Add date to Bash History

In order to add a date stamp to your bash history add the following two lines to your .bash_profile:

HISTTIMEFORMAT='%F %T '

export HISTTIMEFORMAT

Alternativelly, you can set this variable globally and have all history files keep the data by setting these two lines in a file under the /etc/profile.d directory.

echo "HISTTIMEFORMAT='%F %T '" > /etc/profile.d/histtimestamps.sh

# echo "export HISTTIMEFORMAT" >> /etc/profile.d/histtimestamps.sh

# chmod +x /etc/profile.d/histtimestamps.sh

Your history will look like this:

...

902 2012-02-16 09:50:33 cd /var/log

903 2012-02-16 09:50:33 ll

904 2012-02-16 09:50:33 ls -lat | sort -t

905 2012-02-16 09:50:33 ls -lat

...

Build an SELinux policy from an audit log

Often certain commands in linux will simply fail without any messages in /var/log/messages, or seemingly anywhere else... where we usually check. However, if you look at the selinux audit logs, sometimes the error messages are there. /var/log/audit/audit.log.

For example, every once in a while after a kernel update, I can't use the talk program. It simply says the connection is being refused by the other use. Since I already know Selinux is the culprit I grep the logs:

grep -i talkd /var/log/audit/audit.log

The result:

type=AVC msg=audit(1329155365.865:143): avc: denied { open } for pid=5631 comm="in.ntalkd" name="1" dev=devpts ino=4 scontext=system_u:system_r:ktalkd_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_devpts_t:s0 tclass=chr_file

type=SYSCALL msg=audit(1329155365.865:143): arch=c000003e syscall=2 success=no exit=-13 a0=7fffc83c0eb8 a1=101 a2=7fffc83c0ec3 a3=7fffc83c0690 items=0 ppid=5630 pid=5631 auid=4294967295 uid=99 gid=5 euid=99 suid=99 fsuid=99 egid=5 sgid=5 fsgid=5 tty=(none) ses=4294967295 comm="in.ntalkd" exe="/usr/sbin/in.ntalkd" subj=system_u:system_r:ktalkd_t:s0-s0:c0.c1023 key=(null)

Two entries showing that talk is denied. If you really want to authorize this process grep the tail end of the file and use audit2allow to generate a policy file that will allow this.

tail /var/log/audit/audit.log | grep '1329155365.865:143' | audit2allow -M talkpolicy

audit2allow generates a talkpolicy.pp file and will also give you instructions on how to activate it. That would be:

semodule -i talkpolicy.pp

This will take a minute or two and has effectively authorized the blocked program to run.

Redhat / Centos / Fedora VM Clone - Nic gets the wrong eth name.

After creating a clone and changing the MAC address I reboot the machine and find that the eth0 doesn't show up when I run the ifconfig command. This is to be expected of course as I have changed the MAC on the VM guest, but not on the OS's configuration. So:

# vim /etc/sysconfig/network-scripts/ifcfg-eth0

Modify the MAC Address here. Reboot the VM guest.

During the reboot eth0 does not get configured. Running ifconfig still returns nothing except the Loopback device. If I run:

# service network restart

Bringing up interface eth0: Device eth0 does not seem to be present, delaying initialization.

What is going on? I know the ethernet device is there, it's a VM. Let's see what dmesg says.

# dmesg | grep -i eth

e1000: eth0: e1000_probe: Intel(R) PRO/1000 Network Connection
udev: renamed network interface eth0 to eth1

Huh? Why? Well as it turns out, udev had also assigned the MAC address to it's own configuration before the clone took place. So now that the clone is done and we have a new MAC, udev knows about it, but it thinks its a new NIC entirely and doesn't have any configuration for it. Take a look at the udev file for the nic.

vim /etc/udev/rules.d/70-persistent-net.rules

You will notice probably 3 entries. Normally there is only one entry in this file. The first time the system booted up, udev detected a conflict with the MAC so it created a new entry. It was named NAME="eth1" with the new guest VM's real MAC.

The first entry is the original entry. And the last entry exists because we changed the MAC address in the ifcfg-eth0 file. The only valid entry now is the last one, so all we have to do is delete entry 1 and 2. Reboot the system.

Try ifconfig and automagically eth0 is there with an IP address. Provided you configured DHCP or a static IP that is.

Linux / Unix file system permissions. How to memorize the bits.

A very, very brief note on Linux / Unix file system permission bits.

Numeric Bit Value Table:

-------------------------------------

num bit   rep   meaning

-------------------------------------

0   000   ---   no permissions

1   001   --x   execute

2   010   -w-   write

3   011   -wx   write, execute

4   100   r--   read

5   101   r-x   read, execute

6   110   rw-   read, write

7   111   rwx   read, write, execute

-------------------------------------

Mnemonics:

Using  the above bits is simple, but it's not always obvious remembering which value represents which permissions. Eg: Read and Write is 5 or 6? It's easy if you have the chart in front of you, and if you can visualize the chart in your mind.

Here are 4 simple tricks to keep in mind to successfully memorize permission bits.

1) Always remember the order in which permissions are assigned (RWX). From left to right, "Read, Write, Execute." - Never "Write, Execute, Read" or any other combination.

2) Think of 4 as what cuts the permissions table in half. All read permissions are values 4 or above. Binary works from right to left, but the highest values will have a new position digit on the left side. Hence, think of "read" as in the highest values since it's on the left.

3) All write permissions are two values above 0 and 4. So: 2,3 and 6,7. Write access is probably the most important permission to remember due to it's sensitive nature.

