Logging In

After your Linux host or LiveCD boots, you will be presented with a login prompt: either a command-line or GUI (graphical user interface) login prompt.

In Figure 4-1, you can see a typical command-line login prompt for an Ubuntu Linux host, and in Figure 4-2, you can see the graphical login for a CentOS host.

Figure 4-1. Command-line login prompt

Figure 4-2. Graphical login prompt

At either login prompt you need to supply your username and a password or similar form of authentication. (Like Windows, Linux can also use smartcards or tokens or other mechanisms to authenticate users.)

If you just installed a Linux host, you’ll have been prompted to create a user, and you can make use of that user to log in now. If you’re testing Linux with a LiveCD, you may see a default username and password that you will be prompted to log in with, or you may even be automatically logged in. For example, the Ubuntu LiveCD has a default username of ubuntu with a password of ubuntu, and it usually automatically logs you in. If you don’t see a default username and password, you may need to check the LiveCD’s online documentation, or you may be prompted to create a username and a password.

Once your host has verified your access, then you’ll be logged in and, depending on your configuration, your host will either display a command-line or a GUI desktop environment.

The GUI Desktop

Both Linux and Windows can have GUIs. Unlike recent Windows releases, Linux has always been able boot to either a GUI or the command line. Once you’re booted up, you can also switch between these two modes, and we’ll discuss how to do that in the section “Shells” later in this chapter and in some more detail in Chapter 5.

On Linux the GUI is a combination of several applications. The basic application is called the X Window System (you’ll also see it called X11 or simply X). The X application provides an underlying “windowing” environment.

On top of X you then add a desktop environment to provide the “look and feel” and desktop functionality such as toolbars, icons, buttons, and the like. There are two major desktop environments popular on Linux: Gnome and KDE. Most distributions have one of these desktop environments as their default; for example, Gnome is the default desktop environment on the Debian, CentOS, Red Hat, and Fedora distributions, and KDE is the default on Ubuntu derivative Kubuntu and on SUSE, while Ubuntu uses Unity, which is a Gnome shell (based on Gnome).

In Figure 4-3, you can see the default Gnome desktop on an Ubuntu distribution.

Figure 4-3. Ubuntu Unity desktop on the Xenial Xerus release

The Unity desktop has many of the underlying Gnome tools available to it. In this book we will talk primarily about the Gnome desktop in our examples and these examples will also apply to the Unity desktop .

The Command Line

In the Linux world, the command line is one of the most powerful tools available to you. The command line can be referred to as the “console,” “terminal,” or “shell”; each has a slightly different context, but in the end it is the place where you type Linux commands in. In this book, a lot of focus is going to be on the command line. This is where at least some of your administration tasks are going to occur, and it’s important to be able to understand and make use of the command line. Indeed, in some cases you will not have a GUI environment available. If your GUI environment is not functional, you will need to be able to administer your hosts using the command line. The command line also offers some powerful tools that can make your administration tasks faster and more effective.

Let’s take a look at the Linux command line. You can access the command line in one of several ways. If your host has booted to a command-line prompt, as you can see in Figure 4-1, you can simply log in and use the prompt.

From inside the Gnome or KDE GUI, you have two options. The first is to use a virtual console—a kind of Linux management console that runs by default on most Linux distributions. Or you can launch a terminal emulator application like the Gnome Terminal or Konsole. In Figure 4-3 you can see how we would access the Terminal emulator in the Unity desktop.

To launch a virtual console from inside a Gnome or KDE GUI, use the key combination Ctrl+Alt and one of the F1 through F7 keys. Each of the windows that can be opened is a new virtual console. Six virtual consoles are available. You can cycle through consoles using the Crtl+Alt+F1 to F7 keys. Each terminal is independent and separate. Ubuntu and CentOS have the GUI on different consoles. You use Ctrl+Alt+F7 to access the Ubuntu GUI and Ctrl+Alt+F1 for CentOS.

You can also launch a terminal emulator . In Gnome, for example, you click the Applications menu , open the Accessories tab, and select the Terminal application. This will launch the Gnome Terminal application, as you can see in Figure 4-4.

Figure 4-4. Launching the Gnome Terminal application

On KDE, things are slightly different. On earlier versions of KDE, you could launch the Konsole application by clicking Applications, opening System Tools, and selecting the Konsole application. On KDE version 4 and later, you launch Konsole by clicking Applications and then System, and selecting the Konsole application. And in Figure 4-3 we were able to see that we needed to bring up the search in Unity by selecting the Ubuntu symbol and typing Terminal. In Figure 4-3 we can see that it has already appeared without our searching for Terminal because it is a recently used application.

Shells

What command line is presented to you depends on what shell is running for your user. Shells are interfaces to the operating system and kernel of your host. For example, the command line on a Windows host is also a shell. Each shell contains a collection of built-in commands that allow you to interact with your host (these are supplemented by additional tools installed by your distribution).

A variety of shells are available, with the most common being the Bash (or Bourne-again) shell that is used by default on many distributions, including the popular Red Hat, Ubuntu, and Debian distributions.

We’re going to use the Bash shell for all of our examples in this chapter, because it is most likely the shell you’ll find by default.

Command-Line Prompt

After you have logged in to your Linux host, you should see a prompt that looks something like the following:

jsmith@au-mel-centos-1 ∼$

So what does this mean? Well let’s break it down.

user@host directory$

On most Linux distributions, the basic prompt is constructed from the username you’re logged in as, the name of the host, the current directory, and the $ symbol, which indicates what sort of user you are logged in as.

