Blue Shrapnel

installing SugarCRM

2006-11-23T15:54:00.000-08:00

php version - 5.1.4
php modules - IMAP, curl

edit php.ini and uncomment

session.save_path = /tmp

root@server30013 [/usr/local/lib]# php -i | grep -i session
session
Session Support => enabled
session.auto_start => Off => Off
session.bug_compat_42 => On => On
session.bug_compat_warn => On => On
session.cache_expire => 180 => 180
session.cache_limiter => nocache => nocache
session.cookie_domain => no value => no value
session.cookie_lifetime => 0 => 0
session.cookie_path => / => /
session.cookie_secure => Off => Off
session.entropy_file => no value => no value
session.entropy_length => 0 => 0
session.gc_divisor => 100 => 100
session.gc_maxlifetime => 1440 => 1440
session.gc_probability => 1 => 1
session.hash_bits_per_character => 4 => 4
session.hash_function => 0 => 0
session.name => PHPSESSID => PHPSESSID
session.referer_check => no value => no value
session.save_handler => files => files
session.save_path => /tmp => /tmp
session.serialize_handler => php => php
session.use_cookies => On => On
session.use_only_cookies => Off

I ran

root@server30013 [/home/cpapachebuild/buildapache/php-5.1.4]# ./configure
--with-apxs=/usr/local/apache/bin/apxs --prefix=/usr/local --with-xml
--enable-bcmath --enable-calendar --with-curl --enable-ftp --with-gd
--with-jpeg-dir=/usr/local --with-png-dir=/usr --with-xpm-dir=/usr/X11R6
--with-gettext --with-imap=/usr/local/imap-2004g --enable-mbstring
--enable-mbstr-enc-trans --enable-mbregex --enable-magic-quotes --with-mysqli
--with-mysql=/usr --enable-discard-path --with-pear --enable-sockets
--enable-track-vars --with-zlib

followed by make, checked for errors, then make install, then restarted apache
httpd using WHM

PHP Version => 5.1.4

System => Linux server30013.uk2net.com 2.6.17-1.2174_FC5 #1 Tue Aug 8 15:30:55 EDT 2006 i686
Build Date => Nov 24 2006 01:10:44
Configure Command => './configure' '--with-apxs=/usr/local/apache/bin/apxs' '--prefix=/usr/local' '--with-xml' '--enable-bcma
th' '--enable-calendar' '--with-curl' '--enable-ftp' '--with-gd' '--with-jpeg-dir=/usr/local' '--with-png-dir=/usr' '--with-xp
m-dir=/usr/X11R6' '--with-gettext' '--with-imap=/usr/local/imap-2004g' '--enable-mbstring' '--enable-mbstr-enc-trans' '--enabl
e-mbregex' '--enable-magic-quotes' '--with-mysqli' '--with-mysql=/usr' '--enable-discard-path' '--with-pear' '--enable-sockets
' '--enable-track-vars' '--with-zlib'

Java Runtime Environment on Edgy

2006-11-18T13:23:00.000-08:00

How to install JRE v5.0 Update 9
http://ubuntuguide.org/wiki/Ubuntu_Edgy#How_to_install_JRE_v5.0_Update_9

Note: Program included in Automatix2. If you have already used Automatix2, this program may have been installed

Read #General Notes
Read #How to add extra repositories
Navigate to http://java.sun.com/javase/downloads/index.jsp
Choose "Java Runtime Environment (JRE) 5.0 Update 9" and click on "Download"
Accept License Agreement
Download the "Linux self-extracting file"


  * Install the required tool : sudo apt-get install java-package  
  * Create the Ubuntu package : fakeroot make-jpkg jre-1_5_0_09-linux-i586.bin
  * Install the resulting package : sudo dpkg -i sun-j2re1.5_1.5.0+update09_i386.deb
  * Restart Mozilla Firefox
  * If you get an error, try changing the 09's in the filenames to the appropriate version number.

Polling Remote Mail -> IMAP

2006-11-17T15:56:00.000-08:00

Polling Remote POP3 Servers for Mail and pushing into Linux IMAP Server

sudo apt-get install dovecot-imapd

http://wiki.dovecot.org/QuickConfiguration

mounting ntfs on Ubuntu filesystem

2006-11-10T16:33:00.000-08:00

http://ubuntuguide.org/wiki/Ubuntu:Edgy#How_to_mount.2Funmount_Windows_partitions_.28NTFS.29_manually.2C_and_allow_all_users_to_read_only
http://www.ubuntuforums.org/showthread.php?t=21700

Firstly, with Edgy, disks-admin was unmaintained, so it was dropped from GNOME, according to http://ubuntuforums.org/showthread.php?p=1721261

You can install pysdm (Storage Device Manager) and gparted (Gnome Partition Manager) through Synaptic Package Manager (from the menu in Gnome - System, Administration). You will need to enter your user password to gain root access.
```
sudo aptitude install pysdm gparted
```
Run the Storage Device Manager, configure the drives and then mount them. The you can access them using GParted. They are typically mounted in the filesystem: /media/hda1 and /media/hdd1 etc.
Install ntfs-3g: http://www.ubuntuforums.org/showthread.php?t=217009

/dev/hda1    /media/windows    ntfs-3g    defaults,locale=en_GB.utf8    0    0

ubuntu - installing bluetooth to use headset with skype

2006-11-06T15:39:00.000-08:00

https://help.ubuntu.com/community/BluetoothSetup

sudo apt-get install bluez-utils
karen@tom-1300:~$ sudo /etc/init.d/bluetooth restart
* Restarting Bluetooth services...                                                                         [ ok ]
karen@tom-1300:~$ lsusb
Bus 002 Device 001: ID 0000:0000
Bus 001 Device 002: ID 1310:0001 Roper Class 1 Bluetooth Dongle
Bus 001 Device 001: ID 0000:0000

Install bluez-btsco
http://packages.ubuntulinux.org/edgy/sound/bluez-btsco

karen@tom-1300:~$ sudo apt-get install bluez-btsco
Reading package lists... Done
Building dependency tree
Reading state information... Done
The following NEW packages will be installed
bluez-btsco
0 upgraded, 1 newly installed, 0 to remove and 0 not upgraded.
Need to get 17.0kB of archives.
After unpacking 77.8kB of additional disk space will be used.
Get: 1 http://gb.archive.ubuntu.com edgy/universe bluez-btsco 1:0.42-0ubuntu1 [17.0kB]
Fetched 17.0kB in 0s (60.5kB/s)
Selecting previously deselected package bluez-btsco.
(Reading database ... 83451 files and directories currently installed.)
Unpacking bluez-btsco (from .../bluez-btsco_1%3a0.42-0ubuntu1_i386.deb) ...
Setting up bluez-btsco (0.42-0ubuntu1) ...

