Monday, January 23, 2012

How To Identify Major and Minor Number For Block Devices in Unix


Question: How do I find out the major and minor number of my block device / partition / mount points / SAN disk / filesystem?
Why do you need to know major and minor device number?
Sometimes you may need to know the major and minor number of devices for various reasons. For example, sar utility reports the i/o data of filesystems in the format of devm-n as shown below. (m is major number and n is minor number)

From sar man page following is the meaning for the DEV column shown below:
-d     Report activity for each block device (kernels  2.4  and  newer
       only).  When data is displayed, the device specification dev m-
       n is generally used ( DEV column).  m is the  major  number  of
       the  device.   With  recent  kernels (post 2.5), n is the minor
       number of the device, but is only a sequence  number  with  pre
       2.5 kernels.

By looking at the sar output below, we cannot tell what mount point (filesystem) dev110-1 indicates. In this case, you know that this device represents a block device that has a major number 110 and minor number 1.
$ sar -d
Linux 2.6.9-67.0.0.0.1.ELsmp (webserver)        06/21/2009

12:00:00 AM    DEV              tps    rd_sec/s  wr_sec/s
12:02:00 AM    dev110-1        6.00      0.00      6.00
12:02:00 AM    dev8-1           1.00      1.00      0.00
12:02:00 AM    dev1-1           2.00      1.00      1.00
12:02:00 AM    dev1-2           1.00      0.00      1.00
12:02:00 AM    dev1-3           4.00      2.00      2.00
12:02:00 AM    dev1-4           5.00      3.00      2.00

df -k will not display major and minor number

In the following example, when you perform a df -k, it shows that you have a local SCSI hard drive partition (/dev/sda1) mounted as / (root) and a SAN device partition (/dev/san-device1) mounted as /home/mysql. Please note that the SAN device can be a EMC, NetApps or any kind of SAN storage.
$ df -k
Filesystem           1K-blocks      Used Available Use% Mounted on
/dev/sda1             10317828   2353828   7439884  25% /
/dev/sandevice1   50537528  22350656  25619688  47% /home/mysql

How to identify major and minor device number?

Now, if you want to know the major and minor number of these devices, cd to /dev directory and do ls -l as shown below, which will show both major and minor number
$ cd /dev

$ ls -l sd*
brw-rw----  1 root disk 8,  0 Feb  8  2008 sda
brw-rw----  1 root disk 8,  1 Feb  8  2008 sda1

[Note: Major for /dev/sda1 is 8 and minor is 1]

$ ls -l san*
brw-------  1 root root 110,  0 Feb 8 sandevice
brw-------  1 root root 110,  1 Feb 8 sandevice1

[Note: Major for /dev/sandevice1 is 110 and minor is 1]
  • sda1 – Major number is 8 and Minor number is 1
  • sandevice1 – Major number is 110 and Minor number is 1

With this information now you can identify the corresponding device that is reported in the sar -d output.
$ sar -d
Linux 2.6.9-67.0.0.0.1.ELsmp (webserver)        06/21/2009

12:00:00 AM    DEV              tps    rd_sec/s  wr_sec/s
12:02:00 AM    dev110-1        6.00      0.00      6.00
12:02:00 AM    dev8-1           1.00      1.00      0.00

[Note: Now, we know dev110-1 is /dev/sandevice1 and
                    dev8-1 is /dev/sda1 ]

Major number for SCSI and IDE drives

The major numbers for SCSI and IDE doesn’t change and has the following hard-coded value.
  • SCSI (/dev/sd?) Major Number is 8
  • IDE (/dev/hd?) Major Number is 3

The Ultimate Guide to Create Users in Linux / Unix


eating users in Linux or Unix system is a routine task for system administrators.

Sometimes you may create a single user with default configuration, or create a single user with custom configuration, or create several users at same time using some bulk user creation method.

In this article, let us review how to create Linux users in 4 different methods using useradd, adduser and newusers command with practical examples.

Method 1: Linux useradd Command — Create User With Default Configurations
This is a fundamental low level tool for user creation. To create user with default configurations use useradd as shown below.
Syntax: # useradd LOGIN-NAME
 
While creating users as mentioned above, all the default options will be taken except group id. To view the default options give the following command with the option -D.
$ useradd -D
GROUP=1001
HOME=/home
INACTIVE=-1
EXPIRE=
SHELL=/bin/sh
SKEL=/etc/skel
CREATE_MAIL_SPOOL=no
 GROUP: This is the only option which will not be taken as default. Because if you don’t specify -n option a group with same name as the user will be created and the user will be added to that group. To avoid that and to make the user as the member of the default group you need to give the option -n.
  • HOME: This is the default path prefix for the home directory. Now the home directory will be created as /home/USERNAME.
  • INACTIVE: -1 by default disables the feature of disabling the account once the user password has expired. To change this behavior you need to give a positive number which means if the password gets expired after the given number of days the user account will be disabled.
  • EXPIRE: The date on which the user account will be disabled.
  • SHELL: Users login shell.
  • SKEL: Contents of the skel directory will be copied to the users home directory.
  • CREATE_MAIL_SPOOL: According to the value creates or does not create the mail spool.