In our case, jsmith is the name of the user we are logged in as; the @ symbol comes next and is followed by the name of the host we are logged into, i.e., jsmith at au-mel-centos-1.

Next you see a ∼ symbol, which is an abbreviated method of referring to your home directory. On a Linux host, most users have a special directory, called a home directory, which is created when the user is created. Like a Microsoft Window’s user profile , the user’s preferences and configuration files and data are stored in this directory. Any time you see the ∼ symbol used, it indicates a shortcut that means home directory. We talked about home directories earlier, and they roughly equate to a combination of the Windows concept of the Documents and Settings profile and the My Documents folder. You would usually find home directories under a directory called /home.

Finally, you see the $ symbol. This symbol tells you what type of user you are; by default all normal users on the host will have $ as their prompt. There is a special user, called root, whose prompt uses the # symbol:

root@au-mel-centos-1 ∼#

The root user is the superuser. On Windows, we’d call this user the Administrator. Like the Administrator user on Windows, the root user can control and configure everything. So if you see the # symbol, you know you are logged in as the root user.

In some distributions, you can log in as the root user, and you’ll usually be prompted to specify a password for the root user during installation. Other distributions, most notably the Ubuntu distribution, disable the root user’s password. On Ubuntu, you are assumed to never use the root user, but rather a special command called sudo. The sudo command allows you to run commands with the privileges of the root user without logging in as that user. We’ll talk about the sudo command in Chapter 5. To use the sudo command, you simply type sudo and the command you wish to run. You will usually be prompted for your password, and if you enter the correct password, the command will be executed.

$ sudo passwd root

This command would change the password of the root user, which is one method of enabling the root user on Ubuntu.

The root user is all-powerful and can do anything on your host. As a result, it can be easy to accidentally make a mistake that could delete data or disrupt your applications and services when logged in as the root user. Thus, for security and safety reasons, you should never log in as the root user. We’ll discuss other ways to administer your host without using the rootuser later in Chapter 5.

Typing Your First Command

Now it’s time to try entering a command. A command could be a binary executable (like a Windows executable or EXE file), or the command might be provided as part of the shell. Let’s type a command called whoami and execute it by pressing the Enter key:

$ whoami
jsmith

The whoami command returns the name of the user you are logged in as. You can see our host has returned jsmith. This tells us we’re logged in to our host as the user jsmith.

Each shell contains a series of built-in commands and functions to help you make use of the command line. Let’s try one of these now. We start by running the whoami command again. This time, though, we make a spelling error and type the wrong command name:

$ whoamii

We then press the Enter key to run the command and find that Bash has returned the following response:

-bash: whoamii: command not found

So what happened? Well, Bash is telling us that no command called whoami exists on the host. We can fix that. Let’s start by correcting the command. We can bring back a previously typed command by using the up arrow key. Do that now, and you can see that the previous command has returned to the command line:

$ whoamii

Bash usefully has what is called command history, which keeps track of a number of the previous commands typed. Bash allows you to navigate through these commands by using the up and down arrow keys.

You can also move the cursor along the command line to edit commands using the left and right arrow keys. Move to the end of the command using the arrow keys and delete the extra i, leaving you with

$ whoami

Now press the Enter key, and you will see the result on the command line:

jsmith

This time the corrected command, whoami, has again returned the name of the user who is logged in.

Using SSH

We’re quickly going to look at using SSH to provide remote command-line access to a Linux host. You can also access your GUI desktops with SSH, but we’ll talk about that in Chapter 10.

SSH is both an application and a secure protocol used for a number of purposes but primarily for remote administration of hosts. On Linux hosts, SSH is provided by an open source version of the application called OpenSSH (see www.openssh.com/ ).

SSH connects over TCP/IP (Transmittion Control Protocol/Internet Protocol ) networks in a client-server model. Your connecting host is the client. For example, if you are connecting to a remote host from your laptop, your laptop is the client. The host you are connecting to is called the server and receives and manages your connection.

Remote connections using SSH are encrypted and require authentication, either a password or public key cryptography. To make an SSH connection, you need to know the IP address or hostname of the remote host. A connection is then initiated on the client and connects to the server via TCP on port 22 (you can change this port, and we’ll talk about how to do that in Chapter 10).

After the initial connection, the client is then prompted by the server for a username and authentication credentials like a password. If the user exists on the server and the correct credentials are provided, the client is allowed to connect to the server.

On most distributions, SSH is installed as one of the default applications, and a server is started by default. This SSH server or SSH daemon (servers are also called daemons in the Linux world) allows remote connections to be made to the command line or GUI of your host.

You can use SSH via the command line or from one of a number of clients. Via the command line, client connections are made using a command called ssh. Most Linux and Unix-like operating systems (Mac OS X, for example) have SSH installed and have the ssh command available. To use the ssh command, you specify your username and the host you’d like to connect to separated with the @ symbol, as you can see in Listing 4-1.

Listing 4-1. SSH Connections

$ ssh  [email protected]
Password:

In Listing 4-1, we’ve connected to a host called us-ny-server-1.example.com as the user jsmith. We’ve then been prompted to input our password. If we have entered the correct password, we will be logged in to the command line of the remote host.

There are also a variety of SSH clients or terminal emulators available, for example, the popular and free PuTTY client (available from www.chiark.greenend.org.uk/~sgtatham/putty/ ), which runs on Windows (and also on Linux). You can also use the one that comes with Git Bash, which we installed in Chapter 3, which of course, runs on Windows.

