Linux (LAB) (CS-505) Unit 4 Notes - RGPV

How unit 4 is examined

This unit covers viewing, scheduling, prioritising and killing Unix processes, then system security: physical and login control, file permissions, ACLs, FTP, root access and TCP wrappers. No topic has been asked recently, so every topic is short but complete.

Viewing a Process

Not asked since 2022

Definition. A process is a program in execution, and viewing a process means listing the running processes with their details.

Key points.

Every process has a unique process ID (PID) that the kernel assigns when it starts.
Viewing shows who owns each process, how much CPU and memory it uses, and its state.
The main viewing tools are ps, pgrep, top and prstat.
A process is a running instance of a program, and ps gives a snapshot of it.

Command to display Process

Definition. The ps command prints a snapshot of the current processes, and top shows a live, refreshing list.

Key points.

Plain ps lists only the processes of your own terminal session.
ps -ef lists every process in full format, and ps aux gives the BSD-style listing with CPU and memory.
top refreshes every few seconds and sorts by CPU use, so heavy processes show at the top.
ps is a one-time snapshot, whereas top is continuous.

Process Attributes

Definition. Process attributes are the properties the kernel stores for every process.

Key points.

PID is the unique process number, and PPID is the PID of the parent that created it.
UID and GID record the owner and group, which decide the process's access rights.
Priority (nice value), the controlling terminal (TTY) and the current working directory are also stored.
Every process has a PID, a PPID, an owner and a priority.

Process States

Definition. A process state shows what the process is doing at that moment.

Key points.

Running (R) means the process is executing or ready to execute on the CPU.
Sleeping (S) means it is waiting for an event such as input, and stopped (T) means it was suspended by a signal.
Zombie (Z) means the process has finished but its parent has not yet read its exit status.
A zombie is a dead process whose entry stays in the table until the parent collects it.

Process Fields

Definition. Process fields are the columns that ps prints for each process.

Key points.

UID is the owner, PID the process ID, PPID the parent ID, and C the recent CPU usage.
STIME (or START) is the start time, TTY the terminal, and TIME the CPU time used so far.
CMD (or COMD) is the command that started the process.
The long listing ps -l adds S (state), PRI (priority), NI (nice value), SZ (size) and WCHAN (what it waits on).
The key fields are UID, PID, PPID, C, STIME, TTY, TIME and CMD.

PS Commands options

Definition. Options of ps select which processes are shown and how much detail is printed.

Key points.

ps -e lists every process on the system, and ps -f gives the full format.
ps -ef combines them and is the standard listing; ps -l gives the long format.
ps -u user lists the processes of one user, and ps -p PID shows one process.
ps aux is the BSD form that shows all users with %CPU and %MEM.
ps -ef is the usual command to see every process in full format.

PGREP

Definition. pgrep searches the running processes by name or other attribute and prints the matching PIDs.

Key points.

The syntax is pgrep pattern, for example pgrep sshd, and it replaces ps -ef | grep.
-l also prints the process name, -u user restricts the match to one user, and -x needs an exact name.
-n returns only the newest match and -o only the oldest.
pgrep returns PIDs directly, so its output can be passed to kill.

PRSTAT

Definition. prstat is the Solaris command that reports statistics of the active processes and refreshes them repeatedly.

Key points.

It shows PID, USERNAME, SIZE, RSS, STATE, PRI, NICE, TIME, CPU and PROCESS for each process.
The list is sorted by CPU usage by default, and the display refreshes every 5 seconds.
-u selects users, -s and -S sort the output, and -n limits the number of lines.
prstat is the Solaris counterpart of the Linux top command.

CDE Process Manager

Definition. The CDE Process Manager is a graphical tool of the Solaris Common Desktop Environment for viewing and stopping processes.

Key points.

It is opened from the Application Manager under the Desktop Tools folder.
It lists processes with their PID, owner, CPU and memory in a window that can be sorted.
A process is selected in the list and killed with the Kill option in the menu.
It does with the mouse what ps and kill do on the command line.

Scheduling Process

Definition. Scheduling a process means arranging for a command to run automatically at a later time or at regular intervals.

Key points.

at runs a job once at a stated time, for example at 10pm, and atq lists the waiting jobs.
cron runs jobs repeatedly, and each user keeps a table edited with crontab -e.
A crontab line has five time fields, minute, hour, day of month, month and weekday, followed by the command.
/etc/cron.allow and /etc/cron.deny control who may use cron.
at runs a job once and cron runs it repeatedly.

Scheduling Priorities

Definition. A scheduling priority decides which process gets the CPU first, and the nice value is the user-set part of it.

Key points.

