Hands-on Guide to the Debian GNU Operating System
|
|
||
| < index > | ||
Hands-on Guide to the Debian GNU Operating System | ||
 |
Hands-on Guide to the Debian GNU Operating SystemDavor Ocelic
2. IntroductionThe Guide is available under the terms of the GNU GPL license, and you should probably read it after you successfully install the Debian GNU system on your computer (with or without the help of the Debian installation guide). This is a step-by-step document with many examples, which should relatively quickly answer most of your questions and help you build the correct mindset to solve further problems on your own; I am known for repeating that the idea and logic count, not the exact implementation or usage details (I am all for the "give man a fish and he can eat today, teach a man to fish and can eat forever" principle here). I tried to make it a balanced mix bewteen the administrator's and the user's guide; it is probably too broad for those who belong to either of the two extreme categories. The approach I used should fit home users best - people who do have a Debian installation and a root access at hand, and want to learn and experiment. We will properly define basic terms, explain the system design goals, cover the most important end-user issues and show many command line examples. Since this is a Debian guide, we will not hesitate to use Debian-specific features and commands, but note that most of it (ideologically, at least) applies to other Linux or Unix systems as well. Finally, by saying this is a beginner's guide, we definitely don't restrict ourselves to system basics, I believe the guide is hiding many beautiful details that even experienced users might find useful or amusing. Please note that all the fine information presented here can also be found in respective packages' documentation and is more detailed and comprehensive there. Therefore, it is implicitly suggested to read official software and system documentation in combination with this guide (the dpkg(8) and apt(8) manual pages are perfect to show there's much more of it than we mention here). Generally, www.tldp.org (former linuxdoc), www.debian.org and www.debian.org/doc, /usr/{doc, share/doc, local/share/doc} directories, and the man and info pages on your system are the right information sources. After you finish reading this guide, you'll probably want to read other on-topic manuals available from the Debian documentation directory. 2.1. Official "Hands-on Guide" download siteshttp://debguide.sarovar.org/ or http://sarovar.org/projects/debguide/ http://www.debian.org/doc/manuals/hands-on/ 2.2. Acknowledgements
3. Conventions
4. Basic theoryLet's use this chapter to identify some common misinterpretations and properly define the terms we will use everywhere in this document. We'll start with general terms, such as Unix, GNU or Free Software, and then say something about the Debian Project itself. A little glossary of the various terms that you'll be encountering is provided in the appendix. Let's start. 4.1. UnixIn earlier versions of this document, I used to say that Unix was a common name for a group of superior operating systems which shared most of the key design ideas. While there was nothing wrong with that statement, I went to search the Internet for some more formal explanations: Short introduction on the UGU site says:
Similar and more detailed description from searchSolaris:
4.2. Free Software, GNU and LinuxSome time later, Richard Stallman, a MIT hacker, started an initiative to create a completely free operating system (free as in freedom). Among other things, his decision was based on frustrations and problems he saw in non-disclosure agreements. They once prevented his colleague from giving him the source code for a laser printer driver (Stallman wanted to include automatic paper-jam notification features). Highly motivated to do The Right Thing (tm), he later quit the job at MIT (so they couldn't possibly claim copyright on his work) and, in 1984, started the GNU ("Gnu's Not Unix") project, whose goal was to protect freedom and supply users with full-featured free software packages for their computers. GNU is a wonderful philosophy that could surely affect non computer-related areas as well. You can see the original Stallman's announcement from Sep 27, 1983 / 10:35:59 PST in the excellent Google Groups archive! GNU developers have re-written all the necessary Unix system tools and utilities, released them as Free Software (under the GNU GPL licence), and they only needed a kernel to accomplish the initial goal. Independently, in 1991, Linus Torvalds (from the Helsinki University) announced his first public release of the kernel he was working on - Linux. He was a student back then, and wanted to create a cheap alternative to high-priced Unix systems, which would run on PC (i386) compatible machines. Combining the Linux kernel and the GNU tools, the free GNU/Linux system became a reality. Linus wrote the kernel from scratch ("from zero") and it was one of the first free Unix-like variants which, supported by the great GNU community and their software, got the Free Software movement really going (from the general-public perspective, not technically, of course). All the way back in 1994, Peter van der Linden wrote the following in his excellent book, titled “Expert C Programming; Deep C Secrets” (ISBN 0-13-177429-8):
However, there were other efforts, such as those by the BSD people who still had problems with the licensing issues and copyrights, but they have rewritten all the parts in question and released free BSD variants: FreeBSD, NetBSD and OpenBSD.