SSH clients allow you to run text terminals to the command lines of your Unix or Linux hosts from your GUI. You can see the PuTTY client’s configuration screen in Figure 4-5.

Figure 4-5. The PuTTY client

Using a GUI client like PuTTY is very simple. As with the command line, you need to specify the hostname (or IP address) and port of the host to which you wish to connect. With a client like PuTTY, you can also do useful things like save connections so you don’t need to input your hostname again.

With Git Bash we can access ssh from the Bash terminal. We showed you how to install Git Bash in Chapter 3. Take a look at Figure 4-6, where we are making a connection to us-ny-server-1.example.com.

Figure 4-6. Using Git Bash to make an ssh connection

AS in Listing 4-1 we are making a connection to the US server. Here you will note that when we first connect to a host we have never connected to before, we are asked to accept the RSA key fingerprint. This is from the SSH server you are connecting to. After you accept this key, it is stored against the server name in a file called known_hosts. Every subsequent SSH connection to this host will check the fingerprint to see if it is changed. If it has you will be asked to clean the key before reconnecting. This gives you the opportunity to verify if the host or your communication has been tampered with. Again, we will talk more about this in Chapter 10.

In Figure 4-6 we accept the fingerprint after ideally first checking that we are connecting to the host we think we are connecting to (this is harder to do in an online world where you might connect to hosts outside your domains). Once this is done, we store the fingerprint and are then prompted for our password.

If you intend to manage Linux servers from Windows, we recommend you download a client like PuTTY if you prefer a GUI; otherwise you can install and use the Git Bash terminal, like we showed you in Chapter 3. Either will effectively allow you to remotely connect to and administer your Linux hosts from an environment that you’re comfortable in. Mac OS, being Unix based, comes with an SSH client built in.

File Types and Permissions

The file type and permissions are contained in the first ten characters, the section resembling -rw-r--r--. This potentially intimidating collection of characters is actually quite simple to decipher: the first character describes the type of file, and the next nine characters describe the permissions of the file.

File Types

Almost everything on the Linux file system can be generally described as a file. The first character of the listing tells us exactly what sort of file. A dash (-) here indicates a regular file that might contain data or text, or be a binary executable. A d indicates a directory, which is essentially a file that lists other files. An l indicates a symbolic link. Symbolic links allow you to make files and directories visible in multiple locations in the filesystem. They are much like the shortcuts used in Microsoft Windows.

Table 4-2 lists the file types available.

Table 4-2. File Types

Type	Description
-	File
d	Directory
l	Link
c	Character devices
b	Block devices
s	Socket
p	Named pipe

We’ll cover the other types here briefly. You won’t regularly need most of the types, but they will appear occasionally in later chapters. The b and c file types are used for different types of input and output devices (if you look in the /dev directory, you will see examples of these device files). Devices allow the operating system to interact with particular hardware devices; for example, many distributions will have a device called /dev/usb that represents a USB drive attached to the host.

Tip

You’ll learn more about devices in Chapter 9 when we show you how to load a USB on your host.

Finally, sockets and named pipes are files that allow interprocess communications of varying types. They allow processes to communicate with each other. You’ll see some sockets and named pipes later in the book.

Permissions

The next nine characters detail the access permissions assigned to the file or directory. On Linux, permissions are used to determine what access users and groups have to a file. Controlling your permissions and access to files and applications is critical for security on your Linux host, and frequently in this book we’ll use permissions to provide the appropriate access to files. Thus it is important that you understand how permissions work and how to change them.

There are three commonly assigned types of permissions for files:

• Read, indicated by the letter r

• Write, indicated by the letter w

• Execute, indicated by the letter x

Note

There are two other types of permissions, sticky and setuid/setgid permissions, represented by t or s characters, respectively. We discuss these in the sidebar “Setuid, Setgid, and Sticky Permissions” later in this chapter.

Read permissions allow a file to be read or viewed but not edited. If it is set on a directory, the names of the files in the directory can be read, but other details, like their permissions and size, are not visible. Write permissions allow you to make changes or write to a file. If the write permission is set on a directory, you are able to create, delete, and rename files in that directory. Execute permissions allow you to run a file; for example, all binary files and commands (binary files are similar to Windows executables) must be marked executable to allow you to run them. If this permission is set on a directory, you are able to traverse the directory, for example, by using the cd command to access a subdirectory. The combination of the read and execute permissions set on a directory thus allows you to both traverse the directory and view the details of its contents.

Each file on your host has three classes of permissions:

• User

• Group

• Other (everyone else)

Each class represents a different category of access to the file. The User class describes the permissions of the user who owns the file. These are the first three characters in our listing. The Group class describes the permissions of the group that owns the file. These are the second set of three characters in our listing.

Note

Groups in Linux are collections of users. Groups allow like users to be collected together for the purpose of allowing access to applications and services; for example, all the users in the Accounting department can belong to the same group to allow them access to your Accounts Payable application. We’ll talk about groups in Chapter 6.

Finally, the Other class describes the permissions that all others have to the file. These are the final set of three characters in the listing.

Figure 4-9 describes these classes and their positions.

Figure 4-9. File permission breakdown

Note

A dash in any position means that particular permission is not set at all.

You can see a single file in Listing 4-10 whose permissions we’re going to examine in more detail, and then you’ll learn how to make some changes to those permissions.

