Users Archives - ☩ Walking in Light with Christ - Faith, Computing, Diary ☩ Walking in Light with Christ

Posts Tagged ‘Users’

Enable automatic updates on CentOS 8 , CentOS 9 Stream Linux with dnf-automatic and Cockpit Web GUI package management tool

Wednesday, January 15th, 2025

Security for any OS is critical nowadays, thus as a CentOS legacy system admin at work or using CentOS Stream releases 8 and 9 that are to be around for the coming years

CentOS 8 and CentOS 9 Stream Lifecycle

CentOS Stream follows the same lifecycle as Red Hat Enterprise Linux. From version 8 onward this means every version is supported for 10 years, split into 5 years of Full Support and 5 years of maintenance support. Users also have the option to purchase an additional 3 years of Extended Life Cycle Support (ELS) as an add-on.

Version   General Availability   Full Support Ends   Maintenance Support Ends   Extended Life Cycle Support (ELS) Ends
8   May 7, 2019   May 31, 2024   May 31, 2029   May 31, 2032
9   May 18, 2022   May 31, 2027   May 31, 2032   May 31, 2035

In this article, you are going to learn how to enable automatic software updates on CentOS 8 and CentOS 9 ( Stream ) Linux OS-es. I'll show how to set up your system to download and apply security and other updates without user intervention.

It is really useful to use the CentOS automatic updates OS capability, turning on updates and instead typing all the time yum update && yum upgrade (and wasting time to observe the process) as it takes usually some 5 to 10 minutes to make the OS automatically install updates in the background and notify you once all is done so you can periodically check what the dnf-automatic automatic update tool has done that in most cases of success would save you at least few minutes per host. Automatic updates is critical especially if you have to maintain an infrastructure of CentOS virtual servers at version 8 or 9.

Those who use heavily used CentOS might have already enabled and used dnf-automatic, but I guess just like me until recently, most people using CentOS 8 don’t know how to enable and apply CentOS Linux updates automatically and those article might be helpful.

1. Enable Automatic CentOS 8 / 9 Updates Using DNF Automatic RPM Package

Install the DNF-automatic RPM package, it will provide a DNF component that enables start automatically the update process.
To install it on both CentOS 8 / 9.

[root@centos ~]# yum install dnf-automatic
CentOS Stream 9 – BaseOS 78 kB/s | 14 kB 00:00
CentOS Stream 9 – AppStream 28 kB/s | 15 kB 00:00
CentOS Stream 9 – Extras packages 81 kB/s | 18 kB 00:00
Dependencies resolved.
======================================================
Package Architecture Version Repository Size
======================================================
Installing:
dnf-automatic noarch 4.14.0-23.el9 baseos 33 k
Upgrading:
dnf noarch 4.14.0-23.el9 baseos 478 k
dnf-data noarch 4.14.0-23.el9 baseos 37 k
python3-dnf noarch 4.14.0-23.el9 baseos 461 k
yum noarch 4.14.0-23.el9 baseos 88 k

Transaction Summary
=======================================================
Install 1 Package
Upgrade 4 Packages

