Execute arbitrary commands remotely

NOTE

FROM: https://serverfault.com/questions/625641/how-can-i-run-arbitrarily-complex-command-using-sudo-over-ssh

Pass a complex script to be executed over SSH.

ssh -tt @ "echo `base64 test.sh` | base64 -d | sudo bash"

The key is to base64 encode locally and decode it remotely in order to execute it correctly.

Using Virtualbox and Hyper-V on the same system

It's always a challenge to use Virtualbox and MS Hyper-V on the same system, as the CPU's virtualization features are locked by Hyper-V at boot time.

There isn't a way that I know of to use both simultaneously, but at least there is a way to easily enable/disable hyper-v to allow virtualbox access.  Unfortunately it does require a reboot:

Disabling Hyper-V:

Open an elevated command prompt and execute:

bcdedit /set hypervisorlaunchtype off

Enabling Hyper-V:

Open an elevated command prompt and execute:

bcdedit /set hypervisorlaunchtype auto

Enabling the talk daemon on Fedora 20

well, it's been a few years and as technology changes, so does the methods used to configure a system.

I still use the talk program on a regular basis.  Here are the instructions for enabling it:

# yum install xinetd talk-server talk

# systemctl enable xinetd.service
# systemctl enable ntalk.service

At this poing, simply starting the xinetd and ntalk services does not seem to allow the talk program to function.  At the moment, the only solution I had was to reboot the system.  If someone has a better way, I would very much like to know.

# reboot

Talk should now work.  However, there is a chance that SELinux will deny it.  Check your logs:

# grep -i denied /var/log/audit/audit.log

If you do get a denial you will need to build a new policy.  Make sure you have the following utility installed: checkpolicy

# yum install checkpolicy

# grep in.ntalkd /var/log/audit/audit.log | audit2allow -M mypol

# semodule -i mypol.pp

That's it.

Misc Notes

Securely delete files in linux:

# srm --help

# shred --help

---------

Bash history tweaks:

1) Increase history size in Redhat / Fedora / CentOS:

# vim /etc/profile
...
HISTSIZE=100000
...

2) Append history from multiple terminals:

# vim /etc/bashrc
    ...
    fi
    # Turn on append history
    shopt -s histappend
    history -a
    # Turn on checkwinsize
    ...

---------

Copy your public key to a remote host:

$ ssh-copy-id -i ./.ssh/id_rsa.pub remote.domain.com

Modify MySQL variables without restarting the server

Reminder note on changing MySQL variables live and without restarting the service.

mysql> show global variables where variable_name like '%engine%';
+---------------------------+--------+
| Variable_name             | Value  |
+---------------------------+--------+
| engine_condition_pushdown | ON     |
| storage_engine            | MyISAM |
+---------------------------+--------+
2 rows in set (0.00 sec)

mysql> SET GLOBAL storage_engine=InnoDB;
Query OK, 0 rows affected (0.00 sec)

mysql> show global variables where variable_name like '%engine%';
+---------------------------+--------+
| Variable_name             | Value  |
+---------------------------+--------+
| engine_condition_pushdown | ON     |
| storage_engine            | InnoDB |
+---------------------------+--------+
2 rows in set (0.00 sec)

Very simple, but I can never remember this and it tends to be buried somewhere in MySQL's massive documentation.

Granular permissions through sudoers

A quick example on how to provide root permissions on specific commands to a specific group of users.

You can create command aliases, which can be very useful when formatting and controlling access to these.

For example:

Cmnd_Alias vi    = /usr/bin/vim

This will match both /usr/bin/vim or just plain vim.

Assigning ROOT permissions to run this command alias to a specific user:

username ALL=(root) vi

And the same for a group:

%groupname ALL=(root) vi

In my example below, I provide access to use all the NGINX service commands on a redhat 6 system, to a new group called nginxadm.

Open up the sudoers file using visudo.