Example 1: Creating user with all the default options, and with his own group.

Following example creates user ramesh with group ramesh. Use Linux passwd command to change the password for the user immediately after user creation.
# useradd ramesh

# passwd ramesh
Changing password for user ramesh.
New UNIX password:
Retype new UNIX password:
passwd: all authentication tokens updated successfully.

# grep ramesh /etc/passwd
ramesh:x:500:500::/home/ramesh:/bin/bash

# grep ramesh /etc/group
ramesh:x:500:
[Note: default useradd command created ramesh as username and group]

Example 2: Creating an user with all the default options, and with the default group.

# useradd -n sathiya

# grep sathiya /etc/passwd
sathiya:x:511:100::/home/sathiya:/bin/bash

# grep sathiya /etc/group
[Note: No rows returned, as group sathiya was not created]

# grep 100 /etc/group
users:x:100:
[Note: useradd -n command created user sathiya with default group id 100]

# passwd sathiya
Changing password for user sathiya.
New UNIX password:
Retype new UNIX password:
passwd: all authentication tokens updated successfully.
[Note: Always set the password immediately after user creation]

Example 3: Editing the default options used by useradd.

The following example shows how to change the default shell from /bin/bash to /bin/ksh during user creation.
Syntax: # useradd -D --shell=

# useradd -D
GROUP=100
HOME=/home
INACTIVE=-1
EXPIRE=
SHELL=/bin/bash
SKEL=/etc/skel
[Note: The default shell is /bin/bash]

# useradd -D -s /bin/ksh

# useradd -D
GROUP=100
HOME=/home
INACTIVE=-1
EXPIRE=
SHELL=/bin/ksh
SKEL=/etc/skel
[Note: Now the default shell changed to /bin/ksh]

# adduser priya

# grep priya /etc/passwd
priya:x:512:512::/home/priya:/bin/ksh
[Note: New users are getting created with /bin/ksh]

# useradd -D -s /bin/bash
[Note: Set it back to /bin/bash, as the above is only for testing purpose]

Method 2: Linux useradd Command — Create Users With Custom Configurations

Instead of accepting the default values (for example, group, shell etc.) that is given by the useradd command as shown in the above method, you can specify custom values in the command line as parameters to the useradd command.
Syntax: # useradd -s  -m -d  -g  UserName
 -s SHELL : Login shell for the user.
  • -m : Create user’s home directory if it does not exist.
  • -d HomeDir : Home directory of the user.
  • -g Group : Group name or number of the user.
  • UserName : Login id of the user.

Example 4: Crate Linux User with Custom Configurations Using useradd Command

The following example creates an account (lebron) with home directory /home/king, default shell as /bin/csh and with comment “LeBron James”.
# useradd -s /bin/csh -m -d /home/king -c "LeBron James" -g root lebron 

# grep lebron /etc/passwd
lebron:x:513:0:LeBron James:/home/king:/bin/csh
 
Note: You can give the password using -p option, which should be encrypted password. Or you can use the passwd command to change the password of the user.

Method 3: Linux adduser Command – Create Users Interactively

These are the friendlier tools to the low level useradd. By default it chooses the Debian policy format for UID and GID. A very simple way of creating user in the command line interactively is using adduser command.
Syntax: # adduser USERNAME

Example 5: Creating an User Interactively With adduser Command

# adduser spidey

Adding user `spidey' ...
Adding new group `spidey' (1007) ...
Adding new user `spidey' (1007) with group `spidey' ...
Creating home directory `/home/spidey' ...
Copying files from `/etc/skel' ...
Enter new UNIX password:
Retype new UNIX password:
passwd: password updated successfully
Changing the user information for spidey
Enter the new value, or press ENTER for the default
 Full Name []: Peter Parker
 Room Number []:
 Work Phone []:
 Home Phone []:
 Other []:
 Is the information correct? [y/N] y

Method 4: Linux newusers Command — Creating bulk users

Sometimes you may want to to create multiple users at the same time. Using any one of the above 3 methods for bulk user creation can be very tedious and time consuming. Fortunately, Linux offers a way to upload users using newusers command. This can also be executed in batch mode as it cannot ask any input.
# newusers FILENAME
 
This file format is same as the password file.
loginname:password:uid:gid:comment:home_dir:shell