In Linux the nice value runs from -20 (highest priority) to 19 (lowest), and the default is 0.
A higher nice value means the process is "nicer" to others and gets less CPU.
Ordinary users can only raise the nice value, whereas root can also lower it.
A lower nice number means a higher priority.

Changing the Priority of a time-sharing process

Definition. nice starts a command with a chosen nice value, and renice changes the value of a process that is already running.

Key points.

nice -n 10 command starts the command with 10 added to its nice value.
renice -n 5 -p PID changes the running process with that PID.
renice can also act on all processes of a user with -u.
Only root may give a negative value, because that raises priority.
nice sets the priority at start, and renice changes it later.

Killing Process

Definition. Killing a process means sending it a signal so that it terminates, using the kill command.

Key points.

The syntax is kill -signal PID, and the default signal is SIGTERM (15), which asks the process to exit cleanly.
kill -9 PID sends SIGKILL, which cannot be caught or ignored, so it is the last resort.
SIGHUP (1) tells a daemon to reread its configuration, and SIGINT (2) is Ctrl+C.
pkill name and killall name kill by name instead of PID.
kill -9 forces termination because SIGKILL cannot be ignored.

Physical Security

Definition. Physical security is protection of the computer hardware itself from theft, damage and unauthorised access.

Key points.

Servers are kept in locked rooms that only authorised staff can enter.
A firmware or boot-loader password stops a person with physical access from booting a different system.
Screen locks, cable locks and CCTV protect the machine, and backups are stored in a safe, separate place.
Without physical security, all software security can be bypassed.

Controlling System Access

Definition. Controlling system access means allowing only valid users to log in and limiting what they can do.

Key points.

Every user has a login name and a password stored in encrypted form in /etc/shadow.
Password ageing, minimum length and account locking after failed attempts make passwords stronger.
Unused accounts are deleted or locked, and no account may be left without a password.
/etc/nologin blocks ordinary logins during maintenance.
Access is controlled by valid user accounts with strong, ageing passwords.

Restricted Shells Controlling File Access

Definition. A restricted shell is a shell with limited abilities, such as rsh on Solaris or rbash (bash -r) on Linux.

Key points.

The user cannot change directory with cd.
The user cannot change PATH or SHELL, and cannot run a command that contains a slash.
Output redirection with > is not allowed.
It is set as the login shell of guests and untrusted users.
A restricted shell keeps the user inside a fixed set of commands and directories.

File Access Commands

Definition. File access commands set who owns a file and what the owner, group and others may do with it.

Key points.

chmod changes permissions in symbolic form (chmod u+x file) or octal form (chmod 754 file), where r=4, w=2 and x=1.
chown user file changes the owner, and chgrp group file changes the group.
ls -l shows the ten-character mode, and umask sets the default permissions of new files.
chmod 754 gives rwx to the owner, r-x to the group and r-- to others.

Access Control List(ACLs)

Definition. An ACL is a list attached to a file that gives permissions to specific users and groups beyond the owner, group and others.

Key points.

Ordinary permissions allow only one owner and one group, and ACLs remove this limit.
getfacl file displays the ACL entries.
setfacl sets, changes or removes them, and ls -l shows a plus sign (+) after the mode when a file has an ACL.
An ACL gives file permission to any named user or group.

Setting ACL Entries

Definition. Setting an ACL entry adds a permission for a user or group to a file with setfacl -m.

Key points.

The syntax is setfacl -m user:ravi:rw- file, and for a group setfacl -m group:staff:r-- file.
Solaris also allows setfacl -s to set the whole list at once.
The mask entry limits the maximum rights of all named users and groups.
setfacl -m user:name:perm file adds an entry for a named user.

Modifying ACL entries on a file

Definition. Modifying an ACL entry changes the permissions of an entry that already exists.

Key points.

The same command is used, setfacl -m user:ravi:r-- file, and the new permission replaces the old.
Several entries can be changed in one command by separating them with commas.
getfacl file should be run afterwards to confirm the change.
Modification uses setfacl -m again with the new permissions.

Deleting ACL entries on a file

Definition. Deleting an ACL entry removes one user or group entry from a file.

Key points.

In Linux setfacl -x user:ravi file removes one entry.
setfacl -b file removes all ACL entries and leaves the ordinary permissions.
On Solaris the delete option is setfacl -d user:ravi file.
setfacl -x deletes one entry and setfacl -b deletes them all.

Restricting FTP

Definition. Restricting FTP means limiting which users may connect and what they can reach on the FTP server.

Key points.

Names listed in the ftpusers file (/etc/ftpusers or /etc/ftpd/ftpusers) are denied FTP login, and root and system accounts must be listed.
Users can be confined to their home directory with a chroot setting, for example chroot_local_user=YES in vsftpd.
Anonymous FTP is disabled unless it is really needed.
Listing a user in ftpusers bars that user from FTP.

