# Fedora And Red Hat System Administration/Print version

The current, editable version of this book is available in Wikibooks, the open-content textbooks collection, at
https://en.wikibooks.org/wiki/Fedora_And_Red_Hat_System_Administration

# Shell Basics

From the moment you connect to an SSH session, log into a text console, or open a terminal from a graphical environment, you are interacting with a shell program. To describe it simply, the shell provides your command line. It receives the commands you type and runs programs as needed to service those commands.
Bash, the most popular shell for GNU/Linux systems, is built on ideas going back to the original UNIX shell, the Borne Shell. While the Borne shell was revolutionary for its day, it is rather clunky by today's standards. Concepts like command line editing, command history and job control evolved later in other shells that sought to replace the original Borne shell such as the C shell and the Korn Shell. While these features greatly enhanced shell usability, they also came at the price of breaking compatibility with Borne shell syntax. When the GNU Project designed their shell they chose to implement these new ideas but still maintain compatibility with the original Borne shell. The called their shell the Borne Again Shell, or simply Bash.
The basic ideas for the shell differ little from the original, but command history, commandline editing, and features used in shell scripts are more idiosyncratic.

## Running commands from the shell

Commands at the shell take a basic form of:
(It is common convention to put variables in capitols and square brackets around optional elements. The ellipsis indicates the preceding can be repeated).
The COMMAND can be one of four things:
* A Program - The shell will search your PATH environment variable for programs named COMMAND. Most programs are in /bin or /usr/bin. Documentation for commands are usually found in manual pages (Accessed with `man COMMAND')
* A Shell Built-in - Built-in commands are commands processed directly by the shell such as cd, echo and alias. Documentation for built-ins can be found in the manual page for bash or with the help built-in: `help COMMAND'.
* An alias - Aliases are processed before the command is run and are replaced by another command, possibly adding options or arguments.
* A Function - Functions call a sequence of commands and are more often used in shell scripting than on a typical command line.

### Example Built-in Commands

Some of the simplest commands are Built-ins. echo for example simply prints the arguments passed to it:
The pwd built-in prints the working directory; cd changes the working directory. (We'll define "working directory" later when we discuss filesystem basics).
The help built-in provides documentation on built-ins. Without arguments it gives a list of built-ins. With Arguments, help can provide details on a particular built-in command:

### Example Program Commands

Most commands you'll use are programs. That is, they are a separate program run in a separate process from the bash shell. These programs can be found in a number of locations on the system. The directories searched are specified in the PATH environment variable, but more on that later. Most programs are found in either the /bin or /usr/bin directories and we'll focus on those for now.
If I want to get a listing of files in a directory I would use the ls command. The actual program that runs when you type "ls" is found at /bin/ls. If called without arguments, ls will give a listing of files in the current directory. An argument can be used to tell it which directory to list. Options can be used to tell it how to list the files:
Notice the option string "-lt". The "l" specifies a "long" listing while the "t" specifies that the entries should be sorted by modification time. These are single character options and could have been specified separately as "-l -t", but they are usually grouped together like this.
It is customary to put options before arguments such as in the command "ls -l /home". With GNU utilities this is optional, but some utilities will complain if any options appear after the same argument. (There is no distinction between option and argument to the shell or the operating system. When the command is executed by the kernel, they are all arguments and it is up to the program to interpret them).

### Example Running Command as Root User

If you are a user which is not root and you need to install or run a command which requires admin credentials then just do the following:
It's that's easy.
If you are a user and want to list the IP address of the machine you can use sudo command, for now lets imagine you are allowed to use sudo command
Similarly you can use sudo to run any superuser command

# The X Window System

The X window system or X11 is most basic component of the graphical environment. You can find many implementations of X11 including servers for Max OSX and Windows (Please insert recommendations!). Most GNU/Linux distributions now use X.Org's implementation (which forked not too long ago from the XFree86 project).

## Starting X
### Graphical Login and GDM

Most functions of your users graphical experience is actually not handled by X, but rather by the Graphical login managers, such as the Gnome Display Manager(GDM). While other display managers exist, Red Hat and fedora based systems use the Gnome Display Manager as the login manager for their systems.