Listing 4-10. Permissions

-rw-r--r--   1 root  root     0 2016-07-15 20:47 myfile

In Listing 4-10, we have a file, as indicated by the dash (-) at the beginning of the listing. The file is owned by the root user and root group. The first three permissions are rw-, which indicates the root user can read and write the file, but the dash means execute permissions are not set, and the file can’t be executed by the user. The next three permissions, r--, indicate that anyone who belongs to the root group can read the file but can do nothing else to it. Finally, we have r-- for the last three permissions, which tell us what permissions the Other class has. In this case, others can read the file but cannot write to it or execute it.

Now you’ve seen what permissions look like, but how do you go about changing them? Permissions are changed using the chmod (change file mode bits) command. The key to changing permissions is that only the user who owns the file or the root user can change a file’s permissions. So, in Listing 4-10, only the root user could change the permissions of the myfile file.

The chmod command has a simple syntax. In Listing 4-11, you can see some permissions being changed.

Listing 4-11. Changing Permissions

# chmod u+x myfile
# chmod u-x,og+w myfile
# chmod 654 myfile

In Listing 4-11, we’ve changed the myfile file’s permissions three times. Permission changes are performed by specifying the class, the action you want to perform, the permission itself, and then the file you want to change. In our first example, you can see u+x. This translates to adding the execute permission to the User class.

Note

The execute permission is usually set only on files that are executable in nature such as scripts and binaries (a.k.a. applications or programs) and on directories. On directories x means traverse, meaning that you can list directories in the parent directory but you can’t go any further.

After our update, the permissions on our file would now look as follows:

-rwxr--r--   1 root  root      0  2016-07-15 20:47 myfile

You can see the addition of the x to the User class . So how did chmod know to do that? Well, the u in our change represents the User class. With chmod, each class is abbreviated to a single letter:

• u: User

• g: Group

• o: Other or everyone

• a: All

After the class, you specify the action you’d like to take on the class. In the first line in Listing 4-11, the + sign represents adding a permission. You can specify the - sign to remove permissions from a class or the = sign to set absolute permissions on the class. Finally, you specify the permission to the action, in this case x.

You can also specify multiple permission changes in a single command, as you can see in the second line of Listing 4-11. In this second line, we have the change u-x,go+w. This would remove the x, or execute, permission from the User class and add the w, or write, permission to both the Group and Other classes. You can see we’ve separated each permission change with a comma and that we can list multiple classes to act upon. (You can also list multiple permissions; for example, u+rw would add the read and write permissions to the User class.)

Thus the second line in Listing 4-11 would leave our file permissions as

-rw-rw-rw-   1 root  root      0  2016-07-15 20:47 myfile

With chmod, you can also use the a class abbreviation, which indicates an action should be applied to all classes; for example, a+r would add read permissions to all classes: User, Group, and Other.

We can also apply the permissions of one class to another class by using the = symbol.

# chmod u=g myfile

On the previous line, we’ve set the User class permissions to be the same as the Group class permissions.

You can also set permissions for multiple files by listing each file separated by space as follows:

# chmod u+r file1 file2 file3

As with the ls command, you can also reference files in other locations as follows:

# chmod u+x /usr/local/bin/foobar

The previous line adds the execute permission to the User class for the foobar file located in the /usr/local/bin directory.

You can also use the asterisk symbol to specify all files and add the -R switch to recurse into lower directories as follows:

# chmod -R u+x /usr/local/bin/*

The chmod command on the previous line would add the execute permission to the User class to every file in the /usr/local/bin directory.

The last line in Listing 4-11 is a little different. Instead of classes and permissions, we’ve specified a number, 654. This number is called octal notation. Each digit represents one of the three classes: User, Group, and Other. Additionally, each digit is the sum of the permissions assigned to that class. In Table 4-3, you can see the values assigned to each permission type.

Table 4-3. Octal Permission Values

Permission	Value	Description
r	4	Read
W	2	Write
x	1	Execute

Each permission value is added together, resulting in a number ranging from 1 and 7 for each class. So the value of 654 in Listing 4-11 would represent the following permissions:

-rw-r-xr-- 1 root root 0  2016-08- 14 22:37 myfile

The first value, 6, equates to assigning the User class the read permission with a value of 4 plus the write permission with a value of 2. The second value, 5, assigns the Group class the read permission with a value of 4 and the execute permission with a value of 1. The last value, 4, assigns only the read permission to the Other class. To make this clearer, you can see a list of the possible values from 0 to 7 in Table 4-4.

Table 4-4. The Octal Values

Octal	permissions	Description
0	---	None
1	--x	Execute
2	-w-	Write
3	-wx	Write and execute
4	r--	Read
5	r-x	Read and execute
6	rw-	Read and write
7	rwx	Read, write, and execute

In Table 4-5, you can see some commonly used octal numbers and the corresponding permissions they represent.

Table 4-5. Octal Permissions

Octal Numbers	permissions
600	rw-r--r--
644	rw-r--r--
664	rw-rw-r--
666	rw-rw-rw-
755	rwxr-xr-x
777	rwxrwxrwx

Tip

The chmod command has some additional syntax for changing permissions, and you can read about them in the command’s man page.

Finally, there is an important concept called umaskthat you need to also understand to fully comprehend how permissions work. The umask dictates the default set of permissions assigned to a file when it is created. By default, without a umask set, files are created with permissions of 0666 (or read and write permissions for the owner, group, and others are all set), and directories are created with permissions of 0777 (or read, write, and execute for the owner, group, and others). You can use the umask command to modify these default permissions. Let’s look at an example.