Load Kernel Module for btsco

sudo modprobe snd-bt-sco

https://help.ubuntu.com/community/BluetoothSkype
to load it permanently add it to /etc/modules, just write approriate module name at the end of the File.

sudo vi /etc/modules
# /etc/modules: kernel modules to load at boot time.
#
# This file contains the names of kernel modules that should be loaded
# at boot time, one per line. Lines beginning with "#" are ignored.

lp
psmouse
snd-bt-sco

install gnome-bluetooth, obex-server
http://ubuntuforums.org/showthread.php?t=34740

karen@tom-1300:~$ sudo apt-get install gnome-bluetooth
Reading package lists... Done
Building dependency tree
Reading state information... Done
The following NEW packages will be installed
gnome-bluetooth
0 upgraded, 1 newly installed, 0 to remove and 0 not upgraded.
Need to get 194kB of archives.
After unpacking 954kB of additional disk space will be used.
Get: 1 http://gb.archive.ubuntu.com edgy/universe gnome-bluetooth 0.8.0-0ubuntu1 [194kB]
Fetched 194kB in 1s (111kB/s)
Selecting previously deselected package gnome-bluetooth.
(Reading database ... 83459 files and directories currently installed.)
Unpacking gnome-bluetooth (from .../gnome-bluetooth_0.8.0-0ubuntu1_i386.deb) ...
Setting up gnome-bluetooth (0.8.0-0ubuntu1) ...

check for l2cap and rfcomm via dmesg

[17179615.032000] Bluetooth: L2CAP ver 2.8
[17179615.032000] Bluetooth: L2CAP socket layer initialized
[17179615.156000] Bluetooth: HIDP (Human Interface Emulation) ver 1.1-mh1
[17179615.184000] Bluetooth: RFCOMM socket layer initialized
[17179615.184000] Bluetooth: RFCOMM TTY layer initialized
[17179615.184000] Bluetooth: RFCOMM ver 1.7

bring the Bluetooth network interface up

karen@tom-1300:~$ sudo hciconfig hci0 up
karen@tom-1300:~$ hciconfig
hci0:   Type: USB
BD Address: 00:0B:0D:33:79:35 ACL MTU: 120:20 SCO MTU: 64:8
UP RUNNING PSCAN ISCAN
RX bytes:822 acl:0 sco:0 events:61 errors:0
TX bytes:522 acl:0 sco:0 commands:39 errors:0
karen@tom-1300:~$ hcitool scan
Scanning ...
00:12:62:CB:25:A6       K nokia
00:03:89:44:07:5F       M3000 by Plantronics

Edit your /etc/bluetooth/rfcomm.conf

sudo vi /etc/bluetooth/rfcomm.conf

#rfcomm0 {
#       # Automatically bind the device at startup
#       bind no;
#
#       # Bluetooth address of the device
#       device 11:22:33:44:55:66;
#
#       # RFCOMM channel for the connection
#       channel 1;
#
#       # Description of the connection
#       comment "Example Bluetooth device";
#

rfcomm0 {
device 00:12:62:CB:25:A6;
channel 10;
comment "Karen's Phone";
}
karen@tom-1300:/$ sudo sdptool add --channel=10 OPUSH
OBEX Object Push service registered
karen@tom-1300:/$ sudo rfcomm bind /dev/rfcomm0 00:12:62:cb:25:a6 10
karen@tom-1300:/$

get gnome passkey applet
http://ubuntuforums.org/showthread.php?t=225703&page=2

karen@tom-1300:/etc/bluetooth$ sudo apt-get install bluez-passkey-gnome
Reading package lists... Done
Building dependency tree
Reading state information... Done
The following NEW packages will be installed
bluez-passkey-gnome
0 upgraded, 1 newly installed, 0 to remove and 0 not upgraded.
Need to get 14.6kB of archives.
After unpacking 106kB of additional disk space will be used.
Get: 1 http://gb.archive.ubuntu.com edgy/main bluez-passkey-gnome 0.5-2ubuntu2 [14.6kB]
Fetched 14.6kB in 0s (59.4kB/s)
Selecting previously deselected package bluez-passkey-gnome.
(Reading database ... 88545 files and directories currently installed.)
Unpacking bluez-passkey-gnome (from .../bluez-passkey-gnome_0.5-2ubuntu2_i386.deb) ...
Setting up bluez-passkey-gnome (0.5-2ubuntu2) ...

pair with headset

put headset in discovery mode (hold down volume up and call button till red/green light flashes)
sudo hcitool cc 00:03:89:44:07:5F

karen@tom-1300:~$ sudo btsco -v 00:03:89:44:07:5F
btsco v0.42
Device is 1:0
Voice setting: 0x0060
RFCOMM channel 1 connected
Using interface hci0

Skype for Ubuntu

2006-11-06T13:40:00.000-08:00

Installed skype. Fantastic, took a few minutes and worked first time!

http://ubuntuguide.org/wiki/Ubuntu_Edgy#How_to_install_Messenger_.28Skype.29

With Edgy the Skype is not included in the Ubuntu repositories anymore.

sudo apt-get install libqt3-mt
wget http://www.skype.com/go/getskype-linux-deb
sudo dpkg -i skype_debian-*.deb

To run "Applications > Internet > Skype".

VNC

2006-11-02T15:33:00.000-08:00

Using VNC on Windows

Setup

Setting up the programs to connect to a VNC server is not too difficult. You will, however, need to download two programs: a SSH client and a VNC client. The SSH client will make a secure connection between your computer and the VNC server and the VNC client will use this connection to draw a display on your screen.

Download and install a SSH client

In order to use VNC with your SSH client, your SSH client must provide port forwarding. Both Putty and Teraterm Pro will work. (Note: Putty only added this functionality recently, so if you have an old version you will want to upgrade.)

We have installation instructions for a SSH client available at http://www.cs.vassar.edu/SysNews/ssh/windows.html.

Download and install a VNC client

We recommend using TightVNC as your VNC client because it comes with several features over the official VNC client. TightVNC uses a "tight" encoding by default which efficiently compresses the information which updates your display.

Download the TightVNC Viewer binary for Windows from the TightVNC download page: http://www.tightvnc.com/download.html.
Open the downloaded TightVNC Viewer archive. It will create a new folder with the vncviewer program inside.

Connecting

Every time you want to make a VNC connection, you must forward a port with your SSH client and then open a session with your VNC client.

Port Forwarding - Putty

Run PuTTY.
In "Basic options for your Putty Session", enter the host name, vnc.cs.vassar.edu, and choose the "SSH" protocol. Do not "Open" this connection just yet.
On the left, find and select the category "Connection - SSH - Tunnels".
In the section "Add new forwarded port:", set the "Source Port" to 5901 and set the "Destination" to vnc.cs.vassar.edu:5995. Choose "Local" for this connection if it is not already the default, and click "Add".
Open the connection and log in. Leaving PuTTY open, start a VNC session.

Port Forwarding - Teraterm

Open Teraterm Pro by running ttssh. Teraterm will ask you to make a new connection. Hit "Cancel".
Select "SSH Forwarding..." from the "Setup" menu.
Click "Add" and fill in "Forward local port '5901' to remote machine 'vnc.cs.vassar.edu' port '5995'".
Choose 'Ok' to get back to the main, blank, Teraterm window.
Choose "New Connection" from the "File" menu. Connect to host 'vnc.cs.vassar.edu' using the 'SSH' service.
Leave Teraterm open and start a VNC session according to the next session. (It's fine to minimize Teraterm, of course.)

VNC Session

Run the VNC client, vncviewer.
Enter localhost:1 for the vnc server to connect with.
A graphical login screen should appear. Log in and start work.
When you are finished, just log out of your Unix session as you normally would, close the VNC client program, and exit from your SSH session.