4.2.1. Open SourceOpen Source is a somewhat newer term which was generally accepted to help promote Free Software in commercial environments. It relies only on practical benefits of open source code (quality, reliability, cost of maintenance) and has no greater philosophy behind it. More information can be found at the Open Source Initiative (OSI) website. It is therefore important to know the disctinction between the two.
4.3. GNU kernel - The HurdIt is interesting to mention that Linux is a monolithic kernel and shares many ideas with its Unix counterparts. However, the GNU people have a different vision of how kernels should look like and they are working on The Hurd microkernel. Debian GNU/Hurd port is in progress, and you can see the current status or download the software from the Debian GNU/Hurd port page. Monolithic and microkernels are fundamentally different, and there's been much of debate if microkernels would ever prove useful in real-life application. Linus Torvalds, for example, is constantly bashing microkernel operating systems ("just say NO to drugs, and maybe you won't end up like The Hurd people"). Alan Cox, the maintainer of the production tree of the Linux kernel, who has more sympathies for The Hurd, once said that The Hurd was more about Richard Stallman's idea about how a system should work to promote community than about high perfomance OS design. Technically, The Hurd and microkernels in general do offer many advantages over the traditional Unix kernels; those interested in getting more information should see hurd-paper.html and hurd-talk.html (for The Hurd), or the QNX website (for the proprietary, mature, microkernel-based Unix). 4.4. The Debian GNU system, its design goals and basic ingredientsLet's quote something from the official About Debian page:
5. Basic system managementAs we've just covered a bit of the theory, we'll now move on to the basic system administration issues. We will start with basic topics (with software installation, for example), then cover the hardware configuration principles (including the graphical X Window System), suggest generally good things to do with fresh Debian installations and provide help and examples for common software packages. 5.1. Package managementThe first thing we will take a closer look at is the Debian package management system. We'll take a tour of dpkg(8), apt(8) and other package management related tools. What we're referring to when we say package management is the set of tools we use for browsing, installation, configuration and removal of software packages.
If you're not specifically interested in all the details and command line switches at the moment (that is, if this is just your easy late night reading ;-), then just briefly remember the command names and their purpose, and skip down to the Getting familiar with system messages subchapter. 5.1.1. dpkgdpkg is a medium-level package manager for Debian. Unless you run into problems with apt-get, you will generally not have to use it directly. Most notably, dpkg does not have the automatic package retrieval methods, and does not resolve dependencies on its own.
5.1.2. dpkg-reconfiguredpkg-reconfigure is a tool you use to reconfigure debconf-enabled packages (those which use debconf to ask questions and get answers about the local configuration).
5.1.3. aptThe apt package provides a few command-line tools you will need to successfully use apt-get(8), the tool for high-level package management. 5.1.3.1. apt-setupapt-setup (beware, from the base-config package) opens up a ncurses-based apt configuration tool. Basically, it asks a series of questions and then updates the package files (you can do the same manually by editing /etc/apt/sources.list and running apt-get update). Also check the netselect package, which should select the fastest mirror servers for you automatically. It can sometimes come handy to do telnet linuks.mine.nu | tail -n 5 > /etc/apt/sources.list to retrieve the apt sources for the Debian unstable branch. For more exotic apt sources, check www.apt-get.org. 5.1.3.2. apt-cdromIf you have the packages on your cdroms, you will use the apt-cdrom utility to index them.
