In other words : Why do many programs that are configured via /etc/myProgram.conf also allow/suggest to store their configuration into /etc/myProgram.d/myConfFile.conf ?
if /etc/myProgram.d/ is a directory { include /etc/myProgram.d/*.conf }This means, whether you configure myProgram via its main configuration file or with file(s) from its .d/ directory, nobody will be forgotten.
68K /var/log/lastlog
68K /var/log/lastlog
By default, /etc/resolv.conf is managed dynamically by various network service daemons. This is intended for laptops and other highly mobile systems which may connect to different networks. This is why trying to change it manually doesn't work.
Several solutions exist to workaround this behavior : Configuring /etc/resolv.conf.
#include and #includedir lines are NOT commented : they use the C pre-processor-like #include syntax (which is extremely misleading, source). sudo 1.9.1 introduced the less confusing @include and @includedir directives.sudoUser SUDOHOST=(sudoRunAs) sudoCommand sudoOptionSUDOHOST is a string of uppercase letters, numbers and underscores starting with an uppercase letter (source).
stuart ALL=(kevin) /usr/bin/vi
means that Stuart can run /usr/bin/vi on any machine as Kevin. This is equivalent to :stuart@localhost:~$ sudo -u kevin vi anyFile
bob MYSERVER=(root) /usr/bin/nmapThis way, Bob will have to enter his own password to run nmap.
bob MYSERVER=(root) NOPASSWD:/usr/bin/nmap
User_Alias :
!), ... : Runas_Alias : refer to users (similar grammar than User_Alias) to "run commands as"Host_Alias :
Cmnd_Alias :
: (source) :
Alias_Type NAME = item1, item2, item3 : NAME = item4, item5
: found in Cmnd_Alias definitions must be escaped with a \Host_Alias myServer = 10.2.0.188 User_Alias APP_DEVELOPPER = stuart Cmnd_Alias IMPORT_DATA = /path/to/script/importData * APP_DEVELOPPER myServer = (root)NOPASSWD: IMPORT_DATA User_Alias OTHER_USER = kevin Cmnd_Alias DO_SOME_STUFF = /path/to/scriptThatGetsThingsDone * Cmnd_Alias RUN_SQL = /path/to/script.sql * OTHER_USER myServer = (root)NOPASSWD: RUN_SQL, (root)NOPASSWD: DO_SOME_STUFF Runas_Alias DATA_EXTRACTOR = stuart see note below Cmnd_Alias EXTRACT_DATA = /path/to/scripts/extract.sh * OTHER_USER myServer = (DATA_EXTRACTOR)NOPASSWD: EXTRACT_DATA APP_DEVELOPPER myServer = (DATA_EXTRACTOR)NOPASSWD: EXTRACT_DATA
User stuart may run the following commands on this host: (root) NOPASSWD: /path/to/script/importData * (root) NOPASSWD: /path/to/script.sql * (stuart) NOPASSWD: /path/to/scripts/extract.sh *
https://askubuntu.com/questions/334318/sudoers-file-enable-nopasswd-for-user-all-commands for a single user : myuser ALL=(ALL) NOPASSWD: ALL for a group : %sudo ALL=(ALL) NOPASSWD: ALL http://www.ducea.com/2006/06/18/linux-tips-password-usage-in-sudo-passwd-nopasswd/
Defaults insults
Defaults\tinsults" >> /etc/sudoers
This is a work in progress on a topic not (yet) clear to me.
