Scripts to Check Policies in Linux Such as Grub BootLoader Password, Prompting Password in Single user mode

(1) CTR ALT DEL SHUTDOWN POLICY

#!/bin/bash

echo "This script Check CTR ALT DEL POLICY Working or NOT "

f="/etc/inittab"

if [ -e $f ]

then

cd /etc

echo " U R in `pwd` "

s=`cat inittab | grep "^ca::ctrlaltdel:/sbin/shutdown -t3 -r now"`

if [ ! -n "$s" ]

then

echo " POLICY not Working "

else

echo "POLICY Working Properly "

fi

fi

 output

[root@CLIENT ~]# ./CtrAltDel.sh

This script Check CTR ALT DEL POLICY Working or NOT

 U R in /etc

POLICY Working Properly

(2) PASSWORD PROTECTING GRUB

#!/bin/bash

echo "This script check grub bootloader is password protected or not"

f="/boot/grub/grub.conf"

if [ -e $f ]

then

cd /boot/grub

echo " U R in `pwd` "

s=`cat grub.conf | grep "^password --md5"`

echo " PASSWORD OF GRUB IS  $s "

if [ ! -n "$s" ]

then

echo "Not Verified"

else

echo "Password  Implemented "

fi

fi

output

[root@CLIENT ~]# ./grub.sh

This script check grub bootloader is password protected or not

 U R in /boot/grub

 PASSWORD OF GRUB IS  password --md5 $1$cnO6W1$Oc3iMBjHIVVukIGkXkeFD0

Password  Implemented

(3) PROMPTING FOR PASSWORD IN SINGLE USER MODE

#!/bin/bash

echo "This script Check Prompting Password in Singl Usrmod POLICY Working or NOT "

f="/etc/inittab"

if [ -e $f ]

then

cd /etc

echo " U R in `pwd` "

s=`cat inittab | grep "^~~:S:wait:/sbin/sulogin"`

if [ ! -n "$s" ]

then

echo " POLICY not Working "

else

echo "POLICY Working Properly "

fi

fi

output

[root@CLIENT ~]# ./singleuser.sh

This script Check Prompting Password in Singl Usrmod POLICY Working or NOT

 U R in /etc

 POLICY not Working

Scripts to Check Linux Logs Message such as Mail Events,Authentication Message Logs

(1)  Display General Message Logs

#!/bin/bash

echo  "This script shows the General Message Logs "

f= "/var/log/messages"

if [  -e $f  ]

then

cd /var/log

echo  " Welcome to the LOG directory `pwd`  "

head -5 messages  > sample1

echo "Demo of the logs message "

cat sample1

echo "task complete "

fi

ouptput

This script shows the General Message Logs

 Welcome to the LOG directory /var/log 

Demo of the logs message

Dec 29 03:45:20 CLIENT syslogd 1.4.1: restart.

Dec 29 03:45:20 CLIENT nmbd[2423]:   Got SIGHUP dumping debug info.

Dec 29 03:45:20 CLIENT nmbd[2423]: [2013/12/29 03:45:20, 0] nmbd/nmbd_workgroupdb.c:dump_workgroups(282)

Dec 29 03:45:20 CLIENT nmbd[2423]:   dump_workgroups()

Dec 29 03:45:20 CLIENT nmbd[2423]:    dump workgroup on subnet       10.0.2.15: netmask=  255.255.255.0:

task complete

(2)  Display Authentication Message Logs

#!/bin/bash

echo "This script shows the Authentication Message Logs "

f="/var/log/secure"

if [ -e $f  ]

then

cd /var/log

echo " Welcome to the LOG directory `pwd`  "

head -5 secure  > sample2

echo "Demo of the logs message "

cat sample2

echo "task complete "

fi

output

[root@CLIENT ~]# ./secure.sh

This script shows the Authentication Message Logs

 Welcome to the LOG directory /var/log 

Demo of the logs message

Dec 30 04:18:34 CLIENT sshd[2312]: Server listening on :: port 22.