Ubuntu Edgy

2006-10-25T23:32:00.000-07:00

Installed Ubuntu Edgy on home desktop. This is great! So far I am enjoying it and seriously considering the whole shabang as an alternative to XP. Need to keep microsoft alive for the sake of software though.

adduser / useradd

2006-09-18T03:34:00.000-07:00

useradd
[-c comment] 
[-d home_dir]
[-e expire_date] 
[-f inactive_time]
[-g initial_group] 
[-G group[,...]]
[-m [-k skeleton_dir] | -M] 
[-p passwd]
[-s shell] 
[-u uid [ -o]] [-n] [-r] 
login useradd
-D [-g default_group] 
[-b default_home]
[-f default_inactive] 
[-e default_expire_date]
[-s default_shell]

Adding a user using a comment also selecting the uid, gid, shell & home directory.

useradd -c example_user -u 600 -g 501 -s /bin/bash -d /export/home/newuser newuser

Description - Creating New Users

When invoked without the -D option, the useradd command creates a new user account using the values specified on the command line and the default values from the system. The new user account will be entered into the system files as needed, the home directory will be created, and initial files copied, depending on the command line options. The version provided with Red Hat Linux will create a group for each user added to the system, unless -n option is given.

The options which apply to the useradd command are:

-c comment:
The new user's password file comment field.

-d home_dir: The new user will be created using home_dir as the value for the user's login directory. The default is to append the login name to default_home and use that as the login directory name.

-e expire_date: The date on which the user account will be disabled. The date is specified in the format YYYY-MM-DD.

-f inactive_days: The number of days after a password expires until the account is permanently disabled. A value of 0 disables the account as soon as the password has expired, and a value of -1 disables the feature. The default value is -1.

-g initial_group: The group name or number of the user's initial login group. The group name must exist. A group number must refer to an already existing group. The default group number is 1.

-G group,[...]: A list of supplementary groups which the user is also a member of. Each group is separated from the next by a comma, with no intervening whitespace. The groups are subject to the same restrictions as the group given with the -g option. The default is for the user to belong only to the initial group.

-m: The user's home directory will be created if it does not exist. The files contained in skeleton_dir will be copied to the home directory if the -k option is used, otherwise the files contained in /etc/skel will be used instead. Any directories contained in skeleton_dir or /etc/skel will be created in the user's home directory as well. The -k option is only valid in conjunction with the -m option. The default is to not create the directory and to not copy any files.

-M: The user home directory will not be created, even if the system wide settings from /etc/login.defs is to create home dirs.

-n: A group having the same name as the user being added to the system will be created by default. This option will turn off this Red Hat Linux specific behavior.

-r: This flag is used to create a system account. That is, a user with a UID lower than the value of UID_MIN defined in /etc/login.defs and whose password does not expire. Note that useradd will not create a home directory for such an user, regardless of the default setting in /etc/login.defs. You have to specify -m option if you want a home directory for a system account to be created. This is an option added by Red Hat.

-p passwd: The encrypted password, as returned by crypt(3). The default is to disable the account.

-s shell: The name of the user's login shell. The default is to leave this field blank, which causes the system to select the default login shell.

-u uid: The numerical value of the user's ID. This value must be unique, unless the -o option is used. The value must be non-negative. The default is to use the smallest ID value greater than 99 and greater than every other user. Values between 0 and 99 are typically reserved for system accounts.

Sender Verify for Receiving Email

2006-09-18T02:04:00.000-07:00

In order to restrict the quantity of bogus and spam messages our server requires that every inbound mail message be sent from an email address which can be verified as genuine. If the server is unable to send an email (or a bounce message) back to the address that the message appears to come from, the message will not be accepted and therefore not delivered.

If you receive complaints that email messages are being rejected by the server, and the error message mentions sender verification, please ask them to contact their mail administrator (e.g. the postmaster) to ask them to follow this up and suggest they read the text below. Also if the sender is unable to receive mail, for example if their account isn't working or is temporarily down or over quota, they won't be able to send you mail if sender verify is enabled.

To check rejected messages for a particular user run:

root@server30013 [~]# grep -inw 'sender verify'
/var/log/exim_mainlog | grep 'chris@pim-uk.com'

Technical notes for mailserver adminstrators

To verify a message's sender address, our mailhub will attempt the following...

check that the header is syntactically correct
attempt to find a mailserver for the domain part of the sender address (based on either MX or A records)
open an SMTP connection to that server

send the following:

HELO our-server-name
wait for success response
MAIL FROM: <>
wait for success response
RCPT TO: sender-address-from-your-message
wait for success response
QUIT

If any step fails, the message will be rejected.

Note that the dummy mail is sent as if it were a bounce receipt, thereby testing whether a bounce message is deliverable to that address.

If your server does not allow bounce receipts, it is not functioning correctly.
Please read RFC2821 (in particular, sections 4.1.1.2 and 3.7) and ensure that your mailserver complies with the RFCs before complaining to us.

If you are certain that your mailserver is behaving correctly, please email me with a detailed fault report, including the full text of the bounce message and its full SMTP headers.

In the future I will setup a postmaster address which will not be sender-verified so you may be certain that your report will arrive unchecked.

Compress Log File Shell Script

2006-09-17T16:52:00.000-07:00

To save space but retain logfile data, copy and compress logfiles and start again at 0. You could setup a cron job to do this monthly, etc. Or add a check on the size and only process this warranted. If necessary you may want to implement log rotation (see savelog or logrotate). This may already be implemented in FC5.

mv /var/log/messages /var/log/messages-backup
cp /dev/null /var/log/messages //truncate file to zero bytes
CURDATE='date + "%m%d%y"'
mv /var/log/messages-backup /var/log/messages-$CURDATE
gzip /var/log/messages-$CURDATE

/var/log/lastlog (finger)

2006-09-17T16:49:00.000-07:00

/var/log/lastlog is similar to /var/log/wtmp and is used by finger (e.g.) to determine when a user was last logged on.

/var/run/utmp (w, who, finger)

2006-09-17T16:47:00.000-07:00

/var/run/utmp contains binary data on users currently logged into the system. Data is access by commands such as 'w', 'who' and 'finger'.

/var/log/wtmp (last)

2006-09-17T16:44:00.000-07:00

/var/log/wtmp contains binary data indicating login times and duration for each user on the system. It is used by the 'last' command to generate a listing of user logins.

Hacker IPs

2006-09-17T15:05:00.000-07:00

/var/log/secure

83.170.78.93 - logname= uid=0 euid=0 tty=ssh ruser= rhost=raq621.uk2.net
first: Sep 17 04:29:47 server30013
last: Sep 17 23:50:40 server30013
name: Oscar Sanderson
email: osanderson@gmail.com
address: 1 Central Beach, Lytham, Lancashire FY8 5LB
domains:

1.	cooksnightoff.com
2.	ikelo.com
3.	naomei.com
4.	stoned-software.com

218.204.241.252 -
first: Sep 18 16:53:39

Log Files - syslogd.conf

2006-09-17T14:59:00.000-07:00

/etc/syslog.conf details what and where

# Log all kernel messages to the console.
# Logging much else clutters up the screen.
#kern.* /dev/console

# Log anything (except mail) of level info or higher.
# Don't log private authentication messages!
*.info;mail.none;authpriv.none;cron.none /var/log/messages

# The authpriv file has restricted access.
authpriv.* /var/log/secure

# Log all the mail messages in one place.
local0.notice;local0.debug;mail.*;mail.none;mail.info;local0.info /var/log/maillog

# Log cron stuff
cron.* /var/log/cron

# Everybody gets emergency messages
*.emerg *

# Save news errors of level crit and higher in a special file.
uucp,news.crit /var/log/spooler

# Save boot messages also to boot.log
local7.* /var/log/boot.log

Cpanel Hackcheck

2006-09-14T23:55:00.000-07:00

IMPORTANT: Do not ignore this email.
This message is to inform you that the rpm
package findutils did not match the expected checksum. This could mean that
your system was compromised (OwN3D). The offending files have been removed
and replaced with the OS default. To be safe you should verify that your
system has not be compromised.

