Linux chattr and lsattr commands

these two commands are used to view and change the file and directory attributes. Compared with the CHMOD command, chmod only changes the read/write and execution permissions of files, and the underlying attribute control is changed by chattr.

usage of the chattr command: chattr [-RVF] [-V version] [mode] files...
the most important part is in the [mode] section. The [mode] Section is composed of the +-= and [asacddiijsttu] characters, this part is used to control the
attributes of the file.

+: append a parameter based on the original parameter settings.
-: remove the parameter based on the original parameter settings.
=: updated to the specified parameter settings.
A: The atime (access time) of a file or directory cannot be modified, which can effectively prevent I/O errors on a laptop disk.
S: Hard Disk I/O synchronization option, similar to sync.
A: append. After this parameter is set, data can only be added to the file, but cannot be deleted. This attribute is mostly used for server log file security. Only root can set this attribute.
C: compresse: Specifies whether the file is compressed before being stored. Automatic decompression is required for reading.
D: No dump. The setting file cannot be the backup target of the dump Program .
I: the file cannot be deleted, renamed, or linked, and cannot be written or added. The I parameter is very helpful for security settings of the file system.
J: Journal. Set this parameter to enable the file system to be mounted through the Mount parameter: Data = ordered or data = writeback.
, the file is first recorded (in Journal) when it is written ). If the filesystem parameter is set to data = Journal, this parameter is automatically invalid.
S: Confidential deletion of files or directories, that is, all hard disk space is withdrawn.
U: In contrast to S, when set to U, the data content still exists in the disk and can be used for undeletion.
parameters a and I are often used. Option A can only be added and cannot be deleted. It is mostly used for security settings of the log system. I is a more rigorous security setting. This option can be applied only to processes with superuser (Root) or cap_linux_immutable processing capability (identifier.


Example:

1,Use the chattr command to prevent the modification of a key file in the system.:
#Chattr + I/etc/resolv. conf

Then run the MV/etc/resolv. conf command to operate on the file. Operation not permitted is obtained.
. When editing the file, VIM prompts W10: Warning: Changing a readonly.
File error. To modify this file, remove the I attribute: chattr-I/etc/resolv. conf.

#Lsattr/etc/resolv. conf
The following attributes are displayed:
---- I --------/etc/resolv. conf

2,Allows a file to only append data to it, but cannot delete it. It is applicable to various log files.:
#Chattr + A/var/log/messages

 

If you change the Linux Root Password, the following error occurs: passwd: authentication token manipulation.

instance:
as follows:
[root @ ticket-A ~] # Passwd root
changing password for user root.
New UNIX password:
retype new Unix Password:
sorry, passwords do not match
New UNIX password:
retype new Unix Password:
passwd: authentication token manipulation error

Modify as follows:
[Root @ ticket-A ~] # Chattr-I/etc/passwd
[Root @ ticket-A ~] # Chattr-I/etc/shadow
Modify the root password.

After modification, execute
[Root @ ticket-A ~] # Chattr + I/etc/passwd
[Root @ ticket-A ~] # Chattr + I/etc/shadow