5.1.3.3. apt-getapt-get is an apt package handling utility. It is probably the most convenient way to install or remove packages, as it automatically calculates dependencies and adjusts package lists. While dpkg allows you to install any .deb file (provided you have the appropriate .deb file saved locally), apt-get does not. It uses the /etc/apt/sources.list file as its list of 'package sources'; it parses them and creates a big list of all available packages. So whatever you do, you're restricted to packages known to apt. This is both powerful and elegant way to deal with package management, and some of the complicated tasks (such as the package or whole distribution release upgrades) become so easy with Debian GNU that you will hardly believe it! Other, rpm-based distributions are trying to catch up with apt, either by reimplementing the logic in their own programs or porting apt to their systems, but of course, Debian always knows better so stay with the winning team.
5.1.3.4. apt-cacheapt-cache can be used to query the dpkg package database.
5.1.3.5. apt-rdependsapt-rdepends performs recursive dependency listings similar to apt-cache. It searches through the APT cache to find package dependencies, and it knows how to emulate the result of calling apt-cache with both depends and dotty options. By default, it shows a complete dependencies listing. 5.1.3.6. Graphically representing package dependenciesapt-cache dotty takes a list of packages on the command line and generates output suitable for use by dotty from the GraphVis package. The result will be a set of nodes and edges representing the relationships between the packages. By default the given packages will trace out all dependent packages which can produce a very large graph. This can be turned off by setting the APT::Cache::GivenOnly option (man apt_preferences). The resulting nodes will have several shapes, normal packages are boxes, pure provides are triangles, mixed provides are diamonds, hexagons are missing packages. Orange boxes mean recursion was stopped [leaf packages], blue lines are pre-depends, green lines are conflicts.
5.1.4. grep-dctrlThe grep-dctrl utility greps Debian control files. The grep-dctrl program can answer such questions as
It is a specialised grep program that is meant for processing any file which has the general format of a Debian package control file, as described in the Debian Packaging Manual. These include the dpkg available file, the dpkg status file, and the Packages files on a distribution medium (such as a Debian CD-ROM or an FTP site carrying Debian). For instance, too see all the packages for a maintainer, do:
For a lot more usage examples, see the grep-dctrl(1) man page. 5.1.5. debfoster and deborphanTools to weed out unnecessary Debian packages. Their use is trivial. For example, to remove all unnecessary packages, you could do:
5.1.6. dpkg-repackdpkg-repack package provides us with a tool to bundle installed packages back into the .deb format. If any changes have been made to the package while it was unpacked (ie, files in /etc modified), the new package would inherit the changes. This utility can make it easy to copy packages from one computer to another, or to recreate packages that are installed on your system, but no longer available elsewhere.
5.1.7. dpkg-divertdpkg-divert overrides a package's version of a file. File diversions are a way of forcing dpkg not to install a file into its location, but to a different location. Diversions can be used through the Debian package scripts to move a file away when it causes a conflict. System administrators can also use it to override some package's configuration file, or whenever some files (which aren't marked as 'conffiles') need to be preserved by dpkg, when installing a newer version of a package which contains those files. I used it in our ttysnoop+ssh setup (see below):
5.1.8. dpkg-statoverridestat overrides are the way to tell dpkg to use a different owner or mode for a file when a package is installed. This can be used to force programs that are normaly setuid to be installed without a setuid flag, or only executable by a certain group. See the dpkg-statoverride(8) man page for details. 5.2. Getting familiar with system messagesIt is very important to learn how does the system communicate with its users (or administrators). One can always find the exact source of the problem and take appropriate actions (simple, proven-to-be-useful tasks help in almost any situation), so this is why the chapter had priority in the final document layout. 5.2.1. Boot messagesDuring the boot, the system kernel prints out a lot of interesting information (unless the quiet option was passed to it). The copy of the messages is saved in the /var/log/dmesg file (which does not grow with time). The dmesg command, however, will show you the last 4 KB of recent kernel messages. 5.2.2. System logging daemonUnix machines have a standardized way for programs, applications and daemons to send messages to the global system logger (syslog). There are many syslog implementations available; with Debian, you can choose betweeen the default traditional BSD sysklogd, syslog-ng and metalog. Each message has an indication of the facility (message source) and severity (importance level). The date, time, host and process information is automatically generated by syslog, and should not be a part of the message itself. The syslog daemon distributes messages to files, pipes, remote destinations or users, using the schema specified in the /etc/syslog.conf file (for the traditional BSD sysklogd). All the logs from a vanilla ("out of the box") Debian system are written to files in the /var/log/ directory.
