Gqqnbig's questions

I implemented a pluggable authentication module (PAM) called checkConnections.

I initially put this executable in /usr/local/sbin/ because Filesystem Hierarchy Standard says locally installed system tools go to this place. Thus the executable is used like this

session required pam_exec.so stdout /usr/local/sbin/checkConnections 10

This works fine but regular users are able to see this executable through tab-completion because /etc/environment adds /usr/local/sbin to PATH.

My goal is that my system administration tools shall not pollute regular users' views. They by default shall not see my system administration tools.

I was thinking to remove sbin folders from /etc/environment, but https://askubuntu.com/a/866169/703866 recommends against that.

At least you should not remove any of the important paths like /bin, /sbin, /usr/bin and /usr/sbin from it.

If I put checkConnections to somewhere else, I don't know what's the best or standard place.

Please advise.

I want to prevent interactive and non-interactive ssh login based on a conditional logic. I need to test the username and give an error message.

People using sftp (non-interactive ssh) should also be subject to the luckness test.

How would I implement that? I have full control of the system.

I tried to use sshd ForceCommand, but according to https://stackoverflow.com/a/33714333/746461 it does not work for notty.

I'm not familiar with PAM and I doubt if PAM can output custom error message in case the login is interactive.

https://linuxhint.com/understanding_bash_shell_configuration_startup/ says non-interactive login shell with --noprofile option can bypass all bash config files. That's why I can't write my logic there.

$ date
Tue 25 May 2021 12:31:56 PM CST
$ systemctl list-timers
NEXT                        LEFT          LAST                        PASSED        UNIT                         ACTIVATES
Tue 2021-05-25 16:39:00 CST 6min left     Tue 2021-05-25 16:09:05 CST 23min ago     phpsessionclean.timer        phpsessionclean.service
Tue 2021-05-25 18:12:30 CST 1h 40min left Tue 2021-05-25 11:39:43 CST 4h 52min ago  fwupd-refresh.timer          fwupd-refresh.service
Wed 2021-05-26 00:00:00 CST 7h left       Tue 2021-05-25 00:00:09 CST 16h ago       logrotate.timer              logrotate.service
Wed 2021-05-26 00:00:00 CST 7h left       Tue 2021-05-25 00:00:09 CST 16h ago       man-db.timer                 man-db.service

It's not clear whether CST refers to Cuba timezone, Cameroon timezome, or US Central timezone.

Is it possible for my Linux to spell out the full name of the timezone or use the format of UTC-x?

I have two servers, a and b. When I login to a, then ssh to b, I don't want to enter password for sudo commands.

On b, I set if the host is 172.25.9.13, sudo requires no password.

gqqnbig@b:~$ sudo cat /etc/sudoers.d/cluster-create-user
%sudo 172.25.9.13=(ALL) NOPASSWD: ALL
gqqnbig@b:~$ sudo cat /etc/sudoers
#
# This file MUST be edited with the 'visudo' command as root.
#
# Please consider adding local content in /etc/sudoers.d/ instead of
# directly modifying this file.
#
# See the man page for details on how to write a sudoers file.
#
Defaults        env_reset
Defaults        mail_badpass
Defaults        secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/bin"

# Host alias specification

# User alias specification

# Cmnd alias specification

# User privilege specification
root    ALL=(ALL:ALL) ALL

# Members of the admin group may gain root privileges
%admin ALL=(ALL) ALL

# Allow members of group sudo to execute any command
%sudo ALL=(ALL:ALL) ALL

# Limit members of group sudo to execute any command, except
test ALL=ALL, !/bin/su

# See sudoers(5) for more information on "#include" directives:

#includedir /etc/sudoers.d

Now I log in to a, make sure the IP of a is 172.25.9.13. Then I ssh to b. However, sudo on b still requires password.