# umask 0022

Here we’ve specified a umask of 0022. This looks familiar, doesn’t it? Yes, it’s a type of octal notation; in this case, it indicates what’s not being granted. So here we would take the default permissions for a file, 0666, and subtract the 0022 value, leaving us with permissions of 0644. With a umask of 0022, a new file would be created with read and write permissions for the owner of the file and read permissions for the group and others. Newly created directories (default permissions of 0777) would now have permissions of 0755 with a umask of 0022. Another commonly used umask is 0002, which results in default permissions of 0664 for files and 0775 for directories. This allows write access for the group also, and this umask is often used for files located in shared directories or file shares.

On most hosts, your umask is set automatically by a setting in your shell. For Bash shells, you can usually find the global umask in the /etc/bashrc file, but you can also override it on a per-user basis using the umask command or using the pam_umask module (we will give you more information about what PAM is in Chapter 5).

Tip

The umask command can also set umasks using alternative syntax. We’ve just described the simplest and easiest. You can find more details in the umask man page.

Setuid, Setgid, and Sticky Permissions

There are two additional types of permissions, setuid/setgid and sticky, that are also important to understand.

The setuid and setgid permissions allow a user to run a command as if he were the user or group that owned the command. So, why might this be needed? Well, this allows users to execute specific tasks that they would normally be restricted from doing or allows users to share resources, like accessing shared files on a fileserver with the same group id.

A good example of this is the passwd command. The passwd command allows a user to change her password. To do this, the command needs to write to the password file, a file that has restricted access. By adding the setuid permission, a user can execute the passwd command and run it as if she were the root user, hence allowing her to change her password.

You can recognize setuid and setgid permissions by the use of an s or S in the listing of permissions. For example, the permissions of the passwd command are

-rwsr-xr-x 1 root root 25708  2016-09- 25 17:32 /usr/bin/passwd

You can see the s in the execute position of the User class, which indicates that the passwd command has the setuid permission set. Take a look now at the following directory listing.

-rwSrwSr-- 1 jsmith jsmith     0 Jun  5 09:55 adirectory

This also shows that the setuid and setgid for the “adirectory” directory have been set but designated by “S” this time. What this means is that the directory does not have “execute” permissions associated with the user and group. In other words, the permissions for that directory (and a file would be the same) would have been set with ‘u+rws,g+rws,o+r’.

On most distributions, setuid/setgid permissions are used sparely to allow this sort of access. They are used sparingly because you generally don’t want one user be able to run applications as another user or to have particular elevated privileges (another way to do this is through the su and sudo commands, which we’re going to describe further in Chapter 6). As they could also potentially be abused and represent a security exposure, they should not be used indiscriminately. In this book, you may see one or two applications that use setuid/setgid permissions.

Sticky permissions are slightly different and are used on directories (they have no effect on files). When the sticky bit is set on a directory, files in that directory can be deleted only by the user who owns them, the owner of the directory, or the root user, irrespective of any other permissions set on the directory. This allows the creation of public directories where every user can create files but only delete their own files. You can recognize a directory with sticky permissions from the t in the execute position of the Other class. Most frequently it is set on the /tmp directory:

drwxrwxrwt 4 root root 4096 2016-08-15 03:10 tmp

In octal notation , setuid/setgid and sticky permissions are represented by a fourth digit at the front of the notation, for example, 6755. Like other permissions, each special permission also has a numeric value: 4 for setuid, 2 for setgid, and 1 for sticky. So to set the sticky bit on a directory, you’d use an octal notation like 1755. If no setuid/setgid or sticky permissions are being set, this prefixed digit is 0 like so:

# chmod 0644 /etc/grub.conf

Links

Let’s take another look at the example from Listing 4-9:

-rw-r--r--        1 root  root        0   2016-07-15 20:47   .autofsck
drwxr-xr-x     2 root  root   4096  2016-05-18  04:11   bin

In our listing, after our file type and permissions is the number of hard links to the file. Hard links are references that connect your file to the physical data on a storage volume. There can be multiple links to a particular piece of data. However, hard links are different from the symbolic links we introduced earlier (indicated by a file type of l), although both linkages are created with the same command, ln. We’ll talk about the ln command later in this chapter in the section “Linking Files.”

Users, Groups, and Ownership

Next in our listing is the ownership of the file. Each object is owned by a user and a group; in Listing 4-9, the root user and root group own the objects. We briefly discussed user and group ownership when we looked at permissions. We explained that only the user who owns a file could change its permissions, and that groups were collections of users. Groups are generally used to allow access to resources; for example, all users who need to access a printer or a file share might belong to groups that provide access to these resources. As we discussed earlier in this chapter, on Linux hosts a user must belong to at least one group, known as the primary group, but can also belong to one or more additional groups, called supplementary groups.

You can change the user and group ownership of a file using the chown command. Only the root user has authority to change the user ownership of a file (although you can assume this authority using the sudo command we discussed earlier in the chapter and will cover in more detail in Chapter 6).

In Listing 4-12 we show some examples of how to use the chown command to change user and group ownership.