Dec 30 04:18:34 CLIENT sshd[2312]: Server listening on 0.0.0.0 port 22.

Dec 30 04:20:27 CLIENT gdm[2593]: pam_unix(gdm:session): session opened for user root by (uid=0)

Dec 30 05:21:47 CLIENT su: pam_unix(su-l:session): session opened for user alice by root(uid=0)

Dec 30 05:22:20 CLIENT su: pam_unix(su-l:session): session closed for user alice

task complete

(3) Display Mail Event Logs

#!/bin/bash

echo "This script shows the  Mail Events Logs "

f="/var/log/maillog"

if [ -e $f  ]

then

cd /var/log

echo " Welcome to the LOG directory `pwd`  "

head -5 maillog  > sample3

echo "Demo of the logs message "

cat sample3

echo "task complete "

 

output

root@CLIENT ~]# ./maillog.sh

This script shows the  Mail Events Logs

 Welcome to the LOG directory /var/log 

Demo of the logs message

Dec 29 03:45:35 CLIENT sendmail[3685]: rBSMFZHo003685: from=root, size=228, class=0, nrcpts=1, msgid=<201312282215.rBSMFZHo003685@CLIENT>, relay=root@localhost

Dec 29 03:45:35 CLIENT sendmail[3686]: rBSMFZTx003686: from=<root@CLIENT>, size=457, class=0, nrcpts=1, msgid=<201312282215.rBSMFZHo003685@CLIENT>, proto=ESMTP, daemon=MTA, relay=localhost.localdomain [127.0.0.1]

Dec 29 03:45:35 CLIENT sendmail[3685]: rBSMFZHo003685: to=root, ctladdr=root (0/0), delay=00:00:00, xdelay=00:00:00, mailer=relay, pri=30228, relay=[127.0.0.1] [127.0.0.1], dsn=2.0.0, stat=Sent (rBSMFZTx003686 Message accepted for delivery)

Dec 29 03:45:35 CLIENT sendmail[3687]: rBSMFZTx003686: to=<root@CLIENT>, ctladdr=<root@CLIENT> (0/0), delay=00:00:00, xdelay=00:00:00, mailer=local, pri=30647, dsn=2.0.0, stat=Sent

Dec 29 04:02:06 CLIENT sendmail[3833]: rBSMW3Gb003833: from=root, size=3843, class=0, nrcpts=1,

task complete

Public and Private Key Encryption using gpg (Gnu Privacy guard )

(1)  First add 2 users

[root@CLIENT ~]#  useradd alice

[root@CLIENT ~]#  useradd bob

[root@CLIENT ~]#  passwd alice

[root@CLIENT ~]#  passwd bob

   

(2)  Login user alice

[root@CLIENT ~]#  su - alice

[alice@CLIENT ~]$  

 (3) After that generate pub/private key using gpg

[alice@CLIENT ~]$ gpg --gen-key
gpg (GnuPG) 1.4.5; Copyright (C) 2006 Free Software Foundation, Inc.
This program comes with ABSOLUTELY NO WARRANTY.
This is free software, and you are welcome to redistribute it
under certain conditions. See the file COPYING for details.

gpg: directory `/home/alice/.gnupg' created
gpg: new configuration file `/home/alice/.gnupg/gpg.conf' created
gpg: WARNING: options in `/home/alice/.gnupg/gpg.conf' are not yet active during this run
gpg: keyring `/home/alice/.gnupg/secring.gpg' created
gpg: keyring `/home/alice/.gnupg/pubring.gpg' created
Please select what kind of key you want:
   (1) DSA and Elgamal (default)
   (2) DSA (sign only)
   (5) RSA (sign only)
Your selection? 1
DSA keypair will have 1024 bits.
ELG-E keys may be between 1024 and 4096 bits long.
What keysize do you want? (2048)
Requested keysize is 2048 bits
Please specify how long the key should be valid.
         0 = key does not expire
      <n>  = key expires in n days
      <n>w = key expires in n weeks
      <n>m = key expires in n months
      <n>y = key expires in n years
Key is valid for? (0)
Key does not expire at all
Is this correct? (y/N) y