gqqnbig@a:~$ ifconfig
eno1: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 172.25.9.13  netmask 255.255.255.0  broadcast 172.25.9.255
        inet6 fe80::3648:edff:fef9:9c1c  prefixlen 64  scopeid 0x20<link>
        ether 34:48:ed:f9:9c:1c  txqueuelen 1000  (Ethernet)
        RX packets 492366  bytes 127428889 (127.4 MB)
        RX errors 0  dropped 212004  overruns 0  frame 0
        TX packets 133728  bytes 21062341 (21.0 MB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0
        device interrupt 33

lo: flags=73<UP,LOOPBACK,RUNNING>  mtu 65536
        inet 127.0.0.1  netmask 255.0.0.0
        inet6 ::1  prefixlen 128  scopeid 0x10<host>
        loop  txqueuelen 1000  (Local Loopback)
        RX packets 2865  bytes 266771 (266.7 KB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 2865  bytes 266771 (266.7 KB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0


gqqnbig@a:~$ ssh b
...
Last login: Tue Mar  2 11:15:57 2021 from 172.28.80.67
gqqnbig@b:~$ sudo mkdir
[sudo] password for gqqnbig:

Why doesn't the IP rule work? How do I debug it?

I insert block rules using this kind of statements

sudo ufw insert 1 deny log from 45.136.228.230/24

I have a few hundreds of such deny-log rules.

ufw will block the IP and log the event. However, another feature that comes with ufw logging low is that ufw will also log packets not matching the defined policy.

I want to separate or differentiate the ones I explicitly set as deny log from the ones because of unmatching.

--log-prefix in /etc/ufw/user.rules looks promising, but once I add new rules to ufw through the ufw interface, my modifications on user.rules are lost.

How do I set up so that for each entry in ufw.log, I can quickly tell if it's blocked by my deny-log rules or because of not matching the defined policy?

I know the password of gqqtest as I can login via ssh.

> psftp [email protected]
Using username "gqqtest".
[email protected]'s password:
Remote working directory is /home/gqqtest

Now I use another account to login, and once in Ubuntu, I use su to switch to gqqtest.

[email protected]:~$ su - gqqtest
Password:
su: Authentication failure
[email protected]:~$ sudo su - gqqtest
[sudo] password for gqq:
[email protected]:~$ exit
logout

Just to verify, I tried sudo su - gqqtest and succeeded.

Why doesn't su allow me to switch to non-root even with correct password?

I searched here and there, eg. Why does su fail with "authentication error"?, they are all dealing with root or empty password.

$ type -a su; stat $(command -v su)
su is /usr/bin/su
su is /bin/su
  File: /usr/bin/su
  Size: 67816           Blocks: 136        IO Block: 4096   regular file
Device: fd00h/64768d    Inode: 4200703     Links: 1
Access: (0754/-rwxr-xr--)  Uid: (    0/    root)   Gid: ( 1123/   wheel)
Access: 2021-02-02 15:53:54.794314648 +0800
Modify: 2020-07-21 15:49:28.000000000 +0800
Change: 2021-02-02 15:53:02.314466458 +0800
 Birth: -

$ sudo fdisk -l
Disk /dev/loop0: 54.98 MiB, 57626624 bytes, 112552 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes


Disk /dev/loop1: 71.28 MiB, 74735616 bytes, 145968 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes


Disk /dev/loop2: 29.9 MiB, 31334400 bytes, 61200 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes


Disk /dev/sda: 14.99 GiB, 16072572928 bytes, 31391744 sectors
Disk model: IDSDM
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disklabel type: gpt
Disk identifier: C1D9C783-625F-47BA-8BA0-8B78019F9DCC

Device       Start      End  Sectors  Size Type
/dev/sda1     2048  1050623  1048576  512M EFI System
/dev/sda2  1050624  3147775  2097152    1G Linux filesystem
/dev/sda3  3147776 31389695 28241920 13.5G Linux filesystem


Disk /dev/mapper/ubuntu--vg-ubuntu--lv: 13.48 GiB, 14457765888 bytes, 28237824 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes

I connect to a blackbox machine my friend gave me, so I want to check disk information.

Does the above command say there is only 1 physical disk with space only 14.99G? I hardly believe nowadays there is any disk with 14.99G space.

What is "/dev/mapper/ubuntu--vg--root"? says ubuntu--vg-ubuntu--lv is something managed by lvm2.

