Doing Away with the Need for Root Account in Linux

After your installation of Linux, it is a better idea to do away with root account. This is part of making your system as secure as possible. Almost all Linux installations comes with a program named sudo that provides root privileges to normal users without knowing the root password. This way you can execute commands that are meant to be executed by root. Please follow the steps below to enable any user to obtain the root privileges:

• Need to enable any user or group, who want to gain root privileges, in /etc/sudoers. The normal practice is to enable the users belonging to group wheel to run all root privileged commands.
• /etc/sudoers is edited by visudo. You need to be root to edit this file.

$visudo =========== File snippet below ===================== # sudoers file. # # This file MUST be edited with the ‘visudo’ command as root. # # See the sudoers man page for the details on how to write a sudoers file. # # Host alias specification # User alias specification # Cmnd alias specification   # Defaults specification # User privilege specification root ALL=(ALL) ALL # Uncomment to allow people in group wheel to run all commands. Uncomment the following line %wheel ALL=(ALL) ALL # Same thing without a password # %wheel ALL=(ALL) NOPASSWD: ALL

• Now add the user you want to have root privilege into group wheel

$usermod -a -G wheel “username here without the quotes”

Now test whether that particular user can gain root privilege. First login to the system with username you want to test

$wc /etc/sudoers wc: /etc/sudoers: Permission denied $sudo wc /etc/sudoers password: # enter your account password here 28 94 579 /etc/sudoers

if you can count the words in that file, that means you can any command that requires root privilege.

If you are using SSH to login to your machine remotely, then follow the procedure below to disallow “root” to login

• Again it is a good practice to create a group whose users will be allowed SSH access.
• create a group named sshusers.

$sudo groupadd sshusers $sudo usermod -a -G sshusers “username who needs to ssh access without quotes”

Now open /etc/ssh/sshd_config to diable

root

login and enable the group

sshusers

$sudo vi /etc/sshd/sshd_config=========== File snippet. Only the required portion is shown= #LoginGraceTime 2m PermitRootLogin no #Add this line into the file AllowGroups sshusers

Test it out just by logging in as root. You should get Access Denied message

Now try to login using a user that belongs to sshusers group. You should be able to login

Read More

Postfix master.cf configuration tidbit

If you want to override a named command in main.cf, normally you can specify in the master.cf as override option (-o) to the command.
There is one quirk here though. It cannot contain any white spaces. The manual page explain this clearly. However, it is silent when it comes to parameter values that contains whitespace. There are no examples as well.

The simple trick here is to replace white space with comma as well.

For example:
….. -o smtpd_client_restrictions=check_client_access,hash:/etc/postfix/access

Please see the comma after check_client_access.

But when you use this parameter in main.cf, it will be as below
smtpd_client_restrictions=check_client_access hash:/etc/postfix/access

Read More

Configuring Samba as a Home File-Server

Samba is a very powerful software that can act as File-server & print-server using SMB/CIFS protocol. Here I describe a Home environment  and provide a appropriate Samba server configuration.
Assumptions

Samba is installed correctly and it execute with out issues. Samba configuration file is located in /etc/samba Samba Configuration file name is smb.conf ( This is the default ) Samba is installed on Debian Linux distribution. ( This should not matter much )

Description of the Home Environment

A Linux server with huge disk-space A Mac desktop system A Windows XP desktop Office Laptop that needs to work in both Office and Home environment A DSL Internet from ISP. DSL model Cum wireless router acts as the firewall for Home Network All these computers form a private network behind the firewall and Wifi security is enabled for wireless connections.

Samba File Server Requirements

A common folder accessible to all home computers and office laptop while operating under home profile. A private folder for each of the family members The common folder should be available only for the trusted systems. That is, the systems I identify as trusted. For example, if one of my friend visits my house and plugs his computer in my network, the common folder should not be accessible from his computer. Private folder of User A should not be accessible by User B Samba service is only available with in the private network and must not be accessible from the Internet.