You need a user ID to identify your key; the software constructs the user ID
from the Real Name, Comment and Email Address in this form:
    "Heinrich Heine (Der Dichter) <heinrichh@duesseldorf.de>"

Real name: alice
Email address: it1708151@gmail.com
Comment: hello
You selected this USER-ID:
    "alice (hello) <it1708151@gmail.com>"

Change (N)ame, (C)omment, (E)mail or (O)kay/(Q)uit? o
You need a Passphrase to protect your secret key.

We need to generate a lot of random bytes. It is a good idea to perform
some other action (type on the keyboard, move the mouse, utilize the
disks) during the prime generation; this gives the random number
generator a better chance to gain enough entropy.
.++++++++++++++++++++++++++++++++++++++++.++++++++++.++++++++++++++++++++.+++++++++++++++++++++++++++++++++++..++++++++++.+++++++++++++++>+++++..+++++.................................................+++++

Not enough random bytes available.  Please do some other work to give
the OS a chance to collect more entropy! (Need 280 more bytes)
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++>We need to generate a lot of random bytes. It is a good idea to perform
some other action (type on the keyboard, move the mouse, utilize the
disks) during the prime generation; this gives the random number
generator a better chance to gain enough entropy.
+++++++++++++++.+++++++++++++++...+++++.+++++.++++++++++.++++++++++..+++++..++++++++++++++++++++.++++++++++.+++++++++++++++++++++++++++++++++++++++++++++.+++++>..++++++++++>+++++>+++++>+++++.>.>..........................<+++++.......>+++++.................................................................................................,......,.........+++++^^^
gpg: /home/alice/.gnupg/trustdb.gpg: trustdb created
gpg: key 7F6BF7DD marked as ultimately trusted
public and secret key created and signed.

gpg: checking the trustdb
gpg: 3 marginal(s) needed, 1 complete(s) needed, PGP trust model
gpg: depth: 0  valid:   1  signed:   0  trust: 0-, 0q, 0n, 0m, 0f, 1u
pub   1024D/7F6BF7DD 2013-12-27
      Key fingerprint = 24A0 9F3D 007E 29F8 5FC1  E2AC B3E0 74B9 7F6B F7DD
uid                  alice (hello) <it1708151@gmail.com>
sub   2048g/EDC1CF28 2013-12-27

(4) To check key either generated or not we can see both public and private key

[alice@CLIENT ~]$ gpg --list-key
/home/alice/.gnupg/pubring.gpg
------------------------------
pub   1024D/7F6BF7DD 2013-12-27
uid                  alice (hello) <it1708151@gmail.com>
sub   2048g/EDC1CF28 2013-12-27

[alice@CLIENT ~]$ gpg --secret-key
gpg: Missing argument for option "--secret-key"
[alice@CLIENT ~]$ gpg --list-secret-key
/home/alice/.gnupg/secring.gpg
------------------------------
sec   1024D/7F6BF7DD 2013-12-27
uid                  alice (hello) <it1708151@gmail.com>

ssb   2048g/EDC1CF28 2013-12-27

(5)  Export the public key 

[alice@CLIENT ~]$ gpg --export --armor alice > /tmp/alice.key

_________________________________________________________________

7)  Login user bob

[root@CLIENT ~]#  su - bob

[bob@CLIENT ~]$  

(8) User bob need public key of alice so bob import the alice pub key

[bob@CLIENT ~]$ gpg --import  /tmp/alice.key

gpg: directory `/home/bob/.gnupg' created
gpg: new configuration file `/home/bob/.gnupg/gpg.conf' created
gpg: WARNING: options in `/home/bob/.gnupg/gpg.conf' are not yet active during this run
gpg: keyring `/home/bob/.gnupg/secring.gpg' created
gpg: keyring `/home/bob/.gnupg/pubring.gpg' created
gpg: /home/bob/.gnupg/trustdb.gpg: trustdb created
gpg: key 7F6BF7DD: public key "alice (hello) <it1708151@gmail.com>" imported
gpg: Total number processed: 1
gpg:               imported: 1