Listing 4-12. Changing Ownership

# chown jsmith myfile
# chown jsmith:admin myfile
# chown -R jsmith:admin /home/jsmith/*

In Listing 4-12, we’ve got three chown commands. The first command changes the user who owns the myfile file to jsmith. The second command changes the ownership of the file’s user and group, the user to jsmith and the group to admin, the owner and group being separated by a colon, :. The third and last command uses the -R switch to enable recursion. The command would change the owner of every file and directory in the /home/jsmith directory to jsmith and the group to admin.

Size and Space

Next in our listing you see the size of the object on the disk. The size of the file is listed in bytes (a thousand and twenty four bytes is a Kibibytes, or K). We can also display sizes in a more human-readable format by adding the -h switch as follows:

$ ls -lh
-rw-rw-r--  1 jsmith jsmith  51K  2016-08- 17 23:47 myfile

On the previous line, you can see that the myfile file is 51 kibibytes in size.

In a listing, the size next to the directory is not its total size but rather the size of the directory’s metadata. To get the total size of all files in a directory, you can use the du, or disk usage, command. Specify (or change to) the directory you want to find the total size of and run the command with the -s and -h switches. The -s switch summarizes the total, and the -h switch displays the size in a human-readable form.

$ du -sh /usr/local/bin
4.7M     /usr/local/bin

The du tool has a number of additional switches and options that you can see by reviewing its man page.

In addition to the size of files and directories, you can also see the total disk space used and free on your host using another command, df. This command displays all of your disks and storage devices and the free space present on them. You can see the df command in Listing 4-13.

Listing 4-13. Displaying Disk Space

$ df -h
Filesystem                                           Size     Used  Avail   Use%  Mounted on
/dev/mapper/VolGroup00-LogVol01  178G     11G   159G    6%      /
/dev/sda1                                             99M     37M    58M    39%    /boot
tmpfs                                                  910M       0     910M    0%      /dev/shm

We’ve executed the command and added the -h switch, which returns human-readable sizes. It shows our current filesystems and their used and free space, as well as percentage used. There are additional options you can use with the df command, and you can review these in the command’s man page. We’ll revisit the df and du commands in Chapter 9.

Date and Time

The penultimate and ultimate items in our listing are the date and time the file was last modified (known as mtime) and the name of the file or directory. Linux also tracks the last time a file was accessed (called atime) and when it was created (called ctime). You can display the last accessed time for a file by listing it with the -u switch as follows:

$ ls -lu

You can list creation dates by using the -c switch:

$ ls -lc

If you want to know the actual time and date on the current host, you can use the useful and powerful date command. Using date on the command line without any options will return the current time and date as follows:

$ date
Tue Aug 19 13:01:20 EST 2016

You can also add switches to the date command to format the output into different date or time format; for example, to display Unix epoch time (the number of seconds since January 1, 1970), you would execute the date command as follows:

$ date +%s
1219116319

Here we’ve used the + symbol to add a format and then specified the format, in this case %s, to display epoch time. Epoch time can be useful when calculating time differences or for adding as a suffix to a file for uniqueness. You can see additional formats in the date command’s man page. You can also use the date command to set the time. Type date and then specify the required date and time in the format MMDDhhmm[[CC]YY]. You can find out more about Unix epoch time at http://en.wikipedia.org/wiki/Unix_time .

Reading Files

The first thing you’re going to learn is how to read files. Many files on Linux hosts, especially configuration files, are text-based and can be read using some simple command-line tools.

The first of these tools is cat. The cat command is so named because it “concatenates and prints files.” In Listing 4-14, you can see the use of the cat command on a text file.

Listing 4-14. Using the cat Command

$ cat /etc/hosts
# Do not remove the following line, or various programs
# that require network functionality will fail.
127.0.0.1               localhost.localdomain localhost localhost
::1             localhost6.localdomain6 localhost6

In Listing 4-14, we’ve outputted the /etc/hosts file to the screen. The /etc/hosts file contains the host entries for our Linux host (like the WINDOWSSystem32servicesetchosts file under Windows) that match hostnames to IP addresses. But the cat command is a pretty simple tool and just outputs the text directly. If the file is very large, the text will keep outputting and scrolling down the screen, meaning if you wanted to see something at the start of the file, you’d need to scroll back.

To overcome this issue, we’re going to look at another command called less.

The less command allows you to scroll through files, both backward and forward, a screen at a time. Each time a page is displayed, you will be prompted as to how you’d like to proceed. We run less by specifying the name of the file as follows:

$ less /etc/services

From inside the less interface, you can scroll through the file. To go to the next page, you use the spacebar, and to advance one line at a time, you use the Enter key. To scroll backward, you can use the B key. You can also scroll using the arrow keys, and to quit the less command, you use the Q key.

In addition to navigating through files, it is also possible to search a file or files for specific information. To do this, we can make use of the very powerful grep command . The grep command allows you to search through a file or files for a string or pattern (using regular expressions) and return the results of that search.

In Listing 4-15, you can see a very simple grep search for the string localhost in the file /etc/hosts.

Listing 4-15. Introducing grep

$ grep localhost /etc/hosts
127.0.0.1      localhost.localdomain localhost localhost
::1                 localhost6.localdomain6 localhost6

To use grep, you specify the string you’re searching for, in this case localhost (grep is case sensitive, so it will only find this lowercase string), and then the name of the file you’re searching in.

By default, grep returns those lines in the file that contain the string we’re searching for. You can also search for more than one file by using the asterisk symbol, as we have demonstrated for other commands earlier in this chapter, for example:

$ grep localhost /etc/host*
$ grep localhost /etc/*

The first command would search all files starting with host* in the /etc/ directory, and the second would search all files in the /etc/ directory. Both searches are for the string localhost.

