Operation on the real machine, restoring the environment
[[Email protected] Desktop]# rht-vmctl Reset Classroom
[[Email protected] Desktop]# rht-vmctl Reset Server
[[Email protected] Desktop]# rht-vmctl Reset Desktop
###################################################
Configure the following static address parameters for the virtual machine server
– Host Name: server0.example.com
– IP Address: 172.25.0.11
– Subnet Mask: 255.255.255.0
– Default gateway: 172.25.0.254
–dns Server: 172.25.254.254
# Cat/etc/sysconfig/network-scripts/ifcfg-eth0
# cat/etc/resolv.conf
Test DNS resolution
[email protected] ~]# nslookup server0.example.com?
###################################################
? Cron Scheduled Tasks
System Services: Crond
Log file:/var/log/crond
? Using the crontab command
– Edit: Crontab-e [-u user Name]
– View: crontab-l [u user name]
– Clear: Crontab-r [-u user Name]
1. View service Status
[Email protected] ~]# systemctl status Crond
2. Writing a planning task?
? ?* ? ?* ? ?* ? ?* ? ?*
The day of the month?
[[Email protected] ~] #useradd Hanjie
[[Email protected] ~] #ls/Home
[[Email protected] ~] #su-hanjie?
[email protected] ~]#$ Touch a.txt
[[Email protected] ~] #crontab-e-U Hanjie
*/1 * * * */usr/bin/date?>>/home/hanjie/abc.txt
[[Email protected] ~] #watch-N 1 cat/home/natasha/abc.txt
[Email protected] ~]# Useradd Natasha
[email protected] ~]# which ifconfig?? #查询命令所对应的程序在那里
[email protected] ~]# which date
[Email protected] ~]# crontab-e-u Natasha
[Email protected] ~]# crontab-l-u Natasha
*/1 * * * */usr/bin/date?>>/home/natasha/abc.txt
[Email protected] ~]# Watch-n 1 cat/home/natasha/abc.txt
#######################################################
Categories of basic permissions
? Access Mode (permissions)
– read: Allow viewing of content-read?? r
– Write: Allow content to be modified-write?? W
– Executable: Allow to run and switch-execute? x
? For text files:
? ? ? ? ? ? R:cat Head Tail Less
? ? ? ? ? ? W:? vim
? ? ? ? ? ? x:? run
? Permissions applicable object (attribution)
– Owner: The user who owns this file/directory-user?? U
– Owning group: The group that owns this file/directory-group??? G
– Other users:-other for users other than the owner, the owning group? o
Permission bit hard connection number belongs to main group size last modified time File/directory name
[Email protected] ~]# ls-l/etc/passwd
[Email protected] ~]# ls-ld/etc/
[Email protected] ~]# Ls-ld/root
[Email protected] ~]# ls-ld/home/student
[[email protected] ~]# ls-ld/tmp----is a special basic privilege
? Start with "-": File
? Start with "L": Shortcut
? Start with "D": Directory
? Using the chmod command
–chmod [-R] Attribution relationship +-= permission category document ...
? ? ? ? [-R] Recursion gives permission
[Email protected] ~]# mkdir/nsd010
[Email protected] ~]# LS-LD/NSD01
[Email protected] ~]# chmod u-x/nsd01
[Email protected] ~]# LS-LD/NSD01
[Email protected] ~]# chmod g+w/nsd01
[Email protected] ~]# LS-LD/NSD01
[Email protected] ~]# chmod o=rwx/nsd01
[Email protected] ~]# LS-LD/NSD01
[Email protected] ~]# chmod u=rwx,g=rx,o=r/nsd01
[Email protected] ~]# LS-LD/NSD01
################################################
? How to tell if a user has permissions
??? 1. Determine the user's identity???? Owner > Owning group > Other people? Match and stop??
??? 2. See Permissions Division for corresponding permission bits
? ?