## NGINX USERS - should be part of nginxadm group
# Usage: nginx {start|stop|restart|condrestart|try-restart|force-reload|upgrade|reload|status|help|configtest}
Cmnd_Alias NG           = /sbin/service nginx
Cmnd_Alias NGRES        = /sbin/service nginx restart
Cmnd_Alias NGSTA        = /sbin/service nginx start
Cmnd_Alias NGSTO        = /sbin/service nginx stop
Cmnd_Alias NGSTS        = /sbin/service nginx status
Cmnd_Alias NGCDR        = /sbin/service nginx condrestart
Cmnd_Alias NGTRS        = /sbin/service nginx try-restart
Cmnd_Alias NGFRL        = /sbin/service nginx force-reload
Cmnd_Alias NGUPG        = /sbin/service nginx upgrade
Cmnd_Alias NGRLD        = /sbin/service nginx reload
Cmnd_Alias NGHLP        = /sbin/service nginx help
Cmnd_Alias NGCFG        = /sbin/service nginx configtest
%nginxadm ALL=(root)    NG,NGRES,NGSTA,NGSTO,NGSTS,NGCDR,NGTRS,NGFRL,NGUPG,NGRLD,NGHLP,NGCFG

Thanks to FACLs in Linux, we can also give granular permissions to the NGINX configuration files.

List users in linux

Here is a quick tip on how to more or less reliably list all non-system users and print out status information about their accounts, in linux.

grep -i ':/home/' /etc/passwd | cut -d: -f1 | xargs -n 1 passwd -S

Step 1:
We use grep to look for entries in the /etc/passwd file where the /home/ directory is specified.  System users don't normally have such a directory.

Step 2:
We then use cut to retain only the username, and we specify : (colon) as a delimiter.

Step 3:
We run the usernames through xargs to pass each username as a single argument to the passwd -S command.

passwd -S prints out short status of the username.  Whether it's locked, expired, etc...

Parse Apache Logs by Date Range

Parsing apache logs by date and by date ranges can be fairly simple with a bit of awk scripting.

We use AWK to compare date fields in order to retrieve specific rows.

The date fields between access logs and error logs can vary, so some adjustments are needed:

Note that the date field is contained within a single column in the access_log file, therefore we can do a comparison against a single column.  Typically column #4.

AWK Date Range for access logs:

$ awk '$4>"[09/Aug/2012:15:00:" && $4<"[09/Aug/2012:15:59:"' ./access_log | less

The date field in the error log is in separate columns.  Example: [Thu Aug 09 15:30:...  That in itself is four columns.  They must be combined in order to be compared effectively.  To do this, we assign a combination of those four columns to two variables: $from and $two.  We then use these two variables for the comparison.  See below:

AWK Date Range for error logs:

$ awk '$from>"[Thu Aug 09 15:30:00" && $to<"[Thu Aug 09 15:59:00"' from='$1 " " $2 " " $3 " " $4' to='$1 " " $2 " " $3 " " $4' ./error_log | less

Add date to Bash History

In order to add a date stamp to your bash history add the following two lines to your .bash_profile:

HISTTIMEFORMAT='%F %T '

export HISTTIMEFORMAT

Alternativelly, you can set this variable globally and have all history files keep the data by setting these two lines in a file under the /etc/profile.d directory.

echo "HISTTIMEFORMAT='%F %T '" > /etc/profile.d/histtimestamps.sh

# echo "export HISTTIMEFORMAT" >> /etc/profile.d/histtimestamps.sh

# chmod +x /etc/profile.d/histtimestamps.sh

Your history will look like this:

...

902 2012-02-16 09:50:33 cd /var/log

903 2012-02-16 09:50:33 ll

904 2012-02-16 09:50:33 ls -lat | sort -t

905 2012-02-16 09:50:33 ls -lat

...

Build an SELinux policy from an audit log

Often certain commands in linux will simply fail without any messages in /var/log/messages, or seemingly anywhere else... where we usually check. However, if you look at the selinux audit logs, sometimes the error messages are there. /var/log/audit/audit.log.