Links to Refer

http://www.samba.org/samba/docs/man/Samba-HOWTO-Collection/passdb.html http://oreilly.com/catalog/samba/chapter/book/index.html

smb.conf File That Satisfies The Above Requirements

[global] netbios name = squad server string = Siva’s File Server invalid users = backup,bin,daemon,games,gnats,irc,list,lp,mail,man,news,proxy,root,sshd,sync, sys,uucp workgroup = HOME os level = 34 valid users = @users security=user [common] browseable = yes comment = Common folder for family members path = /path/to/directory writeable = yes force group = users create mode = 770 directory mode = 770 [homes] browseable = no read only = no

Read More

How to add Swap partition in Debian/Ubuntu

RAM is composed of chunks of memory called Pages.  When programs execute, it takes fills up pages. Due to this sooner or later memory will run out. In order to free up the RAM, Pages can be swapped into hard drive and the freed up RAM can be used by the other program which needs CPU’s attention.

Swap space is not a must in Linux. So if you happen to have a system that does not have Swap space, then follow the below guide to create a swap file and use it.

Check whether a SWAP space is enabled

sudo swapon -s

if you do not have swap enabled in the system you should see the output as below

Filename                                Type            Size    Used    Priority

Check the system for available space.

The recommended swap file size is twice the size of the RAM size. If your RAM
size is 512 MB, then the SWAP file size should be 1GB.

df

Filesystem           1K-blocks      Used        Available Use% Mounted on
/dev/vda              20642428   2367536    17226316  13% /
tmpfs                   254432         0                  254432   0% /lib/init/rw
udev                    249612        60                   249552   1% /dev
tmpfs                   254432         4                    254428   1% /dev/shm

Allocate space for swapfile

sudo fallocate -l 1GB  /swapfile

Create Swap file 

sudo mkswap /swapfile

the output will look like below

Setting up swapspace version 1, size = 8388608 KiB
no label, UUID=103c4545-5fc5-47f3-a8b3-dfbdb64fd7eb

Turn on the SWAP file

sudo swapon  /swapfile

You will then be able to see the new swap file when you view the swap summary.

swapon -s
Filename    Type  Size Used Priority
/swapfile                               file  8388608 0 -1

TO add this partition permanently, add it into /etc/fstab

sudo nano /etc/fstab

/swapfile  none  swap  sw  0  0

save and close the fstab file.

Read More

How to Mount SMB/CIFS network share in Linux

If you have a Home NAS and if it supports SMB/CIFS shares, then follow the steps below to mount those shares in a Linux System.

Prerequisite   Linux system must have “smbfs” and cifs-utils package installed.

Mount CIFS with the default local filesystem permissions:

# mkdir /mnt/mntpoint 

# mount -t cifs //server-name/share-name /mnt/mntpoint -o username=shareuser,password=sharepassword

For Example
 # mount -t cifs //192.168.1.2/myfolder /mnt/mntpoint -o username=shareuser,password=sharepassword

Where,

• username=shareuser : specifies the CIFS user name.
• password=sharepassword : specifies the CIFS password. If this option is not given then the environment variable PASSWD is used. If the password is not specified directly or indirectly via an argument to mount, mount will prompt for a password, unless the guest option is specified.

For further details and options, please read linux man page for mount.cifs(8). Also, please note that only root user can mount the filesystems.

If you want a particular filesystem to mounted at boot time, then enter a static information about the filesystem you want to mount in /etc/fstab.

For example, in /etc/fstab you need to enter 6 fields

“file system to be mounted”   “mount point”  “file type”  “options”  ” dump option” “file system check (fsck) value”

//192.168.1.2/myfolder  /mnt/mntpoint cifs  username=shareuser,password=sharepassword 0 0

if you want any user to mount this file system then do the following

//192.168.1.2/myfolder  /mnt/mntpoint cifs  username=shareuser,password=sharepassword,user 0 0

if you want to provide a resolvable hostname instead of IP address, then ensure that you have cifs-utils is installed. Otherwise you will fail to mount with error code -22 . If you do a dmesg after failure you will see the below message

cifs_mount failed w/return code = -22

Read More