Does it mean this blackbox machine has a second disk whose size is again amazing small at 13.48G?

I'm running a software listening port 31731. My client side software can connect to port 31731 on my server. Online port scan tool also confirms the port is open.

However, I check ufw status. The default rule is deny all incoming, and there is no rule allowing 31731.

~$ sudo ufw status verbose
Status: active
Logging: on (low)
Default: deny (incoming), allow (outgoing), deny (routed)
New profiles: skip

To                         Action      From
--                         ------      ----
Anywhere                   DENY IN     83.237.17.0/24
Anywhere                   DENY IN     45.77.149.0/24
Anywhere                   DENY IN     178.159.37.0/24
Anywhere                   DENY IN     37.115.223.0/24
Anywhere                   DENY IN     207.180.255.0/24
Anywhere                   DENY IN     42.117.48.0/24
Anywhere                   DENY IN     213.152.162.0/24
Anywhere                   DENY IN     5.227.15.0/24
22/tcp                     ALLOW IN    Anywhere
22                         ALLOW IN    Anywhere
80/tcp                     ALLOW IN    Anywhere
443/tcp                    ALLOW IN    Anywhere
123/udp                    ALLOW IN    Anywhere
22/tcp (v6)                ALLOW IN    Anywhere (v6)
22 (v6)                    ALLOW IN    Anywhere (v6)
80/tcp (v6)                ALLOW IN    Anywhere (v6)
443/tcp (v6)               ALLOW IN    Anywhere (v6)
123/udp (v6)               ALLOW IN    Anywhere (v6)

~$

Why is the port accessible? Could the server side software override ufw, or is ufw not configured properly?

The disk of my computer is corrupted. I plan to use Ubuntu to recover data on the disk.

I went to my friend's home and made a Ubuntu USB stick. I don't think the Ubuntu USB stick has a persistent storage portion.

My computer successfully boots from the Ubuntu USB stick, but my recovery requires additional software.

$ sudo apt-get install testdisk
Reading package lists... Done
Building dependency tree       
Reading state information... Done
E: Unable to locate package testdisk

$ sudo apt-get update
...                  
Get:16 http://archive.ubuntu.com/ubuntu xenial-updates/restricted Translation-en [2,272 B]                     
Fetched 3,789 kB in 12s (297 kB/s)                                                                             

** (appstreamcli:4232): CRITICAL **: Error while moving old database out of the way.
AppStream cache update failed.
Reading package lists... Done

apt-get reports error, I guess it's because the USB stick is kind of read-only mode?

I don't want to bother my friend again to make a persistent USB stick.

What is the easiest way to run additional software on Ubuntu Live?

# systemd-analyze verify whatever-not-exist
/lib/systemd/system/dbus.socket:4: ListenStream= references a path below legacy directory /var/run/, updating /var/run/dbus/system_bus_socket → /run/dbus/system_bus_socket; please update the unit file accordingly.
Failed to prepare filename whatever-not-exist: Invalid argument

I'm asking systemd-analyze to verify my file, but it always outputs dbus.socket.

How do I fix this so that systemd-analyze verify only outputs errors in my file?

On Windows, I can use Process Explorer and drag its crosshairs to a window, then Process Explorer highlights the associated process.

On Ubuntu, I didn't find such a function in System Monitor. What's the easy way to get process from window?

I'm open to downloading an alternative process monitor or other tools.

I installed brand new Ubuntu 18.04. Open Terminal, and copy

echo -e "\e[31mHello World\e[0m"

from https://misc.flogisoft.com/bash/tip_colors_and_formatting

Why does echo color text output garbled text?

On command line, I typed a command and hit enter. It doesn't output anything . How do I tell if it's running and not yet output, or it's asking for user input?

I opened 4 terminals, 3 are visible, the other is minimized.

I want to restore the minimized window, i.e. have the 4 windows visible.

I click the terminal icon, it shows 4 previews. Which preview should I click to restore the minimized window?

Anyway, my goal is to restore the minimized window. If there are better ways, please tell me.