The r permission of the directory: Ability to view this directory content ls
The W permission of the directory: ability to perform rm/mv/cp/mkdir/touch/... Actions to change directory contents
? directory x permissions: Ability to switch to this directory on CD
####################################################
Create a new/nsddir/directory with the root user, create a new Readme.txt file in this directory, and further complete the following operations
1) Enable user Zhangsan to create subdirectories in this directory? Switch users? Su-zhangsan
? ? chmod o+w?/nsddir/
[Email protected] ~]# Mkdir/nsddir
[Email protected] ~]# Touch/nsddir/readme.txt
[Email protected] ~]# Useradd Zhangsan
[Email protected] ~]# Su-zhangsan
[[Email protected] ~]$ exit
[Email protected] ~]# chmod o+w/nsddir/
[Email protected] ~]# Su-zhangsan
[Email protected] ~]$ MKDIR/NSDDIR/ABC
[Email protected] ~]$ ls/nsddir/
2) make the user Zhangsan not be able to create subdirectories under this directory
? ? chmod o-w?/nsddir/
3) Enable user Zhangsan to modify Readme.txt file
? ? chmod o+w?/nsddir/readme.txt
4) Adjust permissions on this directory so that all users cannot access this directory
?? chmod u-x,g-x,o-x?/nsddir/
5) Set permissions for this directory and all documents under it rwxr-x---
?? chmod-r? u=rwx,g=rx,o=---?/nsddir/
###############################################
Set document Attribution
? Using the Chown command
–chown [-R] belongs to main document ...
–chown [-R]: belongs to group document ...
–chown [-R] Owner: a group of documents ...
[Email protected] ~]# MKDIR/NSD05
[Email protected] ~]# LS-LD/NSD05
[Email protected] ~]# Groupadd tedu
[Email protected] ~]# chown dc:tedu/nsd05
[Email protected] ~]# LS-LD/NSD05
[Email protected] ~]# chown student/nsd05
[Email protected] ~]# LS-LD/NSD05
[Email protected] ~]# chown:root/nsd05/
[Email protected] ~]# ls-ld/nsd05/
####################################################
? Special permissions (Additional permissions)
Set UID
? Attached to the X-position of the owner
– The owner's permission identifier becomes S
– For executable files, Set UID allows the user to have the file
Master identity and Partial permissions (pass-through owner identity)
Set GID
? Attached to the X-position of the genus Group
– the permission identifier of the group becomes S
– for executables, similar to set UID (pass as group identity)
– For directories, set GID allows new documents to be automatically set in the directory
The same group as the parent directory
??
[Email protected] ~]# Mkdir/tarena
[Email protected] ~]# Ls-ld/tarena
[Email protected] ~]# Chown:tedu/tarena
[Email protected] ~]# Ls-ld/tarena
[Email protected] ~]# MKDIR/TARENA/NSD01
[Email protected] ~]# LS-LD/TARENA/NSD01
[Email protected] ~]# chmod g+s?/tarena/
[Email protected] ~]# ls-ld?/tarena/
[Email protected] ~]# mkdir? /tarena/nsd02
[Email protected] ~]# ls-ld?/tarena/nsd02
[email protected] ~]# touch?/tarena/nsd02/abc.txt
[Email protected] ~]# ls-l?/tarena/nsd02/abc.txt
#################################################
Sticky Bit
? Attached to another person's X-position
– The other person's permission ID will change to T
– A directory for open W permissions that can prevent users from abusing W writes
Permissions (Prohibit manipulating others ' documents)
[Email protected] ~]# Mkdir/public
[Email protected] ~]# chmod u=rwx,g=rwx,o=rwx/public
[Email protected] ~]# Ls-ld/public
[Email protected] ~]# chmod o+t/public
[Email protected] ~]# Ls-ld/public
###################################################
The role of ACL policies
? Limitations of document Attribution
– No one belongs to three roles: owner, group, other person
– Unable to achieve finer control
? ACL Access Policy
– Ability to set independent permissions on individual users, individual groups
– Most mounted EXT3/4, XFS file systems are supported by default
[Email protected] ~]# mkdir/test
[Email protected] ~]# ls-ld/test
[Email protected] ~]# chmod o=---/test
[Email protected] ~]# ls-ld/test
[Email protected] ~]# Su-zhangsan
[Email protected] ~]$ cd/test/
-BASH:CD:/test/: Permission denied
[[Email protected] ~]$ exit
Logout
[Email protected] ~]# setfacl-m u:zhangsan:rx/test/
[Email protected] ~]# getfacl/test/
[Email protected] ~]# Su-zhangsan
[Email protected] ~]$ cd/test/
[Email protected] test]$ pwd
[[Email protected] test]$ exit
? Using the Getfacl, Setfacl command
–getfacl documentation ...