WHERE MOUNT OPTIONS COME FROM FOR THE ROOT FILESYSTEM '/' : - mount options are not read from /etc/fstab since this file not available yet at boot time. '/' mount options are passed via the kernel boot options (http://man7.org/linux/man-pages/man7/bootparam.7.html) - some sources suggest that SYSTEMD reads '/' mount options from /etc/fstab to prepare boot options parameters (??? not clear ???) ==========================================8<========================================================= https://www.suse.com/support/kb/doc/?id=7016840 the mount option(s) have to be specified on the kernel command line, via the grub2 bootloader. While SUSE is in the process of developing a final fix for this, a workaround would be to: Edit the grub2 boot loader config at /etc/default/grub and add the: rootflags= option with the file system flag added to the GRUB_CMDLINE_LINUX_DEFAULT="" variable, for example: GRUB_CMDLINE_LINUX_DEFAULT="rootflags=discard" ==> then "update-grub" ? The systemd fstab generator, used to mount the root filesystem, only takes into account the mount options specified in the kernel command line through the "rootflags=" variable. If this variable is not specified, the root filesystem is mounted firstly with the default mount options and then remounted with the options specified in /etc/fstab. ==========================================8<========================================================= BOOT ARGUMENTS http://www.tldp.org/HOWTO/BootPrompt-HOWTO-3.html#ss3.1 ==========================================8<========================================================= How does a kernel mount the root partition? https://unix.stackexchange.com/questions/9944/how-does-a-kernel-mount-the-root-partition#answer-18055 https://unix.stackexchange.com/questions/9944/how-does-a-kernel-mount-the-root-partition#answer-9962 The kernel can accept command line arguments like any other program. GRUB, or most other bootloaders can accept command line arguments as user input, or store them and make various combinations of command line arguments available via a menu. The bootloader passes the command line arguments to the kernel when it loads it (I don't know the name or mechanics of this convention but it's probably similar to how an application receives command line arguments from a calling process in a running kernel). One of those command line options is root, where you can specify the root filesystem, i.e. root=/dev/sda1. ==========================================8<========================================================= SYSTEMD systemctl list-units -.mount loaded active mounted Root Mount boot.mount loaded active mounted /boot systemctl status -- -.mount ● -.mount - Root Mount Loaded: loaded (/etc/fstab; generated; vendor preset: enabled) Active: active (mounted) since Mon 2017-11-27 08:26:54 CET; 4 days ago Where: / What: /dev/mapper/caramba--vg-root Docs: man:fstab(5) man:systemd-fstab-generator(8) Tasks: 0 (limit: 4915) CGroup: /system.slice/-.mount systemctl show -- -.mount Where=/ What=/dev/mapper/caramba--vg-root Options=rw,relatime,errors=remount-ro,data=ordered Type=ext4 TimeoutUSec=1min 30s ControlPID=0 DirectoryMode=0755 ... systemctl list-unit-files -- -.mount https://www.freedesktop.org/software/systemd/man/systemd.mount.html https://en.wikipedia.org/wiki/Linux_startup_process#systemd ==========================================8<========================================================= FLAGS : http://man7.org/linux/man-pages/man7/bootparam.7.html 'rootflags=...' This parameter sets the mount option string for the root filesystem (see also fstab(5)). ==========================================8<========================================================= https://unix.stackexchange.com/questions/92720/does-initramfs-use-etc-fstab THE BOOT PROCESS : bios MBR / whatever boot loader (grub2) load the kernel (initrd / initramfs) is instructed who's '/' with the 'root=...' boot parameter may have additional parameters (such as 'rootflags') kernel mounts / read-only start /sbin/init (or systemd ?) one of the 'init' jobs reads /etc/fstab and "mount -o remount,rw /"
: :
dba:x:1000:oracle
Each line has the following format :
x,By default, /etc/group has 644 permissions.
$ ll -rw------- 1 stuart 1000 22K Jul 2 15:06 myFile numerical GID only drwx------ 2 stuart 1000 1.0K Jul 2 10:40 myDir $ id uid=1000(stuart) gid=1000 groups=1000,24,25,27,29,30,44,46,102,108,111,116,123,998,999 numerical GIDs again
$ ll -rw------- 1 stuart developers 22K Jul 2 15:06 myFile group names are back drwx------ 2 stuart developers 1.0K Jul 2 10:40 myDir $ id uid=1000(stuart) gid=1000(developers) groups=1000(developers),24(cdrom),25(floppy),27(sudo),29(audio),30(dip),44(video),46(plugdev),102(systemd-journal),108(netdev),111(scanner),116(bluetooth),123(lpadmin),998(docker),999(vboxsf)
total 0 lrwx------ 1 root root 64 nov. 2 09:19 0 -> /dev/null lrwx------ 1 root root 64 nov. 2 09:19 1 -> /dev/null lrwx------ 1 root root 64 nov. 2 09:19 2 -> /dev/null lr-x------ 1 root root 64 nov. 2 09:19 3 -> socket:[145565953] l-wx------ 1 root root 64 nov. 2 09:19 4 -> /dev/ptmx lrwx------ 1 root root 64 nov. 2 09:19 5 -> socket:[145565284]What does socket:[145565953] refer to ?