To collect all system messages (for strictly educational purposes :) in a single file, add a line like this in /etc/syslog.conf:
[TAB is there to warn you that you really have to press the TAB key, spaces don't do it right]. Then create an empty /var/log/allmessages file (choose your favorite, both variants here do the same):
And just reload the sysklogd daemon configuration:
Now go to some idle virtual console, and type (see the tail(1) man page):
Do something to your system (for example, logout, login or use 'su' on another console, and watch messages appear!). This is an excellent way to learn more about the system and how it works. Also, you can detect any anomalies and error reports that would otherwise go unnoticed. If you are writing shell scripts, or modifying your ~/.bash_profile, you can use the 'logger' command to log your messages via syslog.
5.2.3. Logging ppp messagesIt is nice to have all ppp logs go to /var/log/ppp.log; the 'plog' command will then work as expected. The following will add a line to /etc/syslog.conf and restart the syslog daemon (we used the traditional BSD sysklogd in the example):
5.3. The X Window System, basic principles and Debian setup5.3.1. The XFree86 Project, an open-source X Window System implementationFrom www.XFree86.org:
5.3.2. The X Strike Force: XFree86/X Window System support for DebianVisit the X Strike Force homepage. 5.3.3. XFree86 InstallationDebian potato (2.2) is shipped with XFree86 version 3.6.6, while Debian woody (3.0) has XFree86 version 4. See current status at the X Strike Force homepage. X4 brings a lot of improvements and is now standard in Debian. There's not much difference from administration perspective, but notes will be put where appropriate. You can install basic X support, the icewm window manager and the wdm display manager with:
5.3.4. XFree86 Server ConfigurationWhen you install the packages, the configuration process will start automatically. If you don't get it right the first time, you can always re-run configuration with:
The interface is very clean and should help you create working XFree configs in no time. In case of problems, inspect the config file (/etc/X11/XF86Config-4 or /etc/X11/XF86Config) manually to make sure you have the right Driver option, and that UseFBDev option is set to false (these are the most common errors).
5.3.5. Tuning the resolution in XWhen you start X, it picks the default color depth, loads in the list of available resolutions for the given depth, and displays the highest one. You can then cycle over other pre-defined resolutions with Ctrl+Alt+'+' and '-'. All this is set up in /etc/X11/XF86Config-4. Here's an excerpt from the configuration for 16bit colors with default resolution 1024x768:
To explicitly start X with 16bit colors (if there's no DefaultDepth option or it is different), use:
If you want to further experiment with refresh rates and resolutions, either manually tune VertRefresh, HorizSync and Modeline (in X3 only) definitions in X config file, or see OpenBSD's X tuning guidelines. 5.3.6. Device autodetectionTo take advantage of some kind of device autodetection, see the following three programs:
5.3.7. The client-server modelSince X is a client-server based model (as are most other things in Unix), it means you have a whole new domain of features at your disposal. We'll discuss them now.