Total download size: 1.1 M
Is this ok [y/N]: y
Downloading Packages:
(1/5): dnf-data-4.14.0-23.el9.noarch.rpm 556 kB/s | 37 kB 00:00
(2/5): dnf-automatic-4.14.0-23.el9.noarch.rpm 406 kB/s | 33 kB 00:00
(3/5): yum-4.14.0-23.el9.noarch.rpm 1.4 MB/s | 88 kB 00:00
(4/5): python3-dnf-4.14.0-23.el9.noarch.rpm 4.9 MB/s | 461 kB 00:00
(5/5): dnf-4.14.0-23.el9.noarch.rpm 2.6 MB/s | 478 kB 00:00
——————————————————————————————————
Total 1.1 MB/s | 1.1 MB 00:00
Running transaction check
Transaction check succeeded.
Running transaction test
Transaction test succeeded.
Running transaction
Preparing : 1/1
Upgrading : dnf-data-4.14.0-23.el9.noarch 1/9
Upgrading : python3-dnf-4.14.0-23.el9.noarch 2/9
Upgrading : dnf-4.14.0-23.el9.noarch 3/9
Running scriptlet: dnf-4.14.0-23.el9.noarch 3/9
Installing : dnf-automatic-4.14.0-23.el9.noarch 4/9
Running scriptlet: dnf-automatic-4.14.0-23.el9.noarch 4/9
Upgrading : yum-4.14.0-23.el9.noarch 5/9
Cleanup : yum-4.14.0-9.el9.noarch 6/9
Running scriptlet: dnf-4.14.0-9.el9.noarch 7/9
Cleanup : dnf-4.14.0-9.el9.noarch 7/9
Running scriptlet: dnf-4.14.0-9.el9.noarch 7/9
Cleanup : python3-dnf-4.14.0-9.el9.noarch 8/9
Cleanup : dnf-data-4.14.0-9.el9.noarch 9/9
Running scriptlet: dnf-data-4.14.0-9.el9.noarch 9/9
Verifying : dnf-automatic-4.14.0-23.el9.noarch 1/9
Verifying : dnf-4.14.0-23.el9.noarch 2/9
Verifying : dnf-4.14.0-9.el9.noarch 3/9
Verifying : dnf-data-4.14.0-23.el9.noarch 4/9
Verifying : dnf-data-4.14.0-9.el9.noarch 5/9
Verifying : python3-dnf-4.14.0-23.el9.noarch 6/9
Verifying : python3-dnf-4.14.0-9.el9.noarch 7/9
Verifying : yum-4.14.0-23.el9.noarch 8/9
Verifying : yum-4.14.0-9.el9.noarch 9/9

Upgraded:
dnf-4.14.0-23.el9.noarch dnf-data-4.14.0-23.el9.noarch python3-dnf-4.14.0-23.el9.noarch yum-4.14.0-23.el9.noarch
Installed:
dnf-automatic-4.14.0-23.el9.noarch

Complete!
[root@centos ~]#

Here is info on what dnf-automatic package will do:

[root@centos ~]# rpm -qi dnf-automatic
Name : dnf-automatic
Version : 4.14.0
Release : 23.el9
Architecture: noarch
Install Date: Wed 15 Jan 2025 08:00:47 AM -03
Group : Unspecified
Size : 57937
License : GPLv2+
Signature : RSA/SHA256, Thu 02 Jan 2025 01:19:43 PM -03, Key ID 05b555b38483c65d
Source RPM : dnf-4.14.0-23.el9.src.rpm
Build Date : Thu 12 Dec 2024 07:30:24 AM -03
Build Host : s390-08.stream.rdu2.redhat.com
Packager : builder@centos.org
Vendor : CentOS
URL : https://github.com/rpm-software-management/dnf
Summary : Package manager – automated upgrades
Description :
Systemd units that can periodically download package upgrades and apply them.

Next up is configuring the dnf-automatic updates. The configuration file is located at /etc/dnf/automatic.conf. Once you have opened the file, you can to set the required values to fit your software requirements.
The values you might want to modify are as so:

[root@centos ~]# grep -v \# /etc/dnf/automatic.conf|sed '/^$/d'
[commands]
upgrade_type = default
random_sleep = 0
network_online_timeout = 60
download_updates = yes
apply_updates = no
reboot = never
reboot_command = "shutdown -r +5 'Rebooting after applying package updates'"
[emitters]
emit_via = stdio
[email]
email_from = root@example.com
email_to = root
email_host = localhost
[command]
[command_email]
email_from = root@example.com
email_to = root
[base]
debuglevel = 1
[root@centos ~]#

The most important things you need to tune in automatic.conf are:

[root@centos ~]# vim /etc/dnf/automatic.conf

apply_updates = no

should be changed to yes

apply_updates = yes

for automatic updates to start by dnf-automatic service

It is nice to set the email server to use configuration values, as well as email from, email to and the way for
email to be set emit_via = stdio is default (check out the other options if to be used inside the commented lines)

Finally, you can now run dnf-automatic, execute the following command to schedule DNF automatic updates for your CentOS 8 machine.