4) Execute permissions have the easiest trick. Any odd bit is executable. How simple is that?

Linux - Backtik Operator - Return the result of a command as a parameter for another.

Linux has many useful features which make work easier. While managing packages I often find myself trying to run commands like yum remove but can't remember the exact version numbers, character case, or exact spelling. Usually the solution is to run rpm -qa | grep -i . For example:

$ rpm -qa | grep -i virtualbox

This would yield:

VirtualBox-4.1-4.1.0_73009_fedora14-1.x86_64

Try remembering how to type that package name every time you want to upgrade an RPM with yum.

Wouldn't it be nice to be able to combine both "yum remove" and "rpm -qa..." Linux offers this capability through the back-tick operator. ``. What it does is simply returns the output of the command executed within it. This enables the output to be passed as a parameter to some other command.

# yum remove `rpm -qa | grep -i virtualbox`

Yum will then nicely ask if you wish to remove the above mentioned program. Imagine the possibilities.  

WARNING: Be careful if you use this to remove packages from your system.  I only have one package called virtualbox installed on the system, but if you type in some other package name like "pl" you could end up in a lot of trouble.  Double check what your system is trying to remove.

For example:

# yum remove `rpm -qa | grep -i pl`

My system tells me it will remove 693 packages using 4.5GB of space, and is asking me if I want to continue.  That's nearly all my supporting packages.

Basically, use the backtick operator to your heart's content, but be very wary when cross scripting with commands such as 'yum remove'.

SeLinux HowTo: Change Context, Set SELinux booleans, Set permissive, enforced

Here is a very short 'Quick Reference' guide to manipulating some settings things with SELinux.

---

CHANGING SELINUX BOOLEANS

getsebool : Get's the values for various SELinux booleans.

Try:

1	# getsebool -a | grep httpd_can_network_connect

This should return the status of that particular variable, for example:

httpd_can_network_connect --> off
httpd_can_network_connect_db --> off
httpd_can_network_relay --> off

Of course you can specify the boolean directly without using grep if you know it's name:

1	# getsebool httpd_can_network_connect_db

setsebool Use this command to change the value of a SELinux boolean variable.  Example, the following will allow the httpd process to connect to a remote database server.

1	# setsebool -P httpd_can_network_connect_db on

The -P option stands for "persistent," meaning the changes will persist after a reboot.

---

ENABLING OR DISABLING SELINUX

getenforce : will return the current status for SELinux

setenforce : will temporarily enable/disable SELinux

In Fedora/Redhat modify the /etc/selinux/config file to make the changes to the enforcement policy permanent.

---

MODIFYING SELINUX CONTEXTS TEMPORARILY

It's easy to manipulate SELinux contexts with the chcon command.  For example if a process running as a particular user is not able to modify a file, check the context of that file by issuing the following command:

1

# ls -laZ

The Z option shows the SELinux context information for the files listed by the ls command.
For example, on Fedora / RedHat you might see the following contexts for the /var/log/httpd folder:

1	# ls -laZ /var/log/httpd

drwxr-xr-x  root root user_u:object_r:var_log_t  .
...
...

I created a new httpd log folder to increase the disk space available for logging; the SELinux context was by default set to:

drwxr-xr-x  root root system_u:object_r:file_t

Therefore the httpd process was unable to write new log files in this folder.  The context type was not set correctly to allow changes.  Changing the context type required issuing the following command to ensure it matched the old httpd directories' settings.

1	chcon -c -u user_u -t var_log_t /var/log/httpd

UPDATE (2017-08-23) (The -c option has been removed and is no longer required: http://lists.gnu.org/archive/html/bug-coreutils/2008-10/msg00076.html)

This will relabel the file and the process will now be able to access it directly as needed.

NOTE:  This is a temporary measure and only labels the file until the next reboot.  Read on for a permanent solution.

---

MODIFYING SELINUX CONTEXTS PERMANENTLY

To make persistant modifications to SELinux contexts you must add an entry to the SELinux file context database: /etc/selinux/targeted/contexts/files/file_contexts.local.  The semanage command will do just that.  The next step is to apply the change by running the restorecon command against the file to be modified.

First, add a new record for the file /var/log/httpd with the command:

1	# semanage fcontext -a -s user_u -t var_log_t /var/log/httpd

-a adds the file to /etc/selinux/targeted/contexts/files/file_contexts.local
-s specifies the SELinux user
-t specifies the SELinux type

This change has not yet been applied to the file and will only occur during the next reboot when the filesystem is relabeled.  However to execute the change now use the restorecon command:

1	# restorecon -v /var/log/httpd

How to force a password reset at first login in Fedora Linux

The steps to force a password reset the first time a user logs in, are very simple.  As a matter of fact, there is only 1 step.

Example:

1	# chage -d 0 <username>

The chage command is the password expiry management command for a linux user account.

The -d option specifies the last day when the password was last changed.  When zero is set, the password must then be changed, thereby forcing the user to provide a new password upon login.

QuickRef

Enabling the talk daemon on Linux Fedora 14

The talk daemon is not installed by default in Fedora, but the client is. I've prepared instructions to help enabling the talk daemon on Fedora 14. Note that these instructions should work on most versions of Fedora and various flavors of Linux. The chkconfig command may vary from system to system. For example, on Ubuntu I think you have to use update-rc.d.

To install and enable the talk server, follow these simple steps:

1	# yum install talk-server

1 2 3 4 5

# chkconfig xinetd on # chkconfig talk on # chkconfig ntalk on

1	# /etc/rc.d/init.d/xinetd start

to connect you have to do :

talk username@hostname

QuickRef