Does this entry in

/var/logs/chksrvd.log

correspond to the above email?

[Fri Sep 15 18:55:34 2006] Service check ....cpsrvd [-Notification => karen.archer@gmail.com via EMAIL [level => 3]
Restarting cpsrvd....
system: /usr/local/cpanel/etc/init/safekill cpsrvd
system: /usr/local/cpanel/etc/init/safekill webmaild
system: /usr/local/cpanel/etc/init/safekill cpaneld
system: /usr/local/cpanel/cpsrvd
]...Done

Modified Files:
S.?...... /usr/bin/find
S.?...... /usr/bin/xargs

History of Support Activity:

276  w
277  rpm -qf /usr/bin/find
278  rpm -V findutils
279  rpm -qf /usr/bin/xargs
280  rpm -V xargs
281  ls -alhd /usr/bin/find
282  cat /etc/redhat-release
283  rpm -qf /usr/bin/find /usr/bin/xargs
284  rpm -V findutils-4.2.27-4
285  whereis rpm
286  rpm -V /bin/rpm
287  rpm -qf /bin/rpm
288  rpm -V rpm
289  less /scripts/hackcheck
290  less /scripts/hackcheck
291  rpm -V
292  rpm -V all
293  rpm -V
294  w
295  exit

chkRootKit

root@server30013 [/usr/local/bin]# rpm -qpl chkrootkit-0.46a-2.fc5.i386.rpm
warning: chkrootkit-0.46a-2.fc5.i386.rpm: Header V3 DSA signature: NOKEY, key ID 1ac70ce6
/etc/pam.d/chkrootkit
/etc/security/console.apps/chkrootkit
/usr/bin/chkrootkit
/usr/bin/chkrootkitX
/usr/lib/chkrootkit-0.46a
/usr/lib/chkrootkit-0.46a/check_wtmpx
/usr/lib/chkrootkit-0.46a/chkdirs
/usr/lib/chkrootkit-0.46a/chklastlog
/usr/lib/chkrootkit-0.46a/chkproc
/usr/lib/chkrootkit-0.46a/chkrootkit
/usr/lib/chkrootkit-0.46a/chkutmp
/usr/lib/chkrootkit-0.46a/chkwtmp
/usr/lib/chkrootkit-0.46a/ifpromisc
/usr/lib/chkrootkit-0.46a/strings
/usr/lib/chkrootkit-0.46a/strings-static
/usr/sbin/chkrootkit
/usr/share/applications/fedora-chkrootkit.desktop
/usr/share/doc/chkrootkit-0.46a
/usr/share/doc/chkrootkit-0.46a/ACKNOWLEDGMENTS
/usr/share/doc/chkrootkit-0.46a/COPYRIGHT
/usr/share/doc/chkrootkit-0.46a/README
/usr/share/doc/chkrootkit-0.46a/README.chklastlog
/usr/share/doc/chkrootkit-0.46a/README.chkwtmp
/usr/share/doc/chkrootkit-0.46a/chkrootkit.lsm
/usr/share/pixmaps/chkrootkit.png

Output:
Checking `bindshell'... INFECTED (PORTS: 465)

Important Note: If you see 'Checking `bindshell'... INFECTED (PORTS: 465)' read on.
I'm running PortSentry/klaxon. What's wrong with the bindshell test?
If you're running PortSentry/klaxon or another program that binds itself to unused ports probably chkrootkit will give you a false positive on
the bindshell test (ports 114/tcp, 465/tcp, 511/tcp, 1008/tcp,
1524/tcp, 1999/tcp, 3879/tcp, 4369/tcp, 5665/tcp, 10008/tcp, 12321/tcp,
23132/tcp, 27374/tcp, 29364/tcp, 31336/tcp, 31337/tcp, 45454/tcp,
47017/tcp, 47889/tcp, 60001/tcp).

Beginners Guide to VI Editor

2006-09-14T15:15:00.000-07:00

http://www.eng.hawaii.edu/Tutor/vi.html

Starting the VI Editor

The VI editor lets a user create new files or edit existing files. The command to start the VI editor is vi, followed by the filename. For example to edit a file called temporary, you would type vi temporary and then return. You can start VI without a filename, but when you want to save your work, you will have to tell VI which filename to save it into later.

When you start VI for the first time, you will see a screen filled with tildes (A tilde looks like this: ~) on the left side of the screen. Any blank lines beyond the end of the file are shown this way. At the bottom of your screen, the filename should be shown, if you specified an existing file, and the size of the file will be shown as well, like this:

"filename" 21 lines, 385 characters

If the file you specified does not exist, then it will tell you that it is a new file, like this:

"newfile" [New file]

If you started VI without a filename, the bottom line of the screen will just be blank when VI starts. If the screen does not show you these expected results, your terminal type may be set wrong. Just type :q and return to get out of VI, and fix your terminal type. If you don't know how, ask a lab monitor.

Getting Out of VI

Now that you know how to get into VI, it would be a good idea to know how to get out of it. The VI editor has two modes and in order to get out of VI, you have to be in command mode. Hit the key labeled "Escape" or "Esc" (If your terminal does not have such a key, then try ^[, or control-[.) to get into command mode. If you were already in the command mode when you hit "Escape", don't worry. It might beep, but you will still be in the command mode.

The command to quit out of VI is :q. Once in command mode, type colon, and 'q', followed by return. If your file has been modified in any way, the editor will warn you of this, and not let you quit. To ignore this message, the command to quit out of VI without saving is :q!. This lets you exit VI without saving any of the changes.

Of course, normally in an editor, you would want to save the changes you have made. The command to save the contents of the editor is :w. You can combine the above command with the quit command, or :wq. You can specify a different file name to save to by specifying the name after the :w. For example, if you wanted to save the file you were working as another filename called filename2, you would type: w filename2 and return.

Another way to save your changes and exit out of VI is the ZZ command. When in command mode, type ZZ and it will do the equivalent of :wq. If any changes were made to the file, it will be saved. This is the easiest way to leave the editor, with only two keystrokes.

The Two Modes of VI

The first thing most users learn about the VI editor is that it has two modes: command and insert. The command mode allows the entry of commands to manipulate text. These commands are usually one or two characters long, and can be entered with few keystrokes. The insert mode puts anything typed on the keyboard into the current file.

VI starts out in command mode. There are several commands that put the VI editor into insert mode. The most commonly used commands to get into insert mode are a and i. These two commands are described below. Once you are in insert mode, you get out of it by hitting the escape key. If your terminal does not have an escape key, ^[ should work (control-[). You can hit escape two times in a row and VI would definitely be in command mode. Hitting escape while you are already in command mode doesn't take the editor out of command mode. It may beep to tell you that you are already in that mode.

How to Type Commands in Command Mode

The command mode commands are normally in this format: (Optional arguments are given in the brackets)

[count] command [where]

Most commands are one character long, including those which use control characters. The commands described in this section are those which are used most commonly the VI editor.

The count is entered as a number beginning with any character from 1 to 9. For example, the x command deletes a character under the cursor. If you type 23x while in command mode, it will delete 23 characters.

Some commands use an optional where parameter, where you can specify how many lines or how much of the document the command affects, the where parameter can also be any command that moves the cursor.