You can also recursively search down into lower directories by adding the -r switch as follows:

$ grep -r localhost /etc

You can also specify more complicated search terms, for example, multiple words, as follows:

$ grep "local host" /etc/hosts

You can see we’ve specified the words “local” and “host” with a space between them. In order to tell grep these words are grouped together and have them parsed correctly, we need to enclose them in quotation marks. The quotation marks are used often on the command for a number of commands to protect input from being inappropriately parsed. In this case, we’re searching for the exact string "local host", and grep has returned no results because the string is not present in the /etc/hosts file.

The grep command is capable of much more than these simple examples. You can use grep to do complex regular expression searches in files, for example:

$ grep 'J[oO][bB]' *

This would find the strings JOB, Job, JOb, or JoB in all files in the current directory (remember, grep is case sensitive by default, so our regular expression has explicitly specified upper- and lowercase variations). Regular expressions allow you to do some very powerful searching across your host.

Let’s look at some other useful regular expression searches using grep.

$ grep 'job$' *

In the previous line, we’ve searched all files in the current directory for strings ending in job. The $ symbol tells grep to search for the text at the end of strings.

You can use the ^ symbol to in turn search for strings starting with a particular string like so:

$ grep '^job' *

This would return any string starting with job. There are myriad other regular expressions that you’ll find useful for employing frequently.

grep –o –E "([0-9]{1,3}[.]){3}[0-9]{1,3}" /var/log/auth.log

[0-9]{1,3}.

([0-9]{1,3}[.]){3}

([0-9]{1,3}[.]){3}[0-9]{1,3}

egrep -o "[A-Za-z0-9._-][email protected]" /var/log/mail.log

[A-Za-z0-9._-]

[A-Za-z0-9._-]+

[A-Za-z0-9._-][email protected]

email: [email protected]
email: [email protected]
iam a sentence with [email protected]
email: [email protected]

"[A-Za-z0-9._-][email protected]"

$ egrep -o "[A-Za-z0-9._%+-][email protected]" file.txt
[email protected]
[email protected]
[email protected]

Searching for Files

We’ve shown you how you can read a file, but what if you need to find the location of a file? A number of commands and tools on a Linux host allow you to find files in much the same way as the Windows Search function works. In Figure 4-10, you can see the Gnome search function.

Figure 4-10. Gnome search function

On the command line , you can also search for files using the find command. Let’s use the find command to search for a file called myfile in the /home directory:

$ find /home/ -type f -iname myfile*

The find command is very simple to use. First you specify where you are searching, in this case in the /home/ directory. You can also specify / for the root (and thus search the whole directory tree), or any other location that you can access.

Next, we’ve specified two options, -type and -iname. The first option, -type, specifies the type of file we are searching for; in this case, a normal file is represented by f. You can also specify d for directories or s for sockets (special files for interprocess communications), for example (see the man page for all the possible types you can search for). The -iname option searches for a case-insensitive pattern, in this case, all files starting with myfile. These options are just a very small selection of the possible search options; you can also search by owner, group, permissions, date and time of creation or modification, and size, among others. The find command will then search the specified location and return a list of files that match the search criteria.

You could also use the find command to locate files and directories that aren’t owned by any user or group. These often exist if a user or group has been deleted and the associated files not reassigned or removed with that user or group. We’ll talk more about this in Chapter 6. Using the following find command, you can list all files in this state:

# find / -nouser -o -nogroup

This command, run as root, will search the whole directory tree for any files that don’t belong to a valid user or group.

Copying Files

In addition to viewing files, one of the most common actions you’ll need to take while administering your host is to copy a file. The first thing to understand about copying files is that, like reading files, you need to have appropriate permissions in order to copy. To copy a file, you will need two permissions: read permissions on the file you are copying and write permissions in the destination you are copying to.

To copy a file, use the cp command (short for copy). In Listing 4-16, you can see a simple cp command.

Listing 4-16. Copying Files

$ cp /home/jsmith/myfile /home/jsmith/yourfile

In Listing 4-16, we’ve copied the file /home/jsmith/myfile to /home/jsmith/yourfile. You need to be a little bit careful with the cp command. By default, the cp command will copy over existing files without prompting you. This can be bad if you already have a file with the same name as the one you are copying to. You can change this behavior by adding the -i switch. The -i switch enables interactive mode, where you are prompted with a yes or no question if the file you are copying to already exists. You answer y to overwrite or n to abort the copy.

If we didn’t have permission to read the file, we’d get an error like the following:

cp: cannot open `/home/jsmith/myfile' for reading: Permission denied

We’d get a similar error if we could not write to the target destination.

cp: cannot stat `/home/jsmith/yourfile': Permission denied

You can also do a few more things with cp. You can copy multiple files, using the asterisk symbol as follows:

$ cp /home/jsmith/* /home/jsmith/backup/

The target on the previous line, /home/jsmith/backup/, has to be a directory, and we’re copying all files in the /home/jsmith directory to this directory.

You can also select a subset of files.

$ cp -i /home/jsmith/*.c ./

On the previous line, we’ve copied all the files with a suffix of .c to the current directory (using the ./ shortcut). We’ve also added the -i switch to make sure we’re prompted if a file already exists.

You can also copy directories and their contents using cp by adding the –r switch.

