≡ Menu

Linux login control

7 Powerful Firefox Password Managers [ Add-ons ]

This is an user contributed article.

Choosing the password is only the first step; you have got to remember it. You can not remember 100s of password at a time. However, with the help of a password manager, you can organize passwords, host names, and PIN codes.

Like most of you, I love using Firefox and explaining the advantages of Firefox to others who use other browsers. Unlike other browsers, Firefox has huge list of excellent add-ons that will satisfy almost all of your requirements in using a browser. Following are the list of 7 powerful Firefox password related add-ons that will make your life in managing passwords very safe, secure and easy under Mac OS X, Linux / UNIX and Windows operating system.
[click to continue…]

pssh: Run Command On Multiple SSH Servers

I've already written about tentakel tool and shell script hack to run a single command on multiple Linux / UNIX / BSD server. This is useful to save time and run UNIX commands on multiple machines. Linux.com has published an article about a new and better tool called pssh:

If you want to increase your productivity with SSH, you can try a tool that lets you run commands on more than one remote machine at the same time. Parallel ssh, Cluster SSH, and ClusterIt let you specify commands in a single terminal window and send them to a collection of remote machines where they can be executed.

Intelligent Platform Management Interface (IPMI) is a hardware level interface specification that defines a common, abstracted, message-based interface to platform monitoring and control functions. Both IPMI and KVM over IP can be used in emergency situations.
[click to continue…]

KDE 4 has been released. I've received couple of questions about installing KDE 4 under Ubuntu Linux 7.10. KDE 4 Packages are available for Ubuntu Linux version 7.10 (Gutsy) and from development Ubuntu Linux Hardy version. They install to /usr/lib/kde4 and can be installed alongside your existing KDE 3. However these packages are not compatible with KDE 4 beta packages. Following simple step will help you install KDE 4.

How do I install KDE 4 under Ubuntu Linux?

First you need to update Ubuntu package source file.

WARNING! These examples may crash your Desktop as KDE v4.0 packages are not 100% compatible with Ubuntu 7.10. Following instructions worked on my desktop but failed to work on Laptop. YMMV.

Step # 1: Update Source File

Open a terminal

Open /etc/apt/sources.list file using a text editor such as vi or gedit, enter:
$ sudo vi /etc/apt/sources.list
OR
$ sudo gedit /etc/apt/sources.list
Append following line:
deb http://ppa.launchpad.net/kubuntu-members-kde4/ubuntu gutsy main
Close and save the file. Type the following command to update package list:
$ sudo apt-get update

GUI tool to update software source

Alternatively, you can use GUI tool by visiting System > Administration > Software Sources > Third Party Software > Add > Enter url 'deb http://ppa.launchpad.net/kubuntu-members-kde4/ubuntu gutsy main' > Add Source > Update > Close
Add KDE 4 as Software Source for Ubuntu Linux
(Fig. 01: Update Software Source for KDE 4)

Step # 2: Install KDE 4 desktop

To install kde 4, enter:
$ sudo apt-get install kde4-core
You'll get a warning when installing kde 4, just force to install the same without verification:

WARNING: The following packages cannot be authenticated!
Install these