### The X command

In comparison to Graphical Managers such as GDM, "X" contains extremely minimal functionality on its own, but each graphical display manager is actually built atop X, and thus X is important to understand in its own right.
The 'X' window system is:
* a client-server application
* The client is the application using the X-window
* The server controls the keyboard and screen and takes signals from the application and responds with output to display on the screen
* A protocol used by the application to connect to the server
** the 'X' protocol, also known as X11
To start X, one has

### The X startup scripts
## Remote X access with SSH
### /etc/ssh/sshd_config
## VNC
### Starting a VNC Server

vncserver :1

### Securing your VNC connection
## Further reading

* Guide to X11
* Internet Technologies/VNC

# Archives And Compression
## Compressing Data
#### gzip and gunzip

Under Construction

#### bzip2 and bunzip2

Under Construction

## tar - *NIX Archives

Under Construction

#### Creating a tar archive

To create an uncompressed tar archive, the c and f options are provided (think 'c' for create and 'f' for filename):
[user@station user]$ tar cf foo.tar file1 file2 file3
The first argument is the name of the archive, in this case foo.tar. Any following arguments are the files that are being archived (e.g. file1 file2 file3). Usually globbing is used to archive all files of a particular type (e.g. tar cf foo.tar *.cpp will archive all of the .cpp files in the current directory):
To archive all files and subdirectories within a directory, the same options are provided, but the second argument is the . character which symbolizes the current working directory:
[user@station user]$ tar cf foo.tar .
To compress the contents of the archive one of the z, J, or j options are used. Each option corresponds to a different compression algorithm, which in order are: gzip, xz, and bzip2.
For example, to create a gzip compressed archive of the current directory the following would be run:
[user@station user]$ tar cfz foo.tar.gz .

#### Inspecting a tar archive

Under Construction

#### Extracting a tar archive

Under Construction

## cpio - Flexible Archiving Tool

In general, tar is the preferred method for creating archives, but in some cases a particular archive format may be desired and cpio provides a greater degree of control over how the archive is generated at the cost of greater complexity.

#### Creating a cpio archive

To create a cpio archive, the -o option is provided (think 'o' for "The archive is being written out"). cpio expects a list of files to be provided to its standard input. The list of files is usually provided by piping results from the find command. The -H option can be used to specify the archive format, see the man page for more information.

#### Listing contents of an archive with cpio

To view the contents of an archive the -i option is provided to tell cpio to expect the archive data on its standard input. The -t option is also used then to tell cpio to not extract, but rather simply list the contents of the archive.

#### Extracting an archive with cpio

The -i option is used with a combination of options to tell it how to extract. Common choices include -d to tell cpio to create directories as needed. -m to reset file modification times. -R to change file ownership.

## dump - Filesystem Level Backup

Under Construction

# Finding And Checking Files
## Finding files with dangerous permissions
#### Files that are writable by "other"

If we search just based on permission, we'll get false hits from things like symbolic links.
Instead look for files with other write enabled that are regular files.

#### Directories that are writable by "other"

When searching for directories that are writeable by other, one should also consider whether the "sticky bit" is set for the directory. In octal, the sticky bit is represented as a 1 in the first position in four digit octal representation (ex: 1777). This is a common setting for temporary directories and is not normally considered a security risk.
World writable temporary directories:
Finding the real problem directories:
[user@station user]$ find / -perm -002 -not -perm -1000 -type d -ls 2>/dev/null

#### SUID and SGID executables

SUID and SGID executables can present serious security concerns since they allow users to execute programs with permissions of another user. For this reason they should be closely monitored. SUID is represented as 4 in the first position and SGID, by a 2.

## md5sum

The md5sum command produces a checksum for a file that can be used later to check whether the file's contents have changed.
This is often used when downloading files from possibly untrustworthy mirrors. So long as a trusted checksum can be obtained, it can be used to verify that the data wasn't corrupted whether accidentally or maliciously. Often checksum files are distributed with downloads or kept on secure media to check systems for possible data corruption or intrusion. To create an MD5 checksum file, simply redirect the md5sum output to a file. md5sum -c can then be used to run the check later.