[root@centos ~]# systemctl enable –now dnf-automatic.timer

The command above enables and starts the system timer. To check the status of the dnf-automatic service, run the following.

[root@centos ~]# systemctl list-timers *dnf-*
NEXT LEFT LAST PASSED UNIT ACTIVATES
Wed 2025-01-15 09:31:52 -03 13min left – – dnf-makecache.timer dnf-makecache.service
Thu 2025-01-16 06:21:20 -03 21h left Wed 2025-01-15 08:09:20 -03 1h 8min ago dnf-automatic.timer dnf-automatic.service

2 timers listed.
Pass –all to see loaded but inactive timers, too.
[root@centos ~]#

Enable and Manage Automatic updates with Cockpit GUI web interface

Sooner or later even hard core sysadmins has to enter the 21 century and start using a Web interfaces for server or Desktop Linux management to offload your head for more important stuff.
Cockpit is a great tool to help you automatically manage and update your servers with no need to use the Linux console most of the time.

Cockpit is a very powerful tool you can use to manage remotely updates through a web interface, it is very handy tool for system admins as it gives you overview over updates and supports automatic updates and set RPM package management tasks through web-based console.
Cockpit allows updates over multiple servers and it makes it a kind of server orchestration tool that allows yo to update many same versioned operating system software.

If you haven't it already pre-installed in CentOS 8 / 9 depending on the type ofinstall you have done, you might need to install Cockpit.

To install cockpit

[root@centos ~]# yum install cockpit -y

To make the web service accessible in a browser you'll have to start it with cmds:

[root@centos ~]# systemctl start cockpit
[root@centos ~]# systemctl status cockpit

To access cockpit you'll either have to access it on https://localhost:9090 in case you need to access it locally via https://SERVER_IP:9090/.
Note that of course you will have to have firewalld enabling traffic to SERVER_IP PORT 9090.

By default cockpit will run with self signed certificate, if you need you can set up a certbot certificate or regenerate the self signed one for better managed security risk. For a first time if you haven't changed the certificate simply use the browser exclusion menu and login to Cockpit.

Once logged in you can check the available updates.

centos-steam-cockpit-web-gui-autoupdate-tool-linux-screenshot0

By default you will have to login with non-root account, preferably that should be an account who is authorized to become root via sudo.
To elevate to administrative privileges while in cockpit clock on 'Administrative access' and grant cockpit your superuser privileges.

centos-steam-cockpit-web-gui-autoupdate-tool-linux-screenshot2

Once authorized you can run the upgrade and enojy a coffee or beer in the mean time 🙂

centos-steam-cockpit-web-gui-autoupdate-tool-linux-screenshot-update-ongoing

Among the useful cockpit options, is also the Terminal through which you can run commands like over a normal Web SSH service.

The 'Logs' section is also very useful as it shows you clearly synthesized information on failed services and modules, since last OS system boot.

To add and manage updates for multiple hosts use the 'Add new host' menu that is a expansion of the main machine on which cockpit runs.

centos-steam-cockpit-web-gui-autoupdate-tool-linux-automatic-updates-settings

In the next window, turn automatic updates ON. You can now select the type of updates you want (Apply All Updates or Apply Security Updates), the day and time you want the updates applied, and the server rebooted.

CentOS 9's cockpit even have support for the innovative Kernel live patching, so the machine kernel can be updated even Live and you can save the reboot after complete patching of OS including the kernel.

Note that you cannot set up automatic updates without rebooting the system. Therefore, make sure your server can be rebooted at the time you’ve selected for the updates.

Sum it up

In this post, we learned have learned how to set up automatic updates for your CentOS 8 / 9 Linux. There are two main stream ways you can do it.
1. By using DNF automatic updates tool.
By enabling DNF automatic updates on CentOS 8 Linux the machine updated is faster, seemless and frequent as compared to manual updates.

This protects the OS more about crackers cyber-attacks. Secondly for the more lazy admins or for better structuring of updates (if it has to be executed on multiple hosts), the Cockpit web console is available.