(8) Create a file 

[bob@CLIENT ~]$ vim msg

(8) Encrypt the msg file 

[bob@CLIENT ~]$ gpg --encrypt --armor --recipient alice msg
gpg: EDC1CF28: There is no assurance this key belongs to the named user

pub  2048g/EDC1CF28 2013-12-27 alice (hello) <it1708151@gmail.com>
 Primary key fingerprint: 24A0 9F3D 007E 29F8 5FC1  E2AC B3E0 74B9 7F6B F7DD
      Subkey fingerprint: CFAC B364 6421 F375 28FC  0C5C 8516 C564 EDC1 CF28

It is NOT certain that the key belongs to the person named
in the user ID.  If you *really* know what you are doing,
you may answer the next question with yes.

Use this key anyway? (y/N) y

(9) Mail it to user alice

[bob@CLIENT ~]$ mail alice < msg.asc

_________________________________________________________________________________

(10) login user alice to check the mail

[alice@CLIENT ~]$ mail
Mail version 8.1 6/6/93.  Type ? for help.
"/var/spool/mail/alice": 1 message 1 unread
>U  1 bob@CLIENT            Sat Dec 28 05:07  33/1415
& w
No file specified.
& w hello             #----  w stands for download 
"hello" [New file]
& q
[alice@CLIENT ~]$ hello
-bash: hello: command not found
[alice@CLIENT ~]$ vim hello
[alice@CLIENT ~]$ gpg hello

You need a passphrase to unlock the secret key for
user: "alice (hello) <it1708151@gmail.com>"
2048-bit ELG-E key, ID EDC1CF28, created 2013-12-27 (main key ID 7F6BF7DD)

gpg: encrypted with 2048-bit ELG-E key, ID EDC1CF28, created 2013-12-27
      "alice (hello) <it1708151@gmail.com>"
gpg: hello: unknown suffix
Enter new filename [msg]: hello
File `hello' exists. Overwrite? (y/N) y

_________________________________________________________________

                                                                            

                                                                  

Files and Directory Permissions in Linux with special type of permission implementation such as sticky bit , acl(access control list)

we are implementing file and directory permission with special type of permission  such as  sticky bit and acl
(1) Add 4 users
useradd u1
useradd  u2
useradd u3
useradd u3
useradd u4

(2) Now add 2 groups
groupadd linux
groupadd oracle

(3) Now add the users to the group linux  and oracle
usermod -G  linux u1
usermod -G  linux u2
usermod -G  oracle u3
usermod -G  oracle u4

(4) After that make 2 directory
mkdir  /linux
mkdir  /oracle

(5)  Change group of both the directory
chgrp oracle  /oracle
chgrp linux  /linux

(6) Now change the permissions of both  the directory only group members can access the directory
chmod 770  /oracle
chmod 770  /linux

(8) Now login from user  u1
su - u1

(9) Now create direcory a directory /linux/u1
mkdir /linux/u1
#successful

(10) Now create a directory /oracle/abc
mkdir /oracle /abc
#permission denied
# user u1 can't have permission to make file and directory  in /oracle directory

(11) Now login from user u2
su - u2
rm - rf  /linux/u1
#sucessful

(12) To  prevent this we implement sticky bit only root user and owner of the file can implement in the Directory
chmod 1770 /linux/u1

(13)  To check it
 su -  u2
rm -rf  /linux/u1
#permission denied
------------------------------------------------------------------------------------------------------------
There is an another type of permission that is ACL (acces control list)
that is implemented as
setfacl  -m  u:u1:rwx  /linux
setfacl -m u:u2:rw-   /linux