5.3.8. The Direct Rendering Infrastructure (DRI)Here's a little introduction from the Documentation/Configure.help file (the kernel-doc-* packages):
5.3.9. XFree86 NotesX3 has fewer drivers and you must install specific drivers for specific groups of graphic cards (for example, xserver-rage128, mach32, mach64, i128, 3dlabs, agx, 8514, s3v etc...). In X4, we solve this by only installing xserver-xfree86, which is modular and loads the appropriate modules at runtime. Also, the config file is /etc/X11/XF86Config-4 for X4, and just /etc/X11/XF86Config for old X3. Generally, only use X3 on old machines where you want to save some memory. 5.3.10. Troubleshooting
5.3.11. Window managersNow you have X window system running. Let's make this clear: You need the X server because it knows how to communicate with your hardware and actually display graphics. But that's all it does. How your interface really looks like depends purely on the 'window manager'. If you listened to me, you are probably running icewm now, but there are others (when you install them, they become the default or show up in wdm's login menu). Try wmaker, blackbox, afterstep, xfce or enlightenment. Also try twm and fvwm at least for historical reasons, to understand the Unix folklore ;) If you install GUI environments like Gnome or KDE, you won't have to worry about window managers as they will aready be taken care of. Don't be disappointed by the look of wdm or icewm (tastes difer), you have plenty of other variants to choose; Definitely check out the Window Managers for X website. To get a program which shows you graphical login (so you don't have to log in the console and type startx every time), install package wdm (or any of its relatives; xdm, kdm or gdm). Also, you will be able to select which window manager to use from the wdm's menu. You can also run X without the window manager (usually for testing purposes). Try starting xinit. 5.3.12. Fonts for XFonts you might want are found in xfonts-* packages. Type this command to search for them:
If you are interested in using the Microsoft ttf fonts, there are font servers which can handle them, and I'd recommend you try xfstt. No fonts come with it since they all have non-free licenses. That means you have to get the ttf fonts yourself, copy them to /usr/share/fonts/truetype/, add FontPath “unix/:7101” to /etc/X11/XF86Config, execute /etc/init.d/xfstt restart and then restart X. To browse installed fonts, see the xfontsel and gfontview programs. Also, check out the http://www.linuks.mine.nu/fonts/readme file. Actually, X4 can deal with TrueType fonts directly, you don't need the ttf-enable font server; simply add the ttf FontPath in the X config file. TODO: find the fontpaths for all xfonts- packages and list them here 5.3.13. Gpm (the console mouse driver) and the XFree86You will most probably have problems with gpm and XFree86 running at the same time. The solution would be to set repeat type to 'raw' in gpm's config and mouse device to /dev/gpmdata in X config file, but that doesn't always give usable results. I prefer to shut down gpm. 5.4. Virtual consoles5.4.1. Virtual consoles setup in /etc/inittabAlmost all GNU/Linux distributions ship with predefined 'virtual terminals' - completely separate text screens or consoles which are available with left Alt + F1-F6 keystrokes (only 6 consoles are enabled by default). You can also use the command-line method to switch between them (see the chvt command), and you can open them automatically with the open command. To add more virtual consoles, edit the file/etc/inittab (as the superuser, of course) and add more lines like those:
[You can see which fields have to be incremented]. For changes in that file to take effect, exit the text editor and type init q. If you create more than 12 consoles, you won't be able to access them with left Alt (since the last F key you have is 12), so use right Alt key to reach consoles 13 - 24. You can also use Alt + left_arrow or right_arrow to cycle through open consoles. Alt+print_screen key switches between two last used virtual consoles. If you are switching from X to the console, you need to use Ctrl+Alt, instead of just Alt. The deallocvt command frees memory still associated with virtual terminals which are no longer in use [by applications, not you of course]. This is not so important anymore, since you probably have plenty of ram and few kilobytes mean nothing to you. 5.4.2. VGA fonts sizes in the consoleIf you don't like such big letters in the console, execute this:
This would set up LILO parameters on the next boot (linux vga=ask), and reboot the machine (since vga mode can only be set at boot, unless you mess with 'svgatextmode' package - but don't do that). When you find a nice vga mode, you should edit /etc/lilo.conf and make it permanent there:
