are parsed by entering http://localhost/ and click on phpadmin
4) If cannot access that page (greeted by save php or phtml page as) , then you need to edit /etc/apache2/apache2.conf
look for the line AddType ****
and add in "AddType application/x-httpd-php .php .phtml"
5) Restart apache2 and you should be able to access the phpmyadmin page

Unable to start in Linux GUI

If you ever get an error logging into a linux GUI because the system is complaining that it ran out of space, here are some steps to free up some hard disk space to enable you to login (to do further cleaning)

1) At the GUI login , press Ctrl + Alt + F1 to login in terminal
2) Use df -h to check hard disk utilization information
3) Try deleting files in /home which you know can be deleted.
4) Try deleting files in /tmp
5) mount a USB drive and move some of your files in /home to the USB drive and delete them from the system.

Installing Apache 2 in Ubuntu Feisty

Before installing, please ensure that apache is not installed, else uninstall it.
*Apache modules are reported not to work with Apache2 modules.
1) To uninstall Apache
sudo apt-get remove apache
*alternatively, this can be done through sypnatic package module
2) Update apt-get's package list
sudo apt-get update (to subscribe to updated packages)
3) Install Apache2
sudo apt-get install apache2
4) The system should print out a message saying that apache2 is running. To test,
type http://localhost/ in a browser. You should be able to see the apache-default folder.
5) If step 4 fails, check /etc/default/apache2
ensure that NO_START = 0 to enable apache2 to start at port 80.
It could be that NO_START = 1 if apache was installed in your system and prevented Apache2 from starting at port 80.
6) Restart apache2
sudo /etc/init.d/apache2 restart

* commands to clean up source codes / downloaded files which are no longer in used
sudo dpkg --purge apache apache2

Installation of Ubuntu in Vmware Fusion

Installing Ubuntu Feisty in a virtual machine (VMWare Fusion)

1) Allocate at least 3Gb of space for the virtual drive (about 200Mb will be needed to install VMTools)

2) Boot up ISO image in VMWare Fusion and follow the installation steps.

3) Upon booting into Ubuntu, click on install VMWare Tools in the VMWare tab

4) Press the extract button and save vmware-tools-distrib to your home directory.
5) Enter the following commands:
cd vmware-tools-distrib
./vmware-install.pl
*The default answers are all suitable - but the process takes out your network connection.
./vmware-config-tools.pl.
6) When prompted to enter password when executing sudo commands, enter the admin's (usually the first user registered in Ubuntu) password and NOT the root password.
7) Root password can be set in System / Administration / Users and Groups in the GUI.