#### Finding and Checking SUID and SGID executables
# Bash Scripting

< Fedora And Red Hat System Administration

## Basics
#### Handling Arguments

This program will display all arguments:

## Example Scripts
#### Setting Environment Variable
#### Connecting via ssh using keys
# Awk Scripting
## Awk - A Data Driven Programming Language

Under Construction

## Using Awk at the Command Line

Under Construction

## Awk Scripts
#### Parsing User Information from passwd data

/usr/local/bin/bash-users.awk
Usage:

# Filesystem Mangement
## Partition Management

A partition is a place on disk which contains
at the fdisk prompt: n - create a new partition e - create an extended partition p - will print the table

#### Overview of Partitions

Using Radified's analogy, a partition is like

#### Creating a partition
##### Using the fdisk utility

"fdisk -l" ---> listed fdisk -l

##### the Mkfs Command

mkfs, then hit the tab key twice gives you a list mkfs -t * which equals mkfs.*
so mkfs.reiserfs equals mkfs -t reiserfs
VFAT filesystem - tends to be used for usb mkfs -b ----> mkfs -t every partition has
4k is what you want -> optimized for speed rat mkfs -f [fragment size] fdisk -> enters the interactive prompt w - write n - new m - manual +100m - creates a partition q - quit the command "q" will quit fdisk. if you exit with "q" rather than "w"
1000 bytes is kb 1024 bytes is a kib "kibibytes"
running the command "cat /proc/partitions" looking at the file /proc/partitions will tell you what block devices the kernel knows about partprobe - speaks to a higher level of the kernel
it is a good idea to check with "partprobe" if the kernel agrees with our partitions

#### Inodes

Metadata is stored in the inode
we have goto our filesystem formatted
ctime - when was the inode created mtime - when was the inode last modified
ext2 had to make sure it assigns them to the correct filesystem - tune2fs -l /dev/xvda1
dumpe2fs /dev/xvda1 holding

##### = Mounting the file system

if something is to show up on the desktop, then it will show up as mnt
if we "touch /home/share/unmounted"
the command to mount the
every directory has an inode for the current directory ( in the . entry)
dump e2fs will tell us if

## Filesystems
#### ext2 and ext3

ext3 is the ext2 filesystem with journaling added. Journaling keeps track of what will be written to the disk prior to the write operation beginning. When the write is done, it is noted in the journal. If the system crashes during a write, it can recover the operation when it comes back up. This prevents incomplete writes from occurring on the disk and eliminates the need to do a filesystem check after a system crash.

#### jfs

JFS is a high a performance filesystem made by IBM and ported to Linux in 2001. It uses B+ trees,extents, and a journal to guarantee the consistency of the file system in the event of a crash.

#### reiserfs
## AutoFS - Automounting

AutoFS allows the system to automatically mount devices and network shares as they are requested and even unmount them again when no longer in use. The main configuration for the automounter is /etc/auto.master. Initially, this file will only contain comments, including examples for a /etc/auto.misc and /etc/auto.net.

#### The /net Example
# Working with repositories
## Repositories of extra software

Fedora Core only includes a core set of packages. For downloading and installing programs or codecs not distributed with Core, there are several repositories available. Packages are generally compatible between third-party repositories, though this has not always been the case. There are also occasional overlaps or packaging errors that cause one package to negatively affect packages distributed from different repositories.

### Official repositories

Fedora Core, Fedora Extras and Fedora Legacy are official repositories in this project. Fedora Core is maintained by Red Hat. Fedora Extras is maintained by a group of volunteers and affiliated with the official Fedora Project. Fedora Extras is currently included in the base distribution as a default repository and no extra configuration is required to enable it. Fedora Legacy repository is also included in Fedora Core 5 and above versions but it is not enabled by default.

### Unofficial repositories

These repositories are designed to be compatible with Fedora Core although they may not be compatible with each other. Some of the repositories have discontinued active support for earlier versions of Fedora Core but keep the repositories around for the convenience of users with previous versions.
* Livna, a third-party repository maintained by a group of packagers, supporting Fedora Core 5 through 14 (as of June 2010). Since it merged in 2008 with two other package repositories into RPM Fusion, it contains just the libdvdcss-1.2.10-1 package.
    (Must use with Extras. Not compatible with RPMForge repositories.)
* RPMforge, containing the packages of Matthias Saou, Dag Wieers and Dries that were previously available in three different repositories, supporting Fedora Core 1 through 5. RPMforge is compatible with Fedora Extras, similar to Livna.
** FreshRPMS, maintained by Matthias Saou, supporting Fedora Core 1 through 6
** Dag, maintained by Dag Wieers, supporting Fedora Core 1 through 3
** Dries, maintained by Dries Verachtert, supporting Fedora Core 1 through 6
** PlanetCCRMA, maintained by Fernando Lopez-Lezcano, supporting Fedora Core 1 through 5
* kde-redhat, Excellent source for KDE support in Fedora Core maintained by a group of packagers that support Fedora Core. Has updated KDE desktop RPMS, general KDE applications such as Bluetooth support.
* The Grey Sector, containing mostly MPlayer related packages and binary packaged codecs (which have some legal issues). The repository is maintained by the MPlayer developer.
* fedora-xgl, containing packages required to enable Xgl on Fedora.
* dribble, containing packages with a focus on fun software (multimedia, games, emulators). It is recommended that this repository be used with Livna.
* ATrpms, maintained by Axel Thimm and supporting Fedora Core 1 through 6.
   * Updates base packages ahead of Core. Some administrators consider it a bad idea to update base packages outside of their official channel.
   * ATrpms is also used extensively by Fedora Myth(TV)ology - a popular how-to resource for installing MythTV on Fedora Core, maintained by Jarod Wilson.

