How do I prevent a non-root user from shutting down, rebooting, or halting the system?
The steps to follow to prevent non-root users to shutdown/reboot/halt the server are:
In the file /etc/X11/gdm/gdm.conf, change the line that reads:
SystemMenu=true
to
SystemMenu=false
In the file /etc/inittab, change the line that reads:
ca::ctrlaltdel:/sbin/shutdown -t3 -r now
to
ca::ctrlaltdel:echo <A message indicating rebooting is not possible>
In the directory /etc/security/console.apps/, remove the files: reboot, poweroff, and halt. To remove files, use the rm command. Example: rm /etc/security/console.apps/poweroff.
Remove the file /usr/bin/poweroff
How to Make eth0 Blink?
#sudo ethtool -o eth0
Ethtool will contune to blink the lights on the card until you press Ctrl+c which make it easy for use to map their locations on paper and get the right cables for each network segment in the right card.
Finding All Files above 20MB
Finds all files over 20,000KB (roughly 20MB) in size and presents their names and size in a human readable format:
find / -type f -size +20000k -exec ls -lh {} \; | awk '{ print $9 ": " $5 }'
Can I get to a particular port on a remote server?
#netcat -w 3 -z -vvn 64.233.187.99 79-81
(UNKNOWN) [64.233.187.99] 81 (?) : Connection timed out
(UNKNOWN) [64.233.187.99] 80 (www) open
(UNKNOWN) [64.233.187.99] 79 (finger) : Connection timed out
This example is essentially running a port scan on google.com from port 79 to 81, waiting for 3 seconds for a port to time out. You can see that only port 80 is open. I use this constantly when troubleshooting connections between Application Servers and Databases, especially when firewalls are involved. This is much more meaningful than a simple ping. Note that netcat only accepts IP addresses, not host names, so you can ping a host first to get it’s IP address first. Also note that port scans may violate your own network policies and could be construed as a form of hacking, so use at your own risk and tell someone what you’re going to do before you do it. You can install netcat on Windows using Cygwin (the command is nc in cygwin)
Deleting files older by x days
find /path/to/files* -mtime +5 -exec rm {} \;
Explanation
The first argument is the path to the files. This can be a path, a directory, or a wildcard as in the example above. I would recommend using the full path, and make sure that you run the command without the exec rm to make sure you are getting the right results.
The second argument, -mtime, is used to specify the number of days old that the file is. If you enter +5, it will find files older than 5 days.
The third argument, -exec, allows you to pass in a command such as rm. The {} \; at the end is required to end the command.
This should work on Ubuntu, Suse, Redhat, or pretty much any version of linux.
Knowing the attached USB
The command lsusb will list all the USB Attached.
# lsusb
[root@localhost ~]# lsusb
Bus 006 Device 003: ID 03f0:1327 Hewlett-Packard
Bus 006 Device 002: ID 03f0:1027 Hewlett-Packard
Bus 006 Device 001: ID 0000:0000
Bus 005 Device 001: ID 0000:0000
Bus 004 Device 001: ID 0000:0000
Bus 003 Device 001: ID 0000:0000
Bus 002 Device 001: ID 0000:0000
Bus 001 Device 001: ID 0000:0000
Magic of find command
Search and list all files from current directory and down for the string ABC:
find ./ -name "*" -exec grep -H ABC {} \;
find ./ -type f -print | xargs grep -H "ABC" /dev/null
egrep -r ABC *
Find all files of a given type from current directory on down:
find ./ -name "*.conf" -print
* Find all user files larger than 5Mb:
find /home -size +5000000c -print
* Find all files owned by a user (defined by user id number. see /etc/passwd) on the system: (could take a very long time)
find / -user 501 -print
* Find all files created or updated in the last five minutes: (Great for finding effects of make install)
find / -cmin -5
* Find all users in group 20 and change them to group 102: (execute as root)
find / -group 20 -exec chown :102 {} \;
* Find all suid and setgid executables:
find / \( -perm -4000 -o -perm -2000 \) -type f -exec ls -ldb {} \;
find / -type f -perm +6000 -ls
Note: suid executable binaries are programs which switch to root privaleges to perform their tasks. These are created by applying a "stickey" bit: chmod +s. These programs should be watched as they are often the first point of entry for hackers. Thus it is prudent to run this command and remove the "stickey" bits from executables which either won't be used or are not required by users. chmod -s filename
* Find all world writable directories:
find / -perm -0002 -type d -print
* Find all world writable files:
find / -perm -0002 -type f -print
find / -perm -2 ! -type l -ls
* Find files with no user:
find / -nouser -o -nogroup -print
* Find files modified in the last two days:
find / -mtime 2 -o -ctime 2
* Compare two drives to see if all files are identical:
find / -path /proc -prune -o -path /new-disk -prune -o -xtype f -exec cmp {} /new-disk{} \;
Finding all the users on your system
Cat /etc/passwd |grep "/home" |cut -d: -f1