Some Simple VI Commands

Here is a simple set of commands to get a beginning VI user started. There are many other convenient commands, which will be discussed in later sections.

a: enter insert mode, the characters typed in will be inserted after the current cursor position. If you specify a count, all the text that had been inserted will be repeated that many times.
h: move the cursor to the left one character position.
i: enter insert mode, the characters typed in will be inserted before the current cursor position. If you specify a count, all the text that had been inserted will be repeated that many times.
j: move the cursor down one line.
k: move the cursor up one line.
l: move the cursor to the right one character position.
r: replace one character under the cursor. Specify count to replace a number of characters
u: undo the last change to the file. Typing u again will re-do the change.
x: delete character under the cursor. Count specifies how many characters to delete. The characters will be deleted after the cursor.

Text Buffers in VI

The VI editor has 36 buffers for storing pieces of text, and also a general purpose buffer. Any time a block of text is deleted or yanked from the file, it gets placed into the general purpose buffer. Most users of VI rarely use the other buffers, and can get along without the other buffers. The block of text is also stored in another buffer as well, if it is specified. The buffer is specified using the " command. After typing ", a letter or digit specifying the buffer must be entered. For example, the command: "mdd uses the buffer m, and the last two characters stand for delete current line. Similarly, text can be pasted in with the p or P command. "mp pastes the contents of buffer m after the current cursor position. For any of the commands used in the next two sections, these buffers can be specified for temporary storage of words or paragraphs.

Cutting and Yanking

The command commonly used command for cutting is d. This command deletes text from the file. The command is preceded by an optional count and followed by a movement specification. If you double the command by typing dd, it deletes the current line. Here are some combinations of these:

d^: deletes from current cursor position to the beginning of the line.
d$: deletes from current cursor position to the end of the line.
dw: deletes from current cursor position to the end of the word.
3dd: deletes three lines from current cursor position downwards.

There is also the y command which operates similarly to the d command which take text from the file without deleting the text.

Pasting

The commands to paste are p and P. The only differ in the position relative to the cursor where they paste. p pastes the specified or general buffer after the cursor position, while P pastes the specified or general buffer before the cursor position. Specifying count before the paste command pastes text the specified number of times.

Indenting Your Code and Checking

The VI editor has features to help programmers format their code neatly. There is a variable that to set up the indentation for each level of nesting in code. In order to set it up, see the customization section of this tutorial. For example, the command to set the shift width to 4 characters is :set sw=4.

The following commands indent your lines or remove the indentation, and can be specified with count:

<<: Shifts the current line to the left by one shift width.
>>: Shifts the current line to the right by one shift width.

The VI editor also has a helpful feature which checks your source code for any hanging parentheses or braces. The % command will look for the left parenthesis or brace corresponding to a particular right parenthesis or brace and vice versa. Place the cursor onto a parenthesis or brace and type % to move the cursor to the corresponding parenthesis or brace. This is useful to check for unclosed parentheses or braces. If a parenthesis or brace exists without a matching parenthesis or brace, VI will beep at you to indicate that no matching symbol was found.

Word and Character Searching

The VI editor has two kinds of searches: string and character. For a string search, the / and ? commands are used. When you start these commands, the command just typed will be shown on the bottom line, where you type the particular string to look for. These two commands differ only in the direction where the search takes place. The / command searches forwards (downwards) in the file, while the ? command searches backwards (upwards) in the file. The n and N commands repeat the previous search command in the same or opposite direction, respectively. Some characters have special meanings to VI, so they must be preceded by a backslash (\) to be included as part of the search expression.

Special characters:

^: Beginning of the line. (At the beginning of a search expression.)
.: Matches a single character.
*: Matches zero or more of the previous character.
$: End of the line (At the end of the search expression.)
[: Starts a set of matching, or non-matching expressions... For example: /f[iae]t matches either of these: fit fat fet In this form, it matches anything except these: /a[^bcd] will not match any of these, but anything with an a and another letter: ab ac ad
<: Put in an expression escaped with the backslash to find the ending or beginning of a word. For example: /\ should find only word the, but not words like these: there and other.
>: See the '<' character description above.

The character search searches within one line to find a character entered after the command. The f and F commands search for a character on the current line only. f searches forwards and F searches backwards and the cursor moves to the position of the found character.

The t and T commands search for a character on the current line only, but for t, the cursor moves to the position before the character, and T searches the line backwards to the position after the character.

These two sets of commands can be repeated using the ; or , command, where ; repeats the last character search command in the same direction, while , repeats the command in the reverse direction.

Settings for VI (and EX)

You can customize the way VI behaves upon start up. There are several edit options which are available using the :set command, these are the VI and EX editor options available on Wiliki: (You can get this list by typing :set all and then return in command mode)

noautoindent magic noshowmatch
autoprint mesg noshowmode
noautowrite nomodelines noslowopen
nobeautify nonumber tabstop=8
directory=/tmp nonovice taglength=0
nodoubleescape nooptimize tags=tags /usr/lib/tags
noedcompatible paragraphs=IPLPPPQPP LIpplpipnpbp term=xterm
noerrorbells prompt noterse
noexrc noreadonly timeout
flash redraw timeoutlen=500
hardtabs=8 remap ttytype=xterm
noignorecase report=5 warn
keyboardedit scroll=11 window=23
keyboardedit! sections=NHSHH HUuhsh+c wrapscan
nolisp shell=/bin/csh wrapmargin=0
nolist shiftwidth=8 nowriteany

Some of these options have values set with the equals sign '=' in it, while others are either set or not set. (These on or off type of options are called Boolean, and have "no" in front of them to indicate that they are not set.) The options shown here are the options that are set without any customization. Descriptions of some of these are given below, with an abbreviation. For example, the command set autoindent, you can type :set autoindent or :set ai. To unset it, you can type :set noautoindent or :set noai.

autoindent (ai): This option sets the editor so that lines following an indented line will have the same indentation as the previous line. If you want to back over this indentation, you can type ^D at the very first character position. This ^D works in the insert mode, and not in command mode. Also, the width of the indentations can be set with shiftwidth, explained below.
exrc: The .exrc file in the current directory is read during startup. This has to be set either in the environment variable EXINIT or in the .exrc file in your home directory.
mesg: Turn off messages if this option is unset using :set nomesg, so that nobody can bother you while using the editor.
number (nu): Displays lines with line numbers on the left side.
shiftwidth (sw): This option takes a value, and determines the width of a software tabstop. (The software tabstop is used for the << and >> commands.) For example, you would set a shift width of 4 with this command: :set sw=4.
showmode (smd): This option is used to show the actual mode of the editor that you are in. If you are in insert mode, the bottom line of the screen will say INPUT MODE.
warn: This option warns you if you have modified the file, but haven't saved it yet.
window (wi): This option sets up the number of lines on the window that VI uses. For example, to set the VI editor to use only 12 lines of your screen (because your modem is slow) you would use this: :set wi=12.
wrapscan (ws): This option affects the behavior of the word search. If wrapscan is set, if the word is not found at the bottom of the file, it will try to search for it at the beginning.
wrapmargin (wm): If this option has a value greater than zero, the editor will automatically "word wrap". That is, if you get to within that many spaces of the left margin, the word will wrap to the next line, without having to type return. For example, to set the wrap margin to two characters, you would type this: :set wm=2.

Abbreviations and Mapping Keys to Other Keys

One EX editor command that is useful in the VI editor is the abbreviate command. This lets you set up abbreviations for specific strings. The command looks like this: :ab string thing to substitute for. For example, if you had to type the name, "Humuhumunukunukuapua`a" but you didn't want to type the whole name, you could use an abbreviation for it. For this example, the command is entered like this:
:ab 9u Humuhumunukunukuapua`a
Now, whenever you type 9u as a separate word, VI will type in the entire word(s) specified. If you typed in 9university, it will not substitute the word.