## Legal status

Fedora Core, Fedora Extras and Fedora Legacy projects follow the same packaging guidelines in the Fedora project, and they all only maintain packages that are Free, open source software and legally distributable anywhere in the world. Other repositories may have different policies. For example, the Livna project maintains packages that may have legal issues within the United States or can be downloaded only by the end user.
Some repositories also maintain "source-only" packages that require the user to download pre-built binaries that may not be available to the public. The package script then unpacks and repacks the binaries in a format more suitable for deployment on RPM-based systems.

## Software update utilities

The main tool to install software from repositories is the command yum. A graphical tool called pirut (available in the upper menu bar with the name "Package Manager") is, together with the update program pup ("Package Update"), part of the standard installation since Fedora Core 5. Since FC6, a new mechanism for updates was added, based on a daemon called yum-updatesd that scans the repositories, and a notification applet called puplet that notifies the user about the new updates.
In addition to these standard tools, two graphical alternatives - Yumex [9] and Synaptic - are also available, in Extras. There is also Kyum, which provides a graphical frontend for KDE users.
By default, Fedora Core downloads software (including updates) from a randomly-selected mirror. It is possible to install directly from the Fedora Core CDs or DVD, but this requires changes to yum's configuration files (See off-line repositories below). Altering the configuration in this way is also useful when setting up a local mirror (for example on a company intranet), so that downloads can be obtained from there without having to access a mirror on the Internet.
Up until Fedora Core 4, maintainers of some of the extra repositories advocated the use of apt-rpm for update management - being written in C, it uses fewer CPU cycles and is therefore suitable for older computers with slower processors. For Fedora Core 5, a new version of apt is included in Extras which is capable of using native yum metadata and is multi-lib capable. [6]
Another useful tool to work with repositories is Fedora Helper [10]. It installs and configures the "missing codecs" - MP3 support, for example. It uses the rpm.livna.org repository. Another tool that helps when using different repositories together is Fedora Frog.[11]

## Off-line repositories

If a machine needs to be updated that is not connected to the network, a repository can be created and updated from there. To create such a portable repository do [7]:
* make the directories ./yum, ./yum/base and ./yum/updates. (if you want your local apache to serve as repository of your intranet, do it inside /var/www/html)
* copy all RPMs of your distribution inside ./base
* create the headers of the packets with the command createrepo ./base (use /var/www/html/yum/base if you did set it for Apache)
* download the updates. To do that, look for a real mirror (there is a list of them here [8]) and rsync with it to pick up changes (they will be stored in the ./updates repository). To rsync use the command rsync -avrt rsync://repository --exclude=debug/ /your-path/yum/updates
To use the off-line repository from a computer you only have to include in the /etc/yum/repos.d directory an entry (a *.repo file like the others already in /etc/yum/repos.d) specifying the path to the repository. You can use ftp, http or a mounted filesystem. In the latter case the repository path should start with "file://".

## References

* ↑ FreshRPMs mailing list: (non-)compatibility of repositories
* ↑ Livna's maintainers have a policy to not work together with other 3rd party repositories or at least they had this policy when Fedora Extras was Fedora.us
* ↑ Matthias Saou explains the compatibility issues between FreshRPMs and Livna
* ↑ FreshRPMS, PlanetCCRMA, Dries and DAG (RPMforge.net) build their packages together from the same sources. This ensures much greater cooperation and compatibility and will eventually lead to a merger.
* ↑ "RPMforge: Frequently Asked Questions". Retrieved 2006-07-28.