With Cockpit, it’s much easy to enable automatic updates as the GUI is self-explanatory graphical user interface (GUI) as opposed to the DNF automatic updates, which would waste you more time on CLI ( shell ).

Tags: CentOS, check, cmds, command, configuration file, dnf, noarch, package updates, rpm, running, Stream Lifecycle, Stream Linux, Users
Posted in CentOS, Linux, Linux and FreeBSD Desktop | 1 Comment »

How to set up custom Logon and Lockscreen background of Windows 7

Thursday, March 16th, 2017

If you travel frequently and use your Windows 7 OSed PC in Coffee Clubs and various locations including Airports or public places, you might want to also obfuscate Windows's login screen to prevent it to be easily recognizable you're on a Windows by its default Blue and all known Login and Lockout screns for security or just for personal fun show off your l337 Skills to your colleagues at work and in this article I'll shortly explain how this is possible on Windows 7 the same is easily possible to do also on Windows 8 and Win 10 and I'll explain this as well in a separate article some time I have time in future.

In Windows 7 by default the Login Screen background is identical to its Lock Screen, one that appears on Windows (button) + L combination and through which if the computer is once locked you can login by pressing CTRL + ALT + DEL key combination, after which standardly you're either prompted for your password or if its a Domain connected corporate PC you're asked for your PIN or picture password.

Windows 7 Users: Set a Custom Login Background

To use a custom login background in Windows 7, you need to

1. Do Windows Registry edit – in order to enabled custom backgrounds
2. And then store the image you want in a special Windows folder.

Step One: Enable Custom Backgrounds in Windows 7

For Windows 7, the ability to set a custom logon background is intended for original equipment manufacturers (OEMs) to customize their systems, but there’s nothing stopping you from using this feature yourself.

As I said prior Windows 7 background change feature is disabled by default, so you’ll have to enable it from the Registry Editor. You can also use the Group Policy Editor if you have a Professional version of Windows (or you're configuring the background for a a whole bunch of Domain run Windows PCs).

Launch Registry Editor by hitting Start, typing “regedit,” and then pressing Enter.

windows-7-run-regedit

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\LogonUI\Background

windows-7-registry-setting-to-change-login-and-lockout-background-screenshot

In the right pane, you’ll see a value named OEMBackground. Note that, If you don’t see that value, you’ll need to create it by right-clicking the Background key, choosing

New -> DWORD (32-bit) Value

and then naming the new value “OEMBackground.”

Double-click the OEMBackground value to open its properties window, set its value to 1 in the “Value data” box, and then click “OK.”

oem-background-winsows-7-registry-setting-howto-change-login-and-lockout-screen-background

!! Be Aware that !!:
If at any point you decide to select a new theme in the Appearance and Personalization window, this will reset above already made registry value.
Selecting a theme will change the value of the key to the value stored in the theme’s .ini file—which is most likely 0.
Thus in case you do change theme, to have the background be the custom set make sure you don't forget to perform the Registry tweak again.

windows-7-appearance-and-personalization-control-panel-setting-screenshot

If you're running a Windows Professional or Windows Enterprise alternative way to set custom background is to directly change using the Local Group Policy Editor instead. The advantage of using Local Group Policy Editor to set a custom Login or Lockout screen background is it will be kept persistent even if you change your themes.

To do it via LGPE,

Launch Local Group Policy Editor by pressing Start, typing “gpedit.msc,” and then hitting Enter.

gpedit.msc-windows-7-screenshot

drill down to the following location:

Computer Configuration\Administrative Templates\System\Logon

On the right, you’ll find a setting named “Always use custom login background.” Double-click that setting and, in the setting’s properties window, select “Enabled” and then click “OK.”

always-use-custom-logon-background-screenshot

Next step is to actually set the image you want to use.

Finally Set the Custom Background Image of choice

You can use any image you like, but there are two things you’ll need to keep in mind:

!! Your image must be less than 256 KB in size. !!

You may need to convert your image to something like JPG format to make that happen.
Try find image that matches the resolution of your monitor so it doesn’t look stretched.