To remove a previously defined abbreviation, the command is unabbreviate. To remove the previous example, the command would be ":una 9u" To get your listing of abbreviations, simply just type :ab without any definitions.

Another EX editor command that is useful for customization is the mapping command. There are two kinds of mapping commands. One for command mode, and the other for insert mode. These two commands are :map and :map! respectively. The mapping works similarly to the abbreviation, and you give it a key sequence and give it another key sequence to substitute it with. (The substituted key sequences are usually VI commands.)

The EXINIT Environment Variable and the .exrc file

There are two ways to customize the VI editor. If you create a file called .exrc in your home directory, all the commands in there will be read when VI starts up. The other method is to set an environment variable called EXINIT. The options will be set in your shell's setup file. If you use /bin/csh (C-Shell), the command is as follows, and is put in the .cshrc file:

    setenv EXINIT '...'

If you use /bin/sh or /bin/ksh, the command is as follows, and is put into the .profile file:

    export EXINIT
  EXINIT='...'

Don't put in ... as the example says. In this space put the commands that you want to set up. For example, if you want to have auto indent, line numbering, and the wrap margin of three characters, then the setenv command (for C shell) looks like this:

    setenv EXINIT 'set ai nu wm=3'

If you want to put more than one command in the setenv EXINIT thing, separate the commands with a vertical bar (|). For example, to map the 'g' command to the 'G' character in command mode, the command is :map g G, and combined with the above command, you get this:

setenv EXINIT 'set ai nu wm=3|map g G'

If you want to create the file called .exrc, you can put exactly the same things in the file as shown in the quotes after the EXINIT.

Recovering Your Work When Something Goes Wrong with Your Terminal

The VI editor edits a temporary copy of your file, and after the editing is complete, or when you tell it to save, it puts the contents of the temporary copy into the original file. If something goes wrong while you are editing your file, the VI editor will attempt to save whatever work you had in progress, and store it for later recovery. (Note: If VI dies while you were working on any file, it sends you an email message on how to recover it. The -r option stands for recovery. If you were editing the file vitalinfo, and you accidentally got logged out, then the -r option of the 'vi' editor should help. The command would look somewhat like this: vi -r vitalinfo After using the -r option once, though, you MUST save what you have recovered to the actual file... The -r option only works once per failed VI session.

Warning About Using VI on the Workstations

There are two things to be aware of when using the workstations: Editing the same file many times at once, and changing the size of the screen.

Because VI edits a copy of your original file and saves the contents of that copy into the original file, if you are logged on more than once and are editing the same file more than once using VI, if you save on one window and then you save on the other window, the changes made to the file on the first save would be overwritten. Make sure that you only run one copy of VI per file.

If you use a terminal program from a workstation, you can change the size of the screen by dragging the sides of the window. If the size is not working properly, the command to type is this:

    eval `resize`

If that doesn't work the command would be this:

    eval `/usr/bin/X11/resize`

If the size is wrong, the editor will not operate correctly. If you have any problems with the screen size, ask the monitors in the computer lab for help setting the sizes correctly.

Summary of VI commands

This list is a summary of VI commands, categorized by function. There may be other commands available, so check the on-line manual on VI. For easy reference, you can save this file as text and delete any commands you don't think you would use and print out the resulting shorter file.

Cutting and Pasting/Deleting text

": Specify a buffer to be used any of the commands using buffers. Follow the " with a letter or a number, which corresponds to a buffer.
D: Delete to the end of the line from the current cursor position.
P: Paste the specified buffer before the current cursor position or line. If no buffer is specified (with the " command.) then 'P' uses the general buffer.
X: Delete the character before the cursor.
Y: Yank the current line into the specified buffer. If no buffer is specified, then the general buffer is used.
d: Delete until where. "dd" deletes the current line. A count deletes that many lines. Whatever is deleted is placed into the buffer specified with the " command. If no buffer is specified, then the general buffer is used.
p: Paste the specified buffer after the current cursor position or line. If no buffer is specified (with the " command.) then 'p' uses the general buffer.
x: Delete character under the cursor. A count tells how many characters to delete. The characters will be deleted after the cursor.
y: Yank until , putting the result into a buffer. "yy" yanks the current line. a count yanks that many lines. The buffer can be specified with the " command. If no buffer is specified, then the general buffer is used.

Inserting New Text

A: Append at the end of the current line.
I: Insert from the beginning of a line.
O: (letter oh) Enter insert mode in a new line above the current cursor position.
a: Enter insert mode, the characters typed in will be inserted after the current cursor position. A count inserts all the text that had been inserted that many times.
i: Enter insert mode, the characters typed in will be inserted before the current cursor position. A count inserts all the text that had been inserted that many times.
o: Enter insert mode in a new line below the current cursor position.

Moving the Cursor Within the File

^B: Scroll backwards one page. A count scrolls that many pages.
^D: Scroll forwards half a window. A count scrolls that many lines.
^F: Scroll forwards one page. A count scrolls that many pages.
^H: Move the cursor one space to the left. A count moves that many spaces.
^J: Move the cursor down one line in the same column. A count moves that many lines down.
^M: Move to the first character on the next line.
^N: Move the cursor down one line in the same column. A count moves that many lines down.
^P: Move the cursor up one line in the same column. A count moves that many lines up.
^U: Scroll backwards half a window. A count scrolls that many lines.
$: Move the cursor to the end of the current line. A count moves to the end of the following lines.
%: Move the cursor to the matching parenthesis or brace.
^: Move the cursor to the first non-whitespace character.
(: Move the cursor to the beginning of a sentence.
): Move the cursor to the beginning of the next sentence.
{: Move the cursor to the preceding paragraph.
}: Move the cursor to the next paragraph.
|: Move the cursor to the column specified by the count.
+: Move the cursor to the first non-whitespace character in the next line.
-: Move the cursor to the first non-whitespace character in the previous line.
_: Move the cursor to the first non-whitespace character in the current line.
0: (Zero) Move the cursor to the first column of the current line.
B: Move the cursor back one word, skipping over punctuation.
E: Move forward to the end of a word, skipping over punctuation.
G: Go to the line number specified as the count. If no count is given, then go to the end of the file.
H: Move the cursor to the first non-whitespace character on the top of the screen.
L: Move the cursor to the first non-whitespace character on the bottom of the screen.
M: Move the cursor to the first non-whitespace character on the middle of the screen.
W: Move forward to the beginning of a word, skipping over punctuation.
b: Move the cursor back one word. If the cursor is in the middle of a word, move the cursor to the first character of that word.
e: Move the cursor forward one word. If the cursor is in the middle of a word, move the cursor to the last character of that word.
h: Move the cursor to the left one character position.
j: Move the cursor down one line.
k: Move the cursor up one line.
l: Move the cursor to the right one character position.
w: Move the cursor forward one word. If the cursor is in the middle of a word, move the cursor to the first character of the next word.

Moving the Cursor Around the Screen

^E: Scroll forwards one line. A count scrolls that many lines.
^Y: Scroll backwards one line. A count scrolls that many lines.
z: Redraw the screen with the following options. "z" puts the current line on the top of the screen; "z." puts the current line on the center of the screen; and "z-" puts the current line on the bottom of the screen. If you specify a count before the 'z' command, it changes the current line to the line specified. For example, "16z." puts line 16 on the center of the screen.