[X is replaced with the actual value you like, try '6' for example]. Then, run 'lilo' to apply changes. If you see the penguin in the upper left corner of your screen, you are using a framebuffer (VESA mode). In that case, there are more screen modes available to you, see the table on the Framebuffer HOWTO page. 5.4.3. Font types for the consoleInstall the fonter package and you will be able to edit/create your own fonts, or use some of the standard ones you get:
5.4.4. The console keymapsTo see current keyboard mappings, you would simply do:
After you tune the 'keymap' file to your needs, load it back with the loadkeys command. To see just how advanced the idea of the Linux console is, run the loadkeys program, and type the following in its prompt:
Then just press the F1 key to see the consequences. 5.5. Shutting down the systemSome of the commands you can use:
To reboot:
Sometimes the shutdown -c (shutdown cancelation command) comes handy. You can also use Ctrl+Alt+Del (in the console) to reboot, and this behavior is controlled from /etc/inittab. 5.6. General notes for hardware supportGetting a piece of hardware to work is a fairly easy task (although it wasn't so in the past, so always show the due respect for the developer community). Basically, you have to be able to categorize the hardware and know how the specific devices are usually configured under Debian GNU or Linux.
Debian GNU sports a nice tool for kernel module configuration - the modconf utility. However, the whole story with kernel modules is trivial. You have three basic commands (modprobe, rmmod, lsmod) and a bunch of modules in the /lib/modules/`uname -r` directory to choose from. For instance, to load the driver for a 3Com network card and an onboard AMD VIA audio chip, you would do (so, without modconf):
And to make the modules load at each boot, you'd add them to the /etc/modules file. If you want to use it this way, you must know the module names. Until you get some experience, use modconf.
5.7. Enabling the mouse in text consolesIt is nice to have a mouse working in text consoles; you can copy just by selecting the text, and you can paste with buttons 2 or 3. Install the gpm package and it will automatically ask you for configuration. If you want to delay it, or you don't get it right the first time, you can always re-run the config tool later (it's called gpmconfig). Here's an example for you: for my wheel mouse, I answered this to gpmconfig questions:
Test the config and enjoy. 5.8. Hard disk throughputTo see how good can it be, use the hdparm utility, switch to 'single' mode and test it:
On ~1 Ghz PC machines, you should see cache reads of about 180 MB/sec (although this number has virtually no limit, on newer machines you get 500 MB/sec in a blink), and unbuffered disk I/O of about 30MB/sec on IDE disks (unless you're lucky enough to have those new and shiny 70MB/s IBMs). Things vary, though. If you see poor performance (it can get as low as 2MB/sec), recompile the kernel and test it after that; you'll most probably see enormous improvements. Another great speed improvement comes from enabling DMA, say:
You can add the above command near the end of the /etc/init.d/bootmisc.sh and it will be re-activated on every machine boot (which is what you want). To sum up, unbuffered transfers of 25 MB/sec or more are okay for the traditional PC IDE disks. If you feel lucky, use hdparm and try to fine-tune the hard disk parameters even further; see if it does any good for you. Once you're fine with the performance, remember to adjust the line in /etc/init.d/bootmisc.sh. 5.10. Firewalls5.10.1. What is a firewallThat question would wave made little sense a few years ago (before 1997) but it seems to be a must today, when most computer-related things are just dumbed down and hidden behind graphical interfaces, and children waste their time practicing skills they have no or little use for in the real world. Anyway, on to the subject. Running an Unix machine involves a great deal of responsibility, especially today when people have high-speed Internet connections at their homes; Unix systems don't basically make a difference between physically local and remote users. Anyone who gains access to your machine (especially to privileged accounts) can use it to compromise you and other hosts on your network or attack other Internet sites and cover his tracks. Depending on the type and success of the attack, sometimes the only solace you have is the physical access to the machine and the ability to reinstall it (let alone the backups you didn't make). Therefore, we will now introduce you to firewall software:
This means we will use a firewall to control access to our machine, keeping in mind that we distinguish connections initiated by us, and those initiated by the remote ends.