Securing Super User Access

Definition. Securing super user access means protecting the root account, which has unlimited power over the system.

Key points.

Root must have a strong password, and it should be shared with very few people.
sudo lets chosen users run chosen commands as root, as listed in /etc/sudoers, which is edited with visudo.
Each sudo use is logged, and users type their own password, not the root password.
Give users only the root commands they need, using sudo.

Restricting Root Access

Definition. Restricting root access means stopping root from logging in directly from insecure places.

Key points.

On Solaris, the line CONSOLE=/dev/console in /etc/default/login allows root login only on the console.
In Linux SSH, PermitRootLogin no in /etc/ssh/sshd_config blocks remote root login.
Users log in with their own accounts and use su or sudo afterwards, so actions can be traced.
Root can log in only on the console; everyone else uses su or sudo.

Monitoring super user Access

Definition. Monitoring super user access means keeping a record of who became root and when.

Key points.

Solaris writes every su attempt to /var/adm/sulog, marked + for success and - for failure.
Linux records su and sudo use in /var/log/auth.log (or /var/log/secure).
last and lastb show successful and failed logins.
Logs are checked regularly to detect misuse early.
sulog and auth.log show who used root and whether it succeeded.

TCP Wrappers

Definition. TCP wrappers control which hosts may use network services, using rules in /etc/hosts.allow and /etc/hosts.deny.

Key points.

The wrapper daemon tcpd checks the client address before it starts a service.
hosts.allow is read first, then hosts.deny, and the first matching rule wins.
A rule has the form service : client, for example sshd : 192.168.1. in allow and ALL : ALL in deny.
If no rule matches, access is allowed.
Allow specific hosts in hosts.allow and deny everyone else in hosts.deny.

Last-minute revision

PID is the unique process ID, and PPID is the parent's PID.
Process states are running, sleeping, stopped and zombie.
ps -ef shows all processes in full format, and ps aux is the BSD style.
pgrep prints PIDs by name, and prstat is the Solaris top.
at runs a job once, and cron runs it repeatedly with five time fields.
Linux nice runs from -20 to 19, default 0, and only root can lower it.
kill -9 sends SIGKILL, and the default kill sends SIGTERM (15).
chmod 754 means rwx for owner, r-x for group and r-- for others.
setfacl -m sets or modifies, setfacl -x deletes, and getfacl displays.
PermitRootLogin no and CONSOLE=/dev/console restrict root login.
hosts.allow is checked before hosts.deny.

Memory hooks

Zombie means dead but not collected, because the parent has not called wait.
Nice means kind, so a higher nice number gives away CPU and the priority is lower.
SIGKILL is number 9, "nine lives, none left".
-m modifies, -x xes out, -b blanks the whole ACL.
Allow is read first, and deny is the safety net after it.

Coverage checklist

Viewing a Process: no past questions (definition and tools covered).
Command to display Process: no past questions.
Process Attributes: no past questions.
Process States: no past questions.
Process Fields: no past questions.
PS Commands options: no past questions.
PGREP: no past questions.
PRSTAT: no past questions.
CDE Process Manager: no past questions.
Scheduling Process: no past questions.
Scheduling Priorities: no past questions.
Changing the Priority of a time-sharing process: no past questions.
Killing Process: no past questions.
Physical Security: no past questions.
Controlling System Access: no past questions.
Restricted Shells Controlling File Access: no past questions.
File Access Commands: no past questions.
Access Control List(ACLs): no past questions.
Setting ACL Entries: no past questions.
Modifying ACL entries on a file: no past questions.
Deleting ACL entries on a file: no past questions.
Restricting FTP: no past questions.
Securing Super User Access: no past questions.
Restricting Root Access: no past questions.
Monitoring super user Access: no past questions.
TCP Wrappers: no past questions.

Account

Linux (LAB) (CS-505) - Unit 4 Short Notes

How unit 4 is examined

Viewing a Process

Command to display Process

Process Attributes

Process States

Process Fields

PS Commands options

PGREP

PRSTAT

CDE Process Manager

Scheduling Process

Scheduling Priorities

Changing the Priority of a time-sharing process

Killing Process

Physical Security

Controlling System Access

Restricted Shells Controlling File Access

File Access Commands

Access Control List(ACLs)

Setting ACL Entries

Modifying ACL entries on a file

Deleting ACL entries on a file

Restricting FTP

Securing Super User Access

Restricting Root Access

Monitoring super user Access

TCP Wrappers

Last-minute revision

Memory hooks

Coverage checklist