–setfacl?-M u: User name: Permission category Document ...
–setfacl?-M G: Group name: Permissions Category Document ...
–setfacl?-X u: User name?? Document...? ? ? ? #删除指定的ACL策略??
–setfacl?-B documentation ...? ? ? ? ? ? ? ? ? ? ? ? ? ? #清空ACL策略?????
[Email protected] ~]# getfacl/test/
[Email protected] ~]# setfacl-m u:dc:rwx/test/
[Email protected] ~]# setfacl-m u:natasha:rx/test/
[Email protected] ~]# getfacl/test/
[Email protected] ~]# setfacl-x u:dc/test/? #删除指定的ACL
[Email protected] ~]# getfacl/test/
[Email protected] ~]# setfacl-b/test/?? #清空所有的ACL
[Email protected] ~]# getfacl/test/
##################################################
[Email protected] ~]# MKDIR/NSD20
[Email protected] ~]# chmod U=RWX,G=RWX,O=RWX/NSD20
[Email protected] ~]# LS-LD/NSD20
Drwxrwxrwx. 2 root root 6 October 15:49/nsd20
[Email protected] ~]# setfacl-m U:natasha:---/nsd20
###################################################
Using LDAP authentication
"????" Traditional username password: locally created for local login?/etc/passwd
???? network users: Created on the LDAP server, you can log on to each machine in the domain
? LDAP server: Classroom
? ? Client: Specify the server-side LDAP location
? ??
? 1. Installing the Client Software
? ? ? Package
? ? ? ? ? SSSD: Communication software with the server
? ? ? ? ? AUTHCONFIG-GTK: Graphics Configuration SSSD Tool
[Email protected] ~]# rpm-q sssd????? #验证软件包安装成功
[Email protected] ~]# rpm-q AUTHCONFIG-GTK
? 2. Run the Graphics Configuration SSSD tool: AUTHCONFIG-GTK
[Email protected] ~]# AUTHCONFIG-GTK
? User account Database: LDAP
? LDAP Search Base dn:dc=example,dc=com
? LDAP server: classroom.example.com
Check: Connect with TLS encryption
? ? ? ? Specify Certificate encryption:
?????? http://172.25.254.254/pub/example-ca.crt
?? Authentication method: LDAP password
3. Start the SSSD service and set it to boot from
[Email protected] ~]# systemctl restart SSSD
[Email protected] ~]# Systemctl enable SSSD
4. Verification
[[email protected] ~]# grep ' Ldapuser0 '/etc/passwd
[[email protected] ~]# ID LDAPUSER0
##################################################
Home directory Roaming
? Network File system
– The specified folder is shared to the client by the NFS server
– The client will mount this shared directory to a local directory to access this share
Resources are as convenient as accessing a local directory
– Similar to EXT4, XFS and other types, except that resources are online
? View NFS Resources
[Email protected] ~]# showmount-e 172.25.254.254
? Mount to mount NFS shared content on the server to a local directory
[Email protected] ~]# mkdir/home/guests
# Mount 172.25.254.254:/home/guests/??/home/guests
[Email protected] ~]# ls/home/guests
[Email protected] ~]# Su-ldapuser0
Linux system Administrator Technology (Admin)-------Fifth day