Windows looks by default for the custom logon screen background image in the following directory:

C:\Windows\System32\oobe\info\backgrounds

Also defaultly, “info” and “backgrounds” folders donesn't exist, so you’ll need to navigate to C:\Windows\System32\oobe folder and create the subfolders on your own.

c-windows-system32-oobe-screenshot

After creating the folders
C:\Windows\System32\oobe\info\backgrounds

Copy whatever background image_whatever.jpg you want to the backgrounds folder and rename the image file to “backgroundDefault.jpg.”

Tags: change, change lockout screen windows, change login background windows 7, change windows login and lockout screen picture, default, How to, howto change login background win, look, need, reset, theme, Users, value, Windows
Posted in Curious Facts, Everyday Life, Various, Windows | 1 Comment »

Free Software Remote Desktop for Mac OS X – CoRD simple RDP remote desktop for Mac

Monday, August 4th, 2014

If you're admin using Mac OS X Desktop or casually on a place where you have no access to a Windows / Linux PC (only have access to your girlfriend of wife MAC OS notebook) and you need to administrate Windows hosts remotely out of office hours (from home), you will need some remote desktop client for Mac OS X.

I was just recently in that situation as we were guests to a friend in Shabla village nearby Sea coast and the only near PC, I had was my wife's MacBook Air running Mac OS X.

I looked in google to see if there is some default RDP (remote desktop protocol) client like MS Windows remote desktop command line client, i.e. (yes there is way to invoke remote desktop on Windows from command line 🙂 ):

mstsc [] [/v:] [/admin] [/f[ullscreen]] [/w:] [/h:] [/public] | [/span] [/edit “connection file”] [/migrate] [/?]

remote-desktop-run-from-windows-command-line-rdp-command-line-ms-windows-screenshot

I also looked if there is Mac OS X version ofLinux's rdesktop (command) or RDP Linux GUI remmina
however I didn't find direct port of em, neither there is default integrated RDP Client on Mac OS X, thus after researching a bit further I tried installing the first returned result in Google which was leading to Apple's AppStore – Apple – Remote Desktop.

I tried installing the clicking it but it seemed my wife, didn't know her AppStore as it was her cousin which earlier configured her Mac OS PC on laptop initial install time. Contacting her cousin to ask for the password was a time eater as well as I was lazy to create new appstore account (plus I always prefer to use free software alternative when possible) … did a quick search in Google whether there is some Open Source / Free Software Remote Desktop Client for Mac OS X and I found CoRD – Mac OS X remote desktop client for Microsoft Windows computers using the RDP protocol.
CoRD was originally ported from UNIX program rdesktop.
To have CoRD working you will need as a minimum requirement Mac OS X version 10.5 or later.

CoRD-Free-Software-Open_Source-remote-desktop-client-for-mac-osx
Here is CoRD's description quoted from its SourceForge website:

CoRD: Simple RDP Remote Desktop

Macs interact well with Windows, and with CoRD the experience is a bit smoother. Great for working on the office terminal server, administrating servers or any other time you'd like your PC to be a bit closer without leaving your Mac. CoRD allows you to view each session in its own window, or save space with all sessions in one window. Scale session windows to whatever size fits you—the screen is resized automatically. Enter full screen mode and feel like you're actually at the computer. The clipboard is automatically synchronized between CoRD and the server. For system administrators, CoRD creates a simpler workflow by allowing you to save server information, then quickly connect to that server by using HotKeys or the server drawer. This makes quickly connecting to a specific server easy, even when managing many servers.

Installing CoRD is pretty, straight forward, just download unzip the archive and run it:

cord-remote-desktop-free-software-client-mac-osx-install-warning-screenshot

cord-remote-desktop-free-software-client-mac-osx-install-warning-screenshot.png

cord-open-source-rdp-client-mac-osx

To later run Cord either look it up in Finder or if you prefer like me to access it from command line, you will need to export CoRD PATH in Mac Terminal $PATH variable:

add-cord-remote-desktop-lcient-command-to-default-path-mac-osx

As you see in above screenshot to find out which directory is CoRD located, I've grepped through the processes with

ps ax | grep cord

and then added it to PATH with:

export PATH=$PATH:/Users/svetlana/Application/CoRD.app/Contents/MacOS/

Remembering CoRD to type it each time is annoying, thus to make CorD be accessed like on Linux with rdesktop (easy to remember command), I've used alias:

alias rdesktop='CoRD'