Example 6: Creating Large Number of Users Using newusers Command

If Simpson family decides to join your organization and need access to your Linux server, you can create account for all of them together using newusers command as shown below.
# cat homer-family.txt
homer:HcZ600a9:1008:1000:Homer Simpson:/home/homer:/bin/bash
marge:1enz733N:1009:1000:Marge Simpson:/home/marge:/bin/csh
bart:1y5eJr8K:1010:1000:Bart Simpson:/home/bart:/bin/ksh
lisa:VGz638i9:1011:1000:Lisa Simpson:/home/lisa:/bin/sh
maggie:5lj3YGQo:1012:1000:Maggie Simpson:/home/maggie:/bin/bash
 
Now create accounts for Simpsons family together using the newusers command as shown below.
# newusers homer-family.txt

4 Effective Methods to Disable SELinux Temporarily or Permanently


On some of the Linux distribution SELinux is enabled by default, which may cause some unwanted issues, if you don’t understand how SELinux works and the fundamental details on how to configure it. I strongly recommend that you understand SELinux and implement it on your environment. But, until you understand the implementation details of SELinux you may want to disable it to avoid some unnecessary issues.
 
To disable SELinux you can use any one of the 4 different methods mentioned in this article.

The SELinux will enforce security policies including the mandatory access controls defined by the US Department of Defence using the Linux Security Module (LSM) defined in the Linux Kernel. Every files and process in the system will be tagged with specific labels that will be used by the SELinux. You can use ls -Z and view those labels as shown below.
# ls -Z /etc/
-rw-r--r--  root root  system_u:object_r:etc_t:s0       a2ps.cfg
-rw-r--r--  root root  system_u:object_r:adjtime_t:s0   adjtime
-rw-r--r--  root root  system_u:object_r:etc_aliases_t:s0 aliases
drwxr-x---  root root  system_u:object_r:auditd_etc_t:s0 audit
drwxr-xr-x  root root  system_u:object_r:etc_runtime_t:s0 blkid
drwxr-xr-x  root root  system_u:object_r:bluetooth_conf_t:s0 bluetooth
drwx------  root root  system_u:object_r:system_cron_spool_t:s0 cron.d
-rw-rw-r--  root disk  system_u:object_r:amanda_dumpdates_t:s0 dumpdates

Method 1: Disable SELinux Temporarily

To disable SELinux temporarily you have to modify the /selinux/enforce file as shown below. Please note that this setting will be gone after the reboot of the system.
# cat /selinux/enforce
1

# echo 0 > /selinux/enforce

# cat /selinux/enforce
0
 
You can also use setenforce command as shown below to disable SELinux. Possible parameters to setenforce commands are: Enforcing , Permissive, 1 (enable) or 0 (disable).
# setenforce 0

Method 2: Disable SELinux Permanently

To disable the SELinux permanently, modify the /etc/selinux/config and set the SELINUX=disabled as shown below. One you make any changes to the /etc/selinux/config, reboot the server for the changes to be considered.
# cat /etc/selinux/config
SELINUX=disabled
SELINUXTYPE=targeted
SETLOCALDEFS=0
 
Following are the possible values for the SELINUX variable in the /etc/selinux/config file
  • enforcing – The Security Policy is always Encoforced
  • permissive - This just simulates the enforcing policy by only printing warning messages and not really enforcing the SELinux. This is good to first see how SELinux works and later figure out what policies should be enforced.
  • disabled - Completely disable SELinux
 
Following are the possible values for SELINUXTYPE variable in the /etc/selinux/config file. This indicates the type of policies that can be used for the SELinux.
  • targeted - This policy will protected only specific targeted network daemons.
  • strict - This is for maximum SELinux protection.

Method 3: Disable SELinux from the Grub Boot Loader

If you can’t locate /etc/selinux/config file on your system, you can pass disable SELinux by passing it as parameter to the Grub Boot Loader as shown below.
# cat /boot/grub/grub.conf
default=0
timeout=5
splashimage=(hd0,0)/boot/grub/splash.xpm.gz
hiddenmenu
title Enterprise Linux Enterprise Linux Server (2.6.18-92.el5PAE)
root (hd0,0)
kernel /boot/vmlinuz-2.6.18-92.el5PAE ro root=LABEL=/ rhgb quiet selinux=0
initrd /boot/initrd-2.6.18-92.el5PAE.img
title Enterprise Linux Enterprise Linux Server (2.6.18-92.el5)
root (hd0,0)
kernel /boot/vmlinuz-2.6.18-92.el5 ro root=LABEL=/ rhgb quiet selinux=0
initrd /boot/initrd-2.6.18-92.el5.img

Method 4: Disable Only a Specific Service in SELinux – HTTP/Apache

If you are not interested in disability the whole SELinux, you can also disable SELinux only for a specific service. For example, do disable SELinux for HTTP/Apache service, modify thehttpd_disable_trans variable in the /etc/selinux/targeted/booleans file.
 