5.10.2. Firewall setup in Debian GNU/LinuxFree software firewalls have evolved. The old Linux 2.0 kernel series used ipfwadm, 2.2 had ipchains and the current stable 2.4 branch sports the shiny netfilter, sympathized even by those who always preferred BSD systems for that part of the job. The user-space part (for netfilter) is covered by the iptables package, which is a rather low-level interface to the firewall functions so some people (yes, we too) tend to use frontends; I found ferm to be The Frontend. ferm is a 'firewall rule parser for linux designed to maintain and setup complicated firewall rules'. Fair enough.
We will now see what a generic home-firewall setup looks like. The policy we will follow is: drop everything, permit only port 113, manually specified IPs and traffic initiated by our side. You should read ferm man page and the examples in /usr/share/doc/ferm/examples/, but here's my suggestion to get us going:
To make the rules active:
You could also add this command to the /etc/ppp/ip-up script, to have it start automatically, whenever the dialup link goes up. 5.10.3. More protectionUnless you are playing games under Wine or WineX, you could be interested in applying the grsecurity patches to your kernel (see apt-cache search grsec). You could also install the Prelude Hybrid IDS (Intrusion Detection System) on your machines. 5.11. Setting up IP Masquerading/NATMultiple computers can all share the single connection (to the Internet usually) installed on the gateway machine. The procedure to set it up is trivial:
To make client side changes permanent, add 'gateway' option to the /etc/network/interfaces file. Also, make sure the /etc/resolv.conf files on client machines are valid (copy from the main machine would do if you substitute references to 127.0.0.1 with the server's IP as it is seen from the local network).
5.12. System login procedure, the shell startup and config files5.12.1. The system gettyWe've mentioned the /etc/inittab file before. During the system boot, the init process (it always has the PID 1, it's the first process the kernel runs) reads that file and (among other things) initializes the virtual consoles, usually by starting the getty program on them. The system getty opens up a login prompt on the specified consoles and waits for users. When you enter an username and password, your authentication request reaches the PAM layer (Pluggable Authentication Modules), where it gets checked for validity (using the /etc/pam.d/login rules); the check usually includes reading the /etc/passwd, /etc/group and /etc/shadow files and verifying the user's password and expiration dates. Please note that we are talking about the defaults here, the PAM system has endless configuration options, and it wouldn't be hard to make it use the retina scan instead of passwords to authenticate users. The PAM was originally developed at Sun Microsystems, but the Linux people maintain a fairly compatible Linux-PAM tree. For the complete Linux-PAM user, administration and developer manuals, see the PAM documentation at kernel.org FTP site (the documentation is not on www.tldp.org).
5.12.2. The login shellIf the PAM layer gives you a green light, the login program spawns a shell for you (exactly which shell is specified in the last field of your /etc/passwd record). The shell then:
5.13. Regular user accountsIf you are logged in as root, create a new regular user account with the 'adduser' command and reopen this guide in it. To illustrate why using root account for user tasks is strongly discouraged, I will quote a good summary by Debian users on IRC channel #debian@OPN:
If you visit #debian on irc.openprojects.net, and people see you are logged in as root, they will most definitely harass you about it. You should always be logged in as a regular user, and change current user ID (to root) only when necessary, using the 'su' command (or install advanced control mechanisms, such as 'sudo'). 5.14. Switching to root account without a passwordHowever, the problem is that you always have to type in the root password when you want to 'su' to root. To avoid this (that is, to enable 'su'ing to root without a password), edit the /etc/group file, and insert this line (anywhere):
and in /etc/pam.d/su, uncomment this line (remove the # char at the beginning, or copy this line there if you don't have it):
That will allow users named 'username1' and 'username2' to type 'su' and become root without a password. Also, it will allow them to start processes as root on command-by-command basis with su -c '/command/to/execute with arguments'.