netstat -laputen | grep 145565953
tcp 0 64 192.168.1.101:22 a.b.c.d:7840 ESTABLISHED 0 145565953 26207/sshd: bob
Bob is using an SSH connection from a.b.c.d:7840 to this host.
sl local_address rem_address st tx_queue rx_queue tr tm->when retrnsmt uid timeout inode
8: 6501A8C0:0016 xxxxxxxx:1EA0 01 00000110:00000000 01:0000001B 00000000 0 0 145565953 4 ffff8801172c9240 29 4 29 10 -1
22 7840
| Number | Parameter | Usage |
|---|---|---|
| 1 | device | This can be specified as a device name (/dev/sdb1), or using the device ID returned by blkid (UUID=5FF1-07D3)
|
| 2 | mount point | |
| 3 | filesystem type |
|
| 4 | options |
|
| 5 | dump | Boolean allowing the filesystem to be backuped by dump. The root partition "/" is usually set to 1, and others to 0. 0 or nothing means it is not backuped. |
| 6 | pass | A number telling the order in which the filesystems should be checked at reboot time by fsck :
|
:, and are :
x in this field means the password is stored in /etc/shadow.
---------- 1 root shadow 1633 Nov 29 09:21 /etc/shadowThe idea behind this is
: :
$id$salt$hashed, with :
The safe way to edit this file is with vipw.
crypt (for instance ! or *), the user will not be able to use a unix password to log in (but the user may log in the system by other means).::), in which case no passwords are required to authenticate as the specified login name. However, some applications which read /etc/shadow may decide not to permit any access at all if the password field is empty.!) means that the password is locked. The remaining characters on the line represent the password field before the password was locked.Commands below must be run as root .
/etc/passwd:bob:x:1001:1001::/home/bob:/bin/sh /etc/shadow:bob:!:16679:0:99999:7:::The
x in /etc/passwd indicates the password is stored in /etc/shadow.!./etc/passwd:bob:x:1001:1001::/home/bob:/bin/sh /etc/shadow:bob::16679:0:99999:7:::Now the
! is gone, I still can't su bob, but I can log in as Bob without being prompted for a password.
! :bob:!:16679:0:99999:7::: bob:!!:16679:0:99999:7::: bob:*:16679:0:99999:7::: bob:foo:16679:0:99999:7:::Gives the same result : can not log in, can not su bob.
/etc/passwd:bob:x:1001:1001::/home/bob:/bin/sh /etc/shadow:bob:$6$b3AMx8c1$6DF/Ux9qhlOQSPdC0WNycWK3DYQ7tfsBgWLG74qtpW/ZO39fInB6jnTUF0alL8oH0Z7bF62BiOJ8wkNi1UEqQ/:16679:0:99999:7:::Finally : a password !
/etc/passwd:bob:x:1001:1001::/home/bob:/bin/sh /etc/shadow:bob:!$6$b3AMx8c1$6DF/Ux9qhlOQSPdC0WNycWK3DYQ7tfsBgWLG74qtpW/ZO39fInB6jnTUF0alL8oH0Z7bF62BiOJ8wkNi1UEqQ/:16679:0:99999:7:::The password now has a leading
! showing it is locked.
:: (empty password field) : no password required to authenticate! or !! or * or any string : can not log in with password, but other means may work!any string : the password is locked. Can not log in with password, but other means may workDon't forget to delete the insecure account Bob we've created to experiment :
(should return nothing)
the always full device: a special file that always returns the No space left on device error on writing; usually used when testing the behaviour of a program when it encounters a "disk full" error (details : 1, 2)
Please send complaints to Dave NULL.)
0x00) as are read from itblacklist may be specified to forbid loading a specific module (source)For even more details : man hier