Skip to content

03.md

Latest commit

 

History

History
74 lines (48 loc) · 4.63 KB

03.md

File metadata and controls

74 lines (48 loc) · 4.63 KB

Day 3 - Power trip!

INTRO

You've been logging in as an ordinary user at your server, yet you're probably aware that root is the power user on a Linux system. This administrative or "superuser" account, is all powerful - and a typo in a command could potentially cripple your server. As a sysadmin you're typically working on systems that are both important and remote, so avoiding such mistakes is A Very Good Idea.

On many older production systems all sysadmins login as “root”, but it’s now common Best Practice to discourage or disallow login directly by root - and instead to give specified trusted users the permission to run root-only commands via the sudo command.

This is the way that your server has been set-up, with your “ordinary” login given the ability to run any root-only command - but only if you precede it with sudo.

(Normally on an Ubuntu system this will ask you to re-confirm your identity with your password. However, the standard AWS Ubuntu Server image does not prompt for a password).

YOUR TASKS TODAY:

  • Use the links in the "Resources" section below to understand how sudo works
  • Use ls -l to check the permissions of /etc/shadow - notice that only root has any access. Can you use cat, less or nano to view it?
  • This file is where the hashed passwords are kept. It is a prime target for intruders - who aim to grab it and use offline password crackers to discover the passwords.
  • Now try with sudo, e.g. sudo less /etc/shadow
  • Test running the reboot command, and then via sudo (i.e. sudo reboot)

Once you've reconnected back:

  • Use the uptime command to confirm that your server did actually fully restart
  • Test fully “becoming root” by the command sudo -i This can be handy if you have a series of commands to do "as root". Note the change to your prompt.
  • Type exit or logout to get back to your own normal “support” login.
  • Use less to view the file /var/log/auth.log, where any use of sudo is logged
  • You could "filter" this by typing: grep "sudo" /var/log/auth.log

If you wish to, you can now rename your server, which in Ubuntu is done by editing two files, and then rebooting:

  • Edit /etc/hostname using nano text editor, deleting the old name and setting up a new one:

sudo nano /etc/hostname

  • Then edit the /etc/hosts file, replacing the existing computer name with your new one:

sudo nano /etc/hosts

  • Reboot the system for changes to take effect:

sudo reboot

You might also consider changing the timezone your server uses. By default this is likely to be UTC (i.e. GMT) - which is pretty appropriate for a worldwide fleet of servers. You could also set it to the zone the server is in, or where you and your headquarters are. For a company this is a decision not to be taken lightly, but for now you can simply change as you please!

First check the current setting with:

timedatectl

Then get a a list of available timezones:

timedatectl list-timezones

And finally select one, like this:

sudo timedatectl set-timezone Australia/Sydney

Confirm:

timedatectl

The major practical effects of this are (1) the timing of scheduled tasks, and (2) the timestamping of the logs files kept under /var/log. If you make a change, there will naturally be a "jump" in the dates and time recorded.

WRAP

As a Linux sysadmin you may be working on client or custom systems where you have little control, and many of these will default to doing everything as root. You need to be able to safely work on such systems - where your only protection is to double check before pressing Enter.

On the other hand, for any systems where you have full control, setting up a "normal" account for yourself (and any co-admins) with permission to run sudo is recommended. While this is standard with Ubuntu, it's also easy to configure with other popular server distros such as Debian, CentOS and RHEL.

EXTENSION

RESOURCES

Copyright 2012-2020 @snori74 (Steve Brorens). Can be reused under the terms of the Creative Commons Attribution 4.0 International Licence (CC BY 4.0). This means you can copy, distribute and adapt the material as long as you credit Steve Brorens, and abide by the CC BY 4.0 licence terms.