Set the httpd_disable_trans variable to 1 as shown below.
# grep httpd /etc/selinux/targeted/booleans
httpd_builtin_scripting=1
httpd_disable_trans=1
httpd_enable_cgi=1
httpd_enable_homedirs=1
httpd_ssi_exec=1
httpd_tty_comm=0
httpd_unified=1
 
Set SELinux boolean value using setsebool command as shown below. Make sure to restart the HTTP service after this change.
# setsebool httpd_disable_trans 1
# service httpd restart

Editcap Guide: 11 Examples To Handle Network Packet Dumps Effectively


Editcap utility is used to select or remove specific packets from dump file and translate them into a given format. Editcap does not perform packet captures like ethereal. Instead, it operates on the captured packets and writes some of the required packets into another file. We can pass various options to editcap to get our preferred packets.

In this article, let us review 11 practical examples on how-to use editcap to handle the packet dumps effectively.
Primary Purpose of editcap
Following are the main reason to use editcap command.
  • Divide a dump file into multiple files.
  • Select only the required packets.
  • Translate the capture file from one format to another.
  • Ability to read from a compressed dump file.
  • Make the job easier for network analyzer tool by loading only selective packets, instead of loading whole dump.
  • All feature results in less time consumption when processing or analyzing packets.
Let us assume the scenario where you have to analyze only some specific packet types in a huge dump file. In this situation, we cant use the network packet analyzer (wireshark or ethereal) to load the huge dump file in a single shoh, as it will be a CPU intensive process and the system may hang. Editicap utility makes the job easier by giving only relevant packets, so it could be loaded by network analyzer tool in quick time.
editcap is available in the wireshark package. Make sure wireshark/ethereal package is installed to use the editcap.
 11 Practical Examples Of edicap Usage

Example 1: Discard set of packets from the beginning of input_dump file

The output_dump file will contain all packets except the first 10 packets.
# editcap -v input_dump output_dump 1-10

Example 2: Discard set of packets from the middle of input_dump file

The output_dump file will contain all packets except packets from 200 to 210.
# editcap -v input_dump output_dump 200-210

Example 3: Select multiple range of packets (from beginning and middle)

The output_dump file will contain first 10 packets and packets from 100 and 200.
# editcap -r  -v input_dump output_dump 1-10  100-200

Example 4: Change the encapsulation type of the capture file using option -T

By default the encapsulation type of the dump file is ether. The example below, translates the capture file into ieee-802-11-bsd format
# editcap -v -T  ieee-802-11-radiotap input_dump output_dump

Example 5: Process the compressed input_dump files

editcap automatically detects the compressed capture file formats. Currently it supports for the gzip format. In the example below, it takes packets from the compressed input file and writes the first 10 packets and the packets in-between 100 and 200 into the output_dump file.
# editcap -r -v input_dump.gz output_dump 1-10 100-200

Example 6: Extract packets between a specific timeperiod using option -A and -B

This example create the output_dump, which contains the packets that are captured between the time mentioned in option A and the time mentioned in option B.
# editcap -v -A "2009-02-11 11:26:30" -B "2009-02-11 11:27:00"  input_dump output_dump

Example 7: Change packet’s timestamp (reduce or advance) using option -t

To advances the timestamp of packets to one hour.
# editcap -t 3600 input_dump output_dump
To reduces the timestamp of packets to 30 minutes,
# editcap -t -1800 input_dump output_dump

Example 8: Remove duplicate packets from the output_dump file using option -d

The example below looks back the previous frames to find the duplication. Finally it gives the dump which does not contain duplication.
# editcap -v -d input_dump output_dump

Example 9: Truncate the packets to the specific length using option -s

Produces the ouptut_dump file with packets length limited to 100. This can be very helpful under lot of situations. For example, you can use this method if you want to get only the IP layer of all the packets and does not require other layer.
# editcap -s 100 -v -A "2009-02-11 11:26:30" -B "2009-02-11 11:27:00"  input_dump.gz output_dump

Example 10: Divide input_dump file into multiple files using option -c

Divide the single dump into multiple file and each contains specified number of packets.
# editcap -v -c 1000 input_dump output
 
If the input_dump contains 5000 packets, editcap will generate the following 5 different output files.
output-00000
output-00001
output-00002
output-00003
output-00004

Example 11: Remove certain bytes from the bottom of all packets using option -C

This example removes 10 bytes from every packets and writes into the output file. You can confirm this, by viewing the output file in wireshark, the frame layer of every packet will show “50 bytes bytes on wire, 40 bytes captured” (here the actual size of a packet is 50 bytes).
# editcap -C 10 input_dump output