$ cp -r /home/jsmith /backup

The previous line copies the /home/jsmith directory and all files and directories beneath it to the /backup directory.

Finally, when copying files using the cp command, some items about the file, such as dates, times, and permissions, can be changed or updated. If you want to preserve the original values on the copy, you can use the -p switch.

$ cp -p /home/jsmith/myfile /home/jsmith/yourfile

The cat command we examined earlier can also be used to copy files using a command-line function called redirection.

$ cat /home/jsmith/myfile > /home/jsmith/yourfile

The use of the > symbol sends the output from one command to the command or action on the other side of the > symbol. In this case, the output of the cat command is redirected into a file called yourfile. If this file doesn’t exist, it will be created. If it does exist, its content will be overwritten.

You can also append to files using the same mechanism.

$ cat /home/jsmith/myfile >> /home/jsmith/yourfile

Using the >> syntax will append the output from the cat of myfile to the end of yourfile. If yourfile does not exist, it will be created.

$ cat /etc/passwd | grep ataylor

$ cat *.txt | sort | uniq > text

$ grep accounts < /etc/group > matched_accounts

$ ./configure; make; make test

Moving and Renaming Files

Moving files around in Linux is pretty straightforward. Using the mv command, you can move a file or directory from one location to another. In order to move a file, you must have write permissions to the file and write permissions to the location you want to move it to.

Listing 4-17 demonstrates how to move a file.

Listing 4-17. Moving Files

$ mv -i ∼/myfile /home/bjones/yourfile

The command in Listing 4-17 moves a file called myfile from the home directory to /home/bjones and renames it to yourfile. The -i option again ensures we get prompted if the target file already exists. You can also rename files in place with the mv command.

$ mv -i ∼/myfile ∼/mynewfile

You can do the same for directories.

Deleting Files

Use the rm (remove) command to delete files. As with any host, deleting files should be done carefully and with thought. On Linux, however, unlike Windows, there isn’t a quick and easy way to undelete files, so you need to be careful and take some precautions before you delete files. The first precaution is the use of the -i switch with the rm command. The -i switch enables interactive mode, which prompts you each time a file is deleted. You have to respond with a y or Y to delete the file or anything else to abort, as you can see in Listing 4-18.

Listing 4-18. The rm -i Switch

$ rm -i /home/jsmith/myfile
rm: remove regular file `/home/jsmith/myfile'? n

You can also delete directories and their contents recursively with the -r switch as follows:

$ rm -r /home/jsmith/backup

This would delete the /home/jsmith/backup directory and all its contents.

You can also override the -i switch using the -f, or force, switch like so:

$ rm -fr /home/jsmith/backup

This will also delete the backup directory and all its contents, but you will not be prompted to confirm the deletions. Be careful of using this switch and always be cognizant of where you are in the directory tree when you execute the command—the results of an inappropriate use of this command could be devastating!

Linking Files

On Linux hosts, you can also create links to files. Links can be used like Windows shortcuts but come in two forms—hard links and soft, or symbolic, links. Hard links are not like Windows shortcuts. They are actual references to the physical file. If you delete all hard links to a file, the file they reference is also deleted.

Soft, or symbolic, links are more like Windows shortcuts: if they are deleted, the original file remains and only the link is removed.

You create links with the ln command. Hard links are created by default, and soft links are created by adding the -s switch. There are a few ways the ln command can be used, but the simplest is to create a link to a target file as follows:

$ ln -s /home/jsmith/myfile

The previous line would create a symbolic link called myfile to the /home/jsmith/myfile file. You can see other options you can use with the ln command by reviewing its man page.

Editing Files

Linux provides a wide variety of editing tools for files, including both GUI and command-line tools. In the GUI , you can find editors like kate or the simpler gedit. These are straightforward editors, but they are not word processors—much like Windows Notepad. Also, there are tools that allow you to edit files from the command line, like the popular vim, nano, joe, or bizarrely popular emacs.

We’re going to start by taking a quick look at vim, which is a text editor that is an enhancement of an older Unix editor called vi. To edit a file, you run the vim command and specify the name of the file to edit.

$ vim ∼/newfile

This opens a file called newfile in your home directory. To insert some text into the file, type i, which is short for insert. You will see the word -- INSERT -- appear at the bottom of the screen. This means you’re in insert mode, which allows you to add to the file. You can now type in the file. Let’s type in hello jsmith. You can also use the arrow keys to move around on the line and through the file. The Enter key can be used to add lines to the file.

When you’ve done that, press the Esc key. The Esc key takes you out of insert mode (you will see the text --   INSERT  -- disappear from the bottom of the screen). You can now save what you’ve added to the file by entering the colon character (:) and the letters wq for a combination of :wq. This means write and quit. You could also just specify w, which would write but not quit. If you quit back to the command line , you can now view your file and see your typed text:

$ cat newfile
hello jsmith

A variety of GUI editors are also available. Some are simple in a similar style to the Microsoft Window’s Notepad or WordPad applications, and others are fully fledged word processors and text editors.

An example of these is the Gnome default text editor, gedit. You can launch gedit in Gnome by clicking the Applications menu, opening the Accessories tab, and selecting the Text Editor application. This will launch the gedit editor, as you can see in Figure 4-11.

Figure 4-11. The gedit editor

Another example of these editors is kate ( http://kateeditor.org/ ), which comes with the KDE GUI. In Figure 4-12, you can see a KDE desktop with kate open.

Figure 4-12. The kate editor