To make the new PATH and alias permanent for the user, I've added it to (/Users/svetlana) – ~/.profile

echo "export PATH=$PATH:/Users/svetlana/Application/CoRD.app/Contents/MacOS/" >> ~/.profile
echo "alias rdesktop='CoRD'" >> ~/.profile

Current CoRD MacOSX version is 0.5.7, for personal ease if I need to install it in future time, I've made my own mirror of cord here.

There is also Microsoft Remote Desktop client for Mac OS 2.1.1 however this version was released back in 2011 and is outdated (not supported for use with Mac OS X v10.7 (Lion) or later).

Tags: alias, bit, command, microsoft windows, need, remote desktop client, screen mode, screenshot, servers, sessions, system administrators, time, Users
Posted in Everyday Life, Mac OS X, System Administration, Various | 1 Comment »

FreeBSD Desktop: Allow All system users to mount CDROM, DVD, USB Devices and other external devices

Friday, November 16th, 2012

Users who use FreeBSD for multiple logins Desktop host or in universities multiple login Desktop shared user PCs will have problems with mounting CD and DVD Roms, Usbs and other external devices. To mount any of those a root or toor superuser will be required and this makes a really bad impression to the novice users, making them think FreeBSD is user unfriendly, where in reality it was just build to behave so with higher security in mind.
This ruins a whole user GNOME experience and disappoints the end user, especially if the user is just a person who needs to do some browsing and copy few files from and to the host.
This prevents udevd and auto mount in GNOME and KDE GUI environments to be unable to automatically mount and unmount CD / DVDs and USBS where plugged or unplugged but instead just poping up permission errors whether CD or USB is attached.
Thanksfully, you can change this behavior to make FreeBSD a bit more user friendly and of course 'less secure' by few simple commands 🙂

Here is how:

freebsd# sysctl -w vfs.usermount=1

vfs.usermount: 0 -> 1

echo 'vfs.usermount=1' >> /etc/sysctl.conf

What is required next is to add all devices which will be mountable by all users in /dev/devfs.conf.

To get a list of devices do:
freebsd# camcontrol devlist

at scbus0 target 0 lun 0 (pass0,da0) at scbus1 target 3 lun 0 (pass1,sa0) at scbus1 target 6 lun 0 (pass2,cd0) #

Most USB devices are recognized and assigned as /dev/da0, and almost all CD and DVD Rom devices will be initialized by kernel as /dev/cd0, however if you get something different just set the appropriate vals.

a) Add permission records for CD / DVD ROM in /etc/devfs.conf
freebsd# echo 'own /dev/da0 root:operator' >> /etc/devfs.conf freebsd# echo 'perm /dev/da00 0666' >> /etc/devfs.conf

b) Add permission records for USBs in /dev/devfs.conf

freebsd# echo '## allow member of operator to mount cdrom' >> /etc/devfs.conf freebsd# echo 'own /dev/cd0 root:operator' >> /etc/devfs.conf freebsd# echo 'perm /dev/cd0 0660' >> /etc/devfs.conf

To allow, all present system users to have access to mount USB, CD / DVD roms, it is necessery to add all users to the operator, group. This is a security bad practice as this will make allow all users to have extra permissions to binaries on the system owned or allowed to be accessed by operator group. However for home computers, where you, your sister and a bunch of good friends have accounts, security shouldn't be of a great concern.

If you know well all your users and you have disabled SSH on the system and security is not of top priority run:

freebsd# /usr/local/bin/bash root@freebsd~# for i in /home/*; do user=$(echo $i|sed -e 's#/home/##g'); do \ pw groupmod operator -m $user; \ done

Onwards, you can check few users to see to see if they are added to operator group

freebsd$ id uid=1001(hipo) gid=1001(hipo) groups=1001(hipo),0(wheel),5(operator)

Well that's all now your GNOME hal process – (Hardware Abstraction Layer) will be able to manage CD / DVDs and USBs with no more weird errors.