For example, every once in a while after a kernel update, I can't use the talk program. It simply says the connection is being refused by the other use. Since I already know Selinux is the culprit I grep the logs:

grep -i talkd /var/log/audit/audit.log

The result:

type=AVC msg=audit(1329155365.865:143): avc: denied { open } for pid=5631 comm="in.ntalkd" name="1" dev=devpts ino=4 scontext=system_u:system_r:ktalkd_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_devpts_t:s0 tclass=chr_file

type=SYSCALL msg=audit(1329155365.865:143): arch=c000003e syscall=2 success=no exit=-13 a0=7fffc83c0eb8 a1=101 a2=7fffc83c0ec3 a3=7fffc83c0690 items=0 ppid=5630 pid=5631 auid=4294967295 uid=99 gid=5 euid=99 suid=99 fsuid=99 egid=5 sgid=5 fsgid=5 tty=(none) ses=4294967295 comm="in.ntalkd" exe="/usr/sbin/in.ntalkd" subj=system_u:system_r:ktalkd_t:s0-s0:c0.c1023 key=(null)

Two entries showing that talk is denied. If you really want to authorize this process grep the tail end of the file and use audit2allow to generate a policy file that will allow this.

tail /var/log/audit/audit.log | grep '1329155365.865:143' | audit2allow -M talkpolicy

audit2allow generates a talkpolicy.pp file and will also give you instructions on how to activate it. That would be:

semodule -i talkpolicy.pp

This will take a minute or two and has effectively authorized the blocked program to run.

Linux / Unix file system permissions. How to memorize the bits.

A very, very brief note on Linux / Unix file system permission bits.

Numeric Bit Value Table:

-------------------------------------

num bit   rep   meaning

-------------------------------------

0   000   ---   no permissions

1   001   --x   execute

2   010   -w-   write

3   011   -wx   write, execute

4   100   r--   read

5   101   r-x   read, execute

6   110   rw-   read, write

7   111   rwx   read, write, execute

-------------------------------------

Mnemonics:

Using  the above bits is simple, but it's not always obvious remembering which value represents which permissions. Eg: Read and Write is 5 or 6? It's easy if you have the chart in front of you, and if you can visualize the chart in your mind.

Here are 4 simple tricks to keep in mind to successfully memorize permission bits.

1) Always remember the order in which permissions are assigned (RWX). From left to right, "Read, Write, Execute." - Never "Write, Execute, Read" or any other combination.

2) Think of 4 as what cuts the permissions table in half. All read permissions are values 4 or above. Binary works from right to left, but the highest values will have a new position digit on the left side. Hence, think of "read" as in the highest values since it's on the left.

3) All write permissions are two values above 0 and 4. So: 2,3 and 6,7. Write access is probably the most important permission to remember due to it's sensitive nature.

4) Execute permissions have the easiest trick. Any odd bit is executable. How simple is that?

Linux - Backtik Operator - Return the result of a command as a parameter for another.

Linux has many useful features which make work easier. While managing packages I often find myself trying to run commands like yum remove but can't remember the exact version numbers, character case, or exact spelling. Usually the solution is to run rpm -qa | grep -i . For example:

$ rpm -qa | grep -i virtualbox

This would yield:

VirtualBox-4.1-4.1.0_73009_fedora14-1.x86_64

Try remembering how to type that package name every time you want to upgrade an RPM with yum.

Wouldn't it be nice to be able to combine both "yum remove" and "rpm -qa..." Linux offers this capability through the back-tick operator. ``. What it does is simply returns the output of the command executed within it. This enables the output to be passed as a parameter to some other command.

# yum remove `rpm -qa | grep -i virtualbox`

Yum will then nicely ask if you wish to remove the above mentioned program. Imagine the possibilities.  

WARNING: Be careful if you use this to remove packages from your system.  I only have one package called virtualbox installed on the system, but if you type in some other package name like "pl" you could end up in a lot of trouble.  Double check what your system is trying to remove.

For example:

# yum remove `rpm -qa | grep -i pl`

My system tells me it will remove 693 packages using 4.5GB of space, and is asking me if I want to continue.  That's nearly all my supporting packages.

Basically, use the backtick operator to your heart's content, but be very wary when cross scripting with commands such as 'yum remove'.

SeLinux HowTo: Change Context, Set SELinux booleans, Set permissive, enforced

Here is a very short 'Quick Reference' guide to manipulating some settings things with SELinux.

---

CHANGING SELINUX BOOLEANS

getsebool : Get's the values for various SELinux booleans.