Replacing Text

C: Change to the end of the line from the current cursor position.
R: Replace characters on the screen with a set of characters entered, ending with the Escape key.
S: Change an entire line.
c: Change until . "cc" changes the current line. A count changes that many lines. r; Replace one character under the cursor. Specify a count to replace a number of characters.
s: Substitute one character under the cursor, and go into insert mode. Specify a count to substitute a number of characters. A dollar sign ($) will be put at the last character to be substituted.

Searching for Text or Characters

,: Repeat the last f, F, t or T command in the reverse direction.
/: Search the file downwards for the string specified after the /.
;: Repeat the last f, F, t or T command.
?: Search the file upwards for the string specified after the ?.
F: Search the current line backwards for the character specified after the 'F' command. If found, move the cursor to the position.
N: Repeat the last search given by '/' or '?', except in the reverse direction.
T: Search the current line backwards for the character specified after the 'T' command, and move to the column after the if it's found.
f: Search the current line for the character specified after the 'f' command. If found, move the cursor to the position.
n: Repeat last search given by '/' or '?'.
t: Search the current line for the character specified after the 't' command, and move to the column before the character if it's found.

Manipulating Character/Line Formatting

~: Switch the case of the character under the cursor.
<: Shift the lines up to where to the left by one shiftwidth. "<<" shifts the current line to the left, and can be specified with a count.
>: Shift the lines up to where to the right by one shiftwidth. ">>" shifts the current line to the right, and can be specified with a count.
J: Join the current line with the next one. A count joins that many lines.

Saving and Quitting

^\: Quit out of "VI" mode and go into "EX" mode. The EX editor is the line editor VI is build upon. The EX command to get back into VI is ":vi".
Q: Quit out of "VI" mode and go into "EX" mode. The ex editor is a line-by-line editor. The EX command to get back into VI is ":vi".
ZZ: Exit the editor, saving if any changes were made.

Miscellany

^G: Show the current filename and the status.
^L: Clear and redraw the screen.
^R: Redraw the screen removing false lines.
^[: Escape key. Cancels partially formed command.
^^: Go back to the last file edited.
!: Execute a shell. If a is specified, the program which is executed using ! uses the specified line(s) as standard input, and will replace those lines with the standard output of the program executed. "!!" executes a program using the current line as input. For example, "!4jsort" will take five lines from the current cursor position and execute sort. After typing the command, there will be a single exclamation point where you can type the command in. &; Repeat the previous ":s" command.
.: Repeat the last command that modified the file.
:: Begin typing an EX editor command. The command is executed once the user types return. (See section below.)
@: Type the command stored in the specified buffer.
U: Restore the current line to the state it was in before the cursor entered the line.
m: Mark the current position with the character specified after the 'm' command.
u: Undo the last change to the file. Typing 'u' again will re-do the change.

EX Commands

The VI editor is built upon another editor, called EX. The EX editor only edits by line. From the VI editor you use the : command to start entering an EX command. This list given here is not complete, but the commands given are the more commonly used. If more than one line is to be modified by certain commands (such as ":s" and ":w" ) the range must be specified before the command. For example, to substitute lines 3 through 15, the command is ":3,15s/from/this/g".

:ab string strings: Abbreviation. If a word is typed in VI corresponding to string1, the editor automatically inserts the corresponding words. For example, the abbreviation ":ab usa United States of America" would insert the words, "United States of America" whenever the word "usa" is typed in.
:map keys new_seq: Mapping. This lets you map a key or a sequence of keys to another key or a sequence of keys.
:q: Quit VI. If there have been changes made, the editor will issue a warning message.
:q!: Quit VI without saving changes.
:s/pattern/to_pattern/options: Substitute. This substitutes the specified pattern with the string in the to_pattern. Without options, it only substitutes the first occurence of the pattern. If a 'g' is specified, then all occurences are substituted. For example, the command ":1,$s/Dwayne/Dwight/g" substitutes all occurences of "Dwayne" to "Dwight".
:set [all]: Sets some customizing options to VI and EX. The ":set all" command gives all the possible options. (See the section on customizing VI for some options.)
:una string: Removes the abbreviation previously defined by ":ab".
:unm keys: Removes the remove mapping defined by ":map".
:vi filename: Starts editing a new file. If changes have not been saved, the editor will give you a warning.
:w: Write out the current file.
:w filename: Write the buffer to the filename specified.
:w >> filename: Append the contents of the buffer to the filename.
:wq: Write the buffer and quit.

Linux File Permissions

2006-09-14T14:12:00.000-07:00

source: http://www.linuxforums.org/security/file_permissions.html

Understanding file permissions

In GNU/Linux every user has his own user account, and is a member of one or more user groups. Similarly, each file belongs to a user and to a user group. For restricting file access, GNU/Linux (and Unix in general) defines three different types of rights:

- Read (symbolized by the letter r), which means that the file can be read;
- Write (symbolized by the letter w), which means that the content of the file can be changed;
- Execute (symbolized by the letter x), which means that the file can be executed.

For each file, each of these rights (Read, Write and Execute) are defined for three sets of users :

- The user (symbolized by the letter u), who is the owner of the file.
- The group (symbolized by the letter g), who represents all the users who are members of the group which the file belongs to (as a file belongs both to a user, and a user group).
- The others (symbolized by the letter o), who basically represent all the users that are neither members of the group nor the owner of the file.

For instance, if a file belongs to George (as the owner) and Administrators (as the group), it can define different Read, Write and Execute permissions for George, for members of the "Administrators" group, and for all other users.

Reading file permissions : ls -l

All information related to file permissions is contained within the file and can be viewed by the "ls -l" command:

ls -l myfile
-rwxr-x---  1 george administrators 10 2006-03-09 21:31 myfile

As you can see in this example, the "ls -l" command gives a lot of information about the file "myfile":

- Its name, "myfile";
- Its permissions, "-rwxr-x---";
- Its owner, "george";
- Its group, "administrators";
- And other information which is not relevant to this article.

The way permissions are shown can seem a bit confusing if you're new to GNU/Linux or Unix, but don't be mistaken, it is very simple. The first character simply indicates the type of file as indicated in the table below:

Character	Type of file
-	regular file
d	directory
l	symbolic link
s	socket
p	named pipe
c	character device file (unbuffered)
b	blocked device file (buffered)

In this case myfile is a regular file. Let's have a look at the other nine characters: "rwxr-x---".

The first three characters indicate whether or not the read, write and execute permissions are given to the owner (in this case, George). If they are, their character representation appear (r, w or x), otherwise they are replaced by the character "-". In the same manner, the next three characters indicate whether or not these permissions are given to the group (in this case, Administrators). Finally, the last three characters indicate whether the same rights are given to the others (in this case, people who are not members of the Administrators group).

Letter	Permission
r	Read
w	Write
x	Execute, Go through (for directories)
-	No permission

Letter	Type of users
u	User (owner of the file)
g	Group (group to which belong the file)
o	Other (users who are neither a member of the Group nor the owner of the file)
a	All (everybody)

So, in our example myfile features the following set of permissions : "

rwxr-x---

". This means that George has all three rights on it, that members of the Administrators group can only read (R) and execute (X) the file, and that everybody else can't do anything with the file.

You could imagine that this file, written and maintained by George could be an executable script dedicated to the administrators and not made available to other users.. but hey.. this is only an example, so let's not assume too much :) The important thing is that you now understand the concept of file permissions and that you know how to read them using the "ls -l" command. The next step is to learn how to change them.