This article was inspired by cybercity's Allow normal users to mount CDROMs DVDs and USB devices. So thanks 'em for being a source of inspiration.

Enjoy 🙂

Tags: ALLOW, Desktop, freebsd, mount, system, Users
Posted in FreeBSD, Linux and FreeBSD Desktop, System Administration | No Comments »

Change default new created Debian users insecure (all users read) permissons to secure

Tuesday, September 11th, 2012

In older versions of Debian, the directory permnissions of /home/ directory used to be secure. As of time of writing this post in Debian GNU / Linux Squeeze (6.0.5), default permissions are set to such, that all permissions are set readable for all users. e.g.:

debian:~$ ls -al /home/test drwxr-xr-x 3 test test 4096 Jul 24 10:51 test

This kind of permissions are probably set like this because of Apache configuration to display every user custom file content in web via /home/[users]/public_html through http://website-url.com/~test … (whatever) ~username.

This is great for machines which are supposed to be used for hosting, but for mail server or SQL Database host such permissions of new created users is quite insecure practice. Also such a /home directory settings are not good even for Webserver hosting servers, which did not display any web content via /home/ users directories.

Therefore on each new configured Debian server it is a wonderful practice to change default new created user to only readable, writable and executable by the user itself ….

To do so;

1. Edit /etc/adduser.conf

Change the variable:

DIR_MODE=755

DIR_MODE=700

This will not affect the permissions of current existing directories in /home/, i.e. /home/user1 , /home/user2 etc. but any new created one with adduser or useradd cmd will get permissions of 700

Here are permissions of recent created user syrma:

debian:~# useradd syrma debian:~# ls -ld /home/syrma drwxr-xr-x 98 syrma syrma 12288 7 ceâ—ˆ 13,56 hipo/

In /etc/adduserconf, there are plenty of other useful options, you might want to tune (depending on the type of new configured server). Few worthy to change sometimes are:

FIRST_UID=1000, LAST_UID=29999 FIRST_GID=1000, LAST_GID=29999

This two controls how the USER IDSs (UID) and GROUP IDs (GID)s will get assigned. In some cases it might be useful to assign new users from 1000 onwards.

Another helpful variable to tune for creating new users from there is DSHELL, on Linux defaulting to DSHELL=bash shell.

If there is a necessity to set a GLOBAL new created user quota, this is easily done also via adduser.conf. The file allows you to disable certain strings in username from present in new user logins, configure if new users will have their separate directory or belong to a system wide (user group – like in Slackware) and few others. I suggest anyone new to Linux who hears it for a first time check it.

It is maybe worthy to mention in present moment on Ubuntu Linux, by default /etc/adduser.conf, DIR_HOME=700 (is restrictive).
For some new users, who try to configure Apache read /home/[user_dir]/public_html. This could lead to unexplainable errors like:

[Tue Sep 11 10:20:17 2012] [crit] [client 127.0.0.1] (13) Permission denied:/home/syrma/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable

This error is due to /home/syrma, improper permissions (Apache) server user (www-data) fails to read /home/syrma directory content and the Apache forked child exits with the respective error.log critical err.

If you get some errors like this, the fix is to just make the directory with readable and executable flag for all users:

# chmod -R 0755 /home/syrma

Tags: change, created, Debian, default, insecure, Users
Posted in Linux, System Administration, Web and CMS | No Comments »

How to quickly check unread Gmail emails on GNU / Linux – one liner script

Monday, April 2nd, 2012

I've hit an interesting article explaining how to check unread gmail email messages in Linux terminal. The original article is here

Being able to read your latest gmail emails in terminal/console is great thing, especially for console geeks like me.
Here is the one liner script:

curl -u GMAIL-USERNAME@gmail.com:SECRET-PASSWORD \ --silent "https://mail.google.com/mail/feed/atom" | tr -d '\n' \ | awk -F '' '{for (i=2; i<=NF; i++) {print $i}}' \ | sed -n "s/