Try:

1	# getsebool -a | grep httpd_can_network_connect

This should return the status of that particular variable, for example:

httpd_can_network_connect --> off
httpd_can_network_connect_db --> off
httpd_can_network_relay --> off

Of course you can specify the boolean directly without using grep if you know it's name:

1	# getsebool httpd_can_network_connect_db

setsebool Use this command to change the value of a SELinux boolean variable.  Example, the following will allow the httpd process to connect to a remote database server.

1	# setsebool -P httpd_can_network_connect_db on

The -P option stands for "persistent," meaning the changes will persist after a reboot.

---

ENABLING OR DISABLING SELINUX

getenforce : will return the current status for SELinux

setenforce : will temporarily enable/disable SELinux

In Fedora/Redhat modify the /etc/selinux/config file to make the changes to the enforcement policy permanent.

---

MODIFYING SELINUX CONTEXTS TEMPORARILY

It's easy to manipulate SELinux contexts with the chcon command.  For example if a process running as a particular user is not able to modify a file, check the context of that file by issuing the following command:

1

# ls -laZ

The Z option shows the SELinux context information for the files listed by the ls command.
For example, on Fedora / RedHat you might see the following contexts for the /var/log/httpd folder:

1	# ls -laZ /var/log/httpd

drwxr-xr-x  root root user_u:object_r:var_log_t  .
...
...

I created a new httpd log folder to increase the disk space available for logging; the SELinux context was by default set to:

drwxr-xr-x  root root system_u:object_r:file_t

Therefore the httpd process was unable to write new log files in this folder.  The context type was not set correctly to allow changes.  Changing the context type required issuing the following command to ensure it matched the old httpd directories' settings.

1	chcon -c -u user_u -t var_log_t /var/log/httpd

UPDATE (2017-08-23) (The -c option has been removed and is no longer required: http://lists.gnu.org/archive/html/bug-coreutils/2008-10/msg00076.html)

This will relabel the file and the process will now be able to access it directly as needed.

NOTE:  This is a temporary measure and only labels the file until the next reboot.  Read on for a permanent solution.

---

MODIFYING SELINUX CONTEXTS PERMANENTLY

To make persistant modifications to SELinux contexts you must add an entry to the SELinux file context database: /etc/selinux/targeted/contexts/files/file_contexts.local.  The semanage command will do just that.  The next step is to apply the change by running the restorecon command against the file to be modified.

First, add a new record for the file /var/log/httpd with the command:

1	# semanage fcontext -a -s user_u -t var_log_t /var/log/httpd

-a adds the file to /etc/selinux/targeted/contexts/files/file_contexts.local
-s specifies the SELinux user
-t specifies the SELinux type

This change has not yet been applied to the file and will only occur during the next reboot when the filesystem is relabeled.  However to execute the change now use the restorecon command:

1	# restorecon -v /var/log/httpd

How to force a password reset at first login in Fedora Linux

The steps to force a password reset the first time a user logs in, are very simple.  As a matter of fact, there is only 1 step.

Example:

1	# chage -d 0 <username>

The chage command is the password expiry management command for a linux user account.

The -d option specifies the last day when the password was last changed.  When zero is set, the password must then be changed, thereby forcing the user to provide a new password upon login.

QuickRef

Enabling the talk daemon on Linux Fedora 14

The talk daemon is not installed by default in Fedora, but the client is. I've prepared instructions to help enabling the talk daemon on Fedora 14. Note that these instructions should work on most versions of Fedora and various flavors of Linux. The chkconfig command may vary from system to system. For example, on Ubuntu I think you have to use update-rc.d.

To install and enable the talk server, follow these simple steps:

1	# yum install talk-server

1 2 3 4 5

# chkconfig xinetd on # chkconfig talk on # chkconfig ntalk on

1	# /etc/rc.d/init.d/xinetd start

to connect you have to do :

talk username@hostname

QuickRef

Linux screen resolution set at boot time

Edit your boot command with your bootloader. Use one of the following options:

VGA Resolution and Color Depth reference Chart:

Depth	800×600	1024×768	1152×864	1280×1024	1600×1200
8 bit	vga=771	vga=773	vga=353	vga=775	vga=796
16 bit	vga=788	vga=791	vga=355	vga=794	vga=798
24 bit	vga=789	vga=792		vga=795	vga=799

source: http://www.pendrivelinux.com/vga-boot-modes-to-set-screen-resolution/

QuickRef