5.15. Account login regulationSince most of the accounts on your machine will be used locally by you, you don't want people logging in remotely, do you? (they first need an account password for that, but they might get it easier than you think). Edit file /etc/security/access.conf, read short info there and add something like this to the file:
This denies login to username1 and username2 accounts from all locations except your own machine.
5.16. Tcp wrappersTcp wrappers are a standard part of Debian, and allow you to simply control access to system services (mostly to those started from the inetd meta daemon). If you want to deny all services to remote addresses, make sure the file /etc/hosts.allow is empty, and put this in /etc/hosts.deny:
For more information (including on how to trigger system commands upon incomming requests) read hosts_access(5) and hosts_options(5) man pages.
5.17. Manually unpacking .deb filesFrom time to time you wish to unpack a .deb file to see its contents (or to recover some system files). Fortunately, Debian's .deb files need no special tools to be unpacked, they are simple 'ar' archives containing two files: data.tar.gz and control.tar.gz. Here are some examples:
5.18. Checking the MD5 sums of installed Debian packagesIt is often useful to verify the files on your system, either to detect unauthorized modifications or just to find out which files you once modifed and then forgot about them.
5.19. Shared sessionsTerminal sessions shared by more than one concurrent user can be very useful. On a few occasions, I was asked to remotely tune machines (such as sound card drivers or XFree86 support), and the other party wanted to keep a complete track of my actions (for educational and controlling purposes). It is possible to achieve that effect by using either screen or ttysnoop. 5.19.1. screenUsing screen to make shared sessions is very easy, but it requires both parties to cooperate (so you must trust the other end) and involves shared account passwords (which is a bad thing if it becomes your habbit). All one must do is to login as say, 'username1' (ssh -l username1 localhost) and run 'screen', then wait for the other party to log on to the system (under the same username, of course) and run 'screen -x'. (This tip was provided by electr0n@OPN). 5.19.2. ttysnoopttysnoop is a trivial but very convenient tool that can be used to share, monitor or control user terminals. Enabling ttysnoop on your machine is dangerous; it could violate your security policy or leave the system in an unusable state if not done properly. The ttysnoop itself doesn't need any special setup (except the /etc/snooptab file maybe) if both parties cooperate (one starts the ttysnoops server, and the other starts the ttysnoop client). However, installing it so that the ttysnoops gets started during the login does require a few changes in the system configuration files. We will show here how to replace the system's login binary with ttysnoops and how to enable it for ssh connections. The procedure is delicate, as we said already, so we will comment each line you are about to execute in your shell.
You can test the setup locally (but the same idea applies to remote logins, of course):
When letting people log in remotely to your machine, ssh is strongly-preferred way to connect. Do not even bother with telnet (which is an unencrypted and insecure service). If you have special needs or demand telnet anyway, check out working configurations from the sample /etc/snooptab files. 5.20. Runlevels and system services5.20.1. System boot and the init processThis is a very interesting and important part of every Unix system. In most common scenarios, you have LILO installed as the bootloader. LILO (the LInux LOader) accepts parameters on the command line, but Debian has been configured (in default configuration) not to show the LILO boot prompt. To make it appear, hold the Alt key at the 'LILO' message (during boot, just before you see the 'Loading linux ....' message) and you'll be able to pass arbitrary parameters to kernel. You can type anything there, and it will later be visible in the /proc/cmdline file. After the kernel gets loaded, it starts 'init' as the first system process. Init executes the tasks defined in the /etc/rcS.d directory. Init then enters default runlevel 2 (other Linux distributions mostly use runlevel 3 as the default) and executes the tasks defined in the /etc/rc2.d/ directory. Init directories consist of symbolic links to files in /etc/init.d/; here's an example:
The 'S' prefix starts a service, while 'K' stops it (for the given runlevel). The numbers determine the order in which the scripts are run | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