Changing file permissions : chmod

You can change the permissions of your files (or other people's files if you're the root superuser) by using the command "chmod". The syntax is very simple. For instance if George decides to give write permissions to the administrators, he will type:

chmod g+w myfile

g represents the group of the file (administrators).
w represents the write permission.
+ represents the fact that the permission is added.

If George then lists the permissions using ls -l he obtains:

ls -l myfile
-rwxrwx---  1 george administrators 10 2006-03-09 21:31 myfile

As you can see, the administrators now have write access to the file, and permission to change its content.

The "chmod" command takes 4 parameters:

- The type of users to apply the change of permissions for (u for user, g for group, o for others, a combination of them or a for all three of them).
- The type of change to make (+ to add permissions, - to remove permissions, = to define permissions)
- The type of permissions to apply the change with (r for read, w for write, x for execute)
- The file or group of files to apply the change on (filename for a precise file, but wildcard characters for multiple files)

Let's have a look at a few examples:

- chmod o+r myfile adds read permission to the others on myfile;
- chmod ug+rx myfile adds read and execute permissions to both the owner (user) and the group on myfile;
- chmod a-rwx myfile removes all permissions to everybody (all) on myfile;
- chmod a=rx *.txt defines permissions to be read and write to everybody on all files suffixed by .txt.

The chmod command also accepts another syntax which is quite popular among system administrators: the octal system. Rather than using letters such as u, g, o, a, r, w and x.. you can use octal numbers. The main advantage is that once you're used to it, it is faster to use. Also, because it sets permissions rather than adding or removing them, you don't accidentally overlook anything. Here is how the octal numbers work:

Each permission is given a value:

Permission	Value
-	0
x	1
w	2
r	4

Values add up when you combine permissions. Consequently the total value can go from 0 (no permission at all) to 7 (full permissions):

Permission	Value
---	0
--x	1
-w-	2
-wx	3
r--	4
r-x	5
rw-	6
rwx	7

Finally a value is given for each of the three types of users (User, Group and Other) and these three numbers ranging from 0 to 7 are put together to form the octal number. This is the number you can use with "chmod".

For instance:

chmod 750 myfile

750 means 7 (rwx) for the owner, 5 (r-x) for the group and 0 (---) for others. As a result, the permissions of myfile will be "rwxr-x---". As seen above this command is equivalent to:

chmod u=rwx,g=rw myfile; chmod o-rwx myfile;

Here are some common uses of the octal numbers:

- chmod 755 myfile : rwxr-xr-x, all rights to the owner, other people only read and execute;
- chmod 644 myfile : rw-r--r--, owner car read and write, other people only read;
- chmod 777 myfile : can be considered bad practice in some cases, full permissions to everybody.

Changing file owner or group : chown, chgrp

You can give ownership of your files to somebody else, or change the group that they belong to, by using the commands "chown" and "chgrp". "chown" allows you yo change the owner of the file, and "chgrp" allows you to change its group.

For instance, if George decides to give ownership of myfile to Robert, he can simply type:

chown robert myfile

Also, if Robert later on decides to make the file only available to members of the group "SeniorAdmin" group rather than to those of the group "Administrators", he can type:

chgrp senioradmin myfile

Note: The "chown" command also allows to change the group ownership. In fact George could have directly typed the following command:

chown robert:senioradmin myfile

Setting the sticky bit on a directory : chmod +t

If you have a look at the /tmp permissions, in most GNU/Linux distributions, you'll see the following:

clem@pluto:/$ ls -l | grep tmp
drwxrwxrwt   10 root root  4096 2006-03-10 12:40 tmp

The "t" in the end of the permissions is called the "sticky bit". It replaces the "x" and indicates that in this directory, files can only be deleted by their owners, the owner of the directory or the root superuser. This way, it is not enough for a user to have write permission on /tmp, he also needs to be the owner of the file to be able to delete it.

In order to set or to remove the sticky bit, use the following commands:

chmod +t tmp
chmod -t tmp

Setting the SGID attribute on a directory : chmod g+s

If the SGID (Set Group Identification) attribute is set on a directory, files created in that directory inherit its group ownership. If the SGID is not set the file's group ownership corresponds to the user's default group.

In order to set the SGID on a directory or to remove it, use the following commands:

chmod g+s directory
chmod g-s directory

When set, the SGID attribute is represented by the letter "s" which replaces the "x" in the group permissions:

ls -l directory
drwxrwsr-x  10 george administrators  4096 2006-03-10 12:50 directory

Setting SUID and SGID attributes on executable files : chmod u+s, chmod g+s

By default, when a user executes a file, the process which results in this execution has the same permissions as those of the user. In fact, the process inherits his default group and user identification.

If you set the SUID attribute on an executable file, the process resulting in its execution doesn't use the user's identification but the user identification of the file owner.

For instance, consider the script myscript.sh which tries to write things into mylog.log :

ls -l
-rwxrwxrwx  10 george administrators  4096 2006-03-10 12:50 myscript.sh
-rwxrwx---  10 george administrators  4096 2006-03-10 12:50 mylog.log

As you can see in this example, George gave full permissions to everybody on myscript.sh but he forgot to do so on mylog.log. When Robert executes myscript.sh, the process runs using Robert's user identification and Robert's default group (robert:senioradmin). As a consequence, myscript fails and reports that it can't write in mylog.log.

In order to fix this problem George could simply give full permissions to everybody on mylog.log. But this would make it possible for anybody to write in mylog.log, and George only wants this file to be updated by his myscript.sh program. For this he sets the SUID bit on myscript.sh:

chmod u+s myscript.sh

As a consequence, when a user executes the script the resulting process uses George's user identification rather than the user's. If set on an executable file, the SUID makes the process inherit the owner's user identification rather than the one of the user who executed it. This fixes the problem, and even though nobody but George can write directly in mylog.log, anybody can execute myscript.sh which updates the file content.

Similarly, it is possible to set the SGID attribute on an executable file. This makes the process use the owner's default group instead of the user's one. This is done by:

 chmod g+s myscript.sh

By setting SUID and SGID attributes the owner makes it possible for other users to execute the file as if they were him or members of his default group.

The SUID and GUID are represented by a "s" which replaces the "x" character respectively in the user and group permissions:

chmod u+s myscript.sh
ls -l
-rwsrwxrwx  10 george administrators  4096 2006-03-10 12:50 myscript.sh
chmod u-s myscript.sh
chmod g+s myscript.sh
ls -l
-rwxrwsrwx  10 george administrators  4096 2006-03-10 12:50 myscript.sh

Setting the default file creation permissions : umask

When a file is created, its permissions are set by default depending on the umask setting. This value is usually set for all users in /etc/profile and can be obtained by typing:

umask

The default umask value is usually 022. It is an octal number which indicates what rights will be removed by default to all new files. For instance, 022 indicates that write permissions will not be given to group and other.

By default, and with a umask of 000, files get mode 666 and directories get mode 777. As a result, with a default umask value of 022, newly created files get a default mode 644 (666 - 022 = 644) and directories get a default mode 755 (777 - 022 = 755).

In order to change the umask value, simply use the umask command and give it an octal number. For instance, if you want all new directories to get permissions rwxr-xr--- and files to get permissions rw-r----- by default (modes 750 and 640), you'll need to use a umask value which removes all rights to other, and write permissions to the group : 027. The command to use is:

umask 027

please, correct the article, to change line "ls -l | grep tmp" to "ls -ld tmp" , it's no good to teach people to bad behaviour... thanks

Be very careful when using SUID/SGID. If you follow the instructions above, then any user can become you and take full controll of whatever you can do, since the SUID file is world-writable.