Linux Users Group M. – [7] discussions, [10] comments and [2] jobs on LinkedIn Twitter – Lynn Serafinn (@LynnSerafinn) has sent you a direct message on Twitter! Facebook – Sys, you have notifications pending Twitter – Email Marketing (@optinlists) is now following you on Twitter! Twitter – Lynn Serafinn (@LynnSerafinn) is now following you on Twitter! NutshellMail – 32 New Messages for Sat 3/31 12:00 PM Linux Users Group M. – [10] discussions, [5] comments and [8] jobs on LinkedIn eBay – Deals up to 60% OFF + A Sweepstakes! LinkedIn Today – Top news today: The Magic of Doing One Thing at a Time NutshellMail – 29 New Messages for Fri 3/30 12:00 PM Linux Users Group M. – [16] discussions, [8] comments and [8] jobs on LinkedIn Ervan Faizal Rizki . – Join my network on LinkedIn Twitter – LEXO (@LEXOmx) retweeted one of your Tweets! NutshellMail – 24 New Messages for Thu 3/29 12:00 PM Facebook – Your Weekly Facebook Page Update Linux Users Group M. – [11] discussions, [9] comments and [16] jobs on LinkedIn

As you see this one liner uses curl to fetch the information from mail.google.com's atom feed and then uses awk and sed to parse the returned content and make it suitable for display.

If you want to use the script every now and then on a Linux server or your Linux desktop you can download the above code in a script file -quick_gmail_new_mail_check.sh here

Here is a screenshot of script's returned output:

A good use of a modified version of the script is in conjunction with a 15 minutes cron job to launch for new gmail mails and launch your favourite desktop mail client.
This method is useful if you don't want a constant hanging Thunderbird or Evolution, pop3 / imap client on your system to just take up memory or dangle down the window list.
I've done a little modification to the script to simply, launch a predefined email reader program, if gmail atom feed returns new unread mails are available, check or download my check_gmail_unread_mail.sh here
Bear in mind, on occasions of errors with incorrect username or password, the script will not return any errors. The script is missing a properer error handling.Therefore, before you use the script make sure:

gmail_username='YOUR-USERNAME'; gmail_password='YOUR-PASSWORD';

are 100% correct.

To launch the script on 15 minutes cronjob, put it somewhere and place a cron in (non-root) user:

# crontab -u root -e ... */15 * * * * /path/to/check_gmail_unread_mail.sh

Once you read your new emails in lets say Thunderbird, close it and on the next delivered unread gmail mails, your mail client will pop up by itself again. Once the mail client is closed the script execution will be terminated.
Consised that if you get too frequently gmail emails, using the script might be annoying as every 15 minutes your mail client will be re-opened.

If you use any of the shell scripts, make sure there are well secured (make it owned only by you). The gmail username and pass are in plain text, so someone can steal your password, very easily. For a one user Linux desktops systems as my case, security is not such a big concern, putting my user only readable script permissions (e.g. chmod 0700)is enough.

Tags: article, atom, Auto, awk, client, com, cron, Desktop, download, Draft, ebay, email, email marketing, email messages, facebook, Fri, geeks, Gmail, GMAIL-USERNAME, GNU, gnu linux, google, Group, https mail, liner, LinkedIn, Linux, linux server, linux users group, mail, marketing, news today, OFF, original article, password, quot, rizki, sat 3, script, SECRET-PASSWORD, terminal, thing, top news, twitter, username, Users, Weekly
Posted in Linux, System Administration, Various | 2 Comments »

☩ Walking in Light with Christ – Faith, Computing, Diary

Posts Tagged ‘Users’

Free Software Remote Desktop for Mac OS X – CoRD simple RDP remote desktop for Mac

CoRD: Simple RDP Remote Desktop

FreeBSD Desktop: Allow All system users to mount CDROM, DVD, USB Devices and other external devices

Daily Bible quote

GET ARTICLE UPDATES

Useful blog? Help it:

Links to Other Places

Recent Posts

Ads

Categories

About Myself

Recent Comments

Top Post Views

blogtopsites