crucif0rm's Sysadmin Adventures

I’ve come to rely on sar for accurate performance statistics more and more as I grow in my Sysadmin role. I thought I’d share some of my notes.

To view process creation statistics, enter:
# sar -c 3 10

To view I/O and transfer rate statistics, enter:
# sar -b 3 10

To view paging statistics, enter:
# sar -B 3 10

To view block device statistics, enter:
# sar -d 3 10

To view statistics for all interrupt statistics, enter:
# sar -I XALL 3 10

To view device specific network statistics, enter:
# sar -n DEV 3 10
# sar -n EDEV 3 10

To view CPU specific statistics, enter:
# sar -P ALL

Only 1st CPU stats:
# sar -P 1 3 10

To view queue length and load averages statistics, enter:
# sar -q 3 10

To view memory and swap space utilization statistics, enter:
# sar -r 3 10
# sar -R 3 10

To view status of inode, file and other kernel tables statistics, enter:
# sar -v 3 10

To view system switching activity statistics, enter:
# sar -w 3 10

To view swapping statistics, enter:
# sar -W 3 10

To view statistics for a given process called Apache with PID # 3256, enter:
# sar -x 3256 3 10

-crucif0rm

I actually wrote this script because I couldn’t find a proftpd user management script/app for non system users.

crucif0rm what the hell are you talking about?

You can configure proftpd to read it’s access list from a separate file, rather than using the UNIX system users (/etc/passwd), this is useful in several scenario’s, the one I used it for was:

I have 20+ domains hosted on my Linux device, and there’s some people that need access to a few of the directories to make mild/moderate changes whenever they need, but I do NOT want them to have an actual local user account for security reasons.

In ProFTPD I configured it to read from an alternate user list:

AuthOrder             mod_auth_file.c                     #enables the alternate auth config file
AuthUserFile             /etc/ftpasswd                 #sets the file you want to read from

The cool thing about this setup is how ProFTPD parses the file, it reads it EXACTLY like the /etc/passwd file. ProFTPD comes with a nice application called “ftpasswd” which has tons of features, but I used it in my script to format my input:

#!/bin/bash
#script to add new users to proftpd /etc/ftpasswd
read -p “Enter username: ” username
read -p “Enter password: ” password
read -p “Enter home (/data/www/www.example.com): ” ftpdir
#read -p “Enter GID (home dir group)” gid
grep -q ^$username /etc/ftpasswd

if [ $? -eq 0 ]
then
echo “$username exists!”
exit 1
else
gid=709
uid=”$(tail -1 /etc/ftpd.passwd | cut -d’:’ -f3 | awk ‘{printf $0+1}’)”
part2=”$(echo “$password” | ftpasswd –stdin –passwd –file=/etc/ftpasswd –name=$username –uid=$uid –gid=$gid –home=$ftpdir –shell=/bin/false 2>&1)”

if [ $? -eq 0 ]
then
final=”$(tail -1 /etc/ftpasswd)”
echo -e “# Account created succesfully #\n\n Username: $username\n Password: $password\n UID/GID: $uid $gid\n home DIR: $ftpdir\n entry: $final”
else
echo -e “ERROR:\n $part2″
fi
fi

How it works:

1. Request the username, password, home dir
2. check the current custom Auth file for an existing entry
3. parse the most recently added users 'UID' and create the new one with a new increment of 1.
4. convert all the previously input information into 'passwd' format into the ftpasswd file.
5. Report if the user creation was successful, with a detailed report and also report if it failed.

If you look at the GID it sets, it’s configured to 709, specifically because all the users i’ll be adding will need the same permissions as the 709 group.
wait, crucif0rm.. what about security?
DefaultRoot ~

We’re able to securely lock any user to their home directory specified (in /etc/ftpasswd) when they were added to the config.
They will be blind to any other directory behind it and in the FTP client. The initial home folder would show as ‘ / ‘ directory.

-crucif0rm

grep -v ^\# /etc/postfix/main.cf | grep -v ' #' | grep -v '^$'

Example:

queue_directory = /var/spool/postfix
command_directory = /usr/sbin
daemon_directory = /usr/libexec/postfix
mail_owner = postfix
inet_interfaces = all
mydestination = hash:/etc/postfix/mydomains
unknown_local_recipient_reject_code = 550
mynetworks = 192.168.0.1/32, 127.0.0.0/8
alias_maps = hash:/etc/aliases
alias_database = hash:/etc/aliases
home_mailbox = Maildir/

smtpd_banner = $myhostname ESMTP $mail_name
debug_peer_level = 2
debugger_command =
     PATH=/bin:/usr/bin:/usr/local/bin:/usr/X11R6/bin
     xxgdb $daemon_directory/$process_name $process_id & sleep 5
sendmail_path = /usr/sbin/sendmail.postfix
newaliases_path = /usr/bin/newaliases.postfix
mailq_path = /usr/bin/mailq.postfix
setgid_group = postdrop
html_directory = no
manpage_directory = /usr/share/man
sample_directory = /usr/share/doc/postfix-2.3.3/samples
readme_directory = /usr/share/doc/postfix-2.3.3/README_FILES
virtual_alias_maps = hash:/etc/postfix/virtual
smtpd_sasl_auth_enable = yes
smtpd_sasl_security_options = noanonymous
smtpd_sasl_local_domain = $myhostname
smtp_sasl_security_options = noplaintext
smtpd_recipient_restrictions = permit_sasl_authenticated, permit_mynetworks, reject_unauth_destination
mailbox_size_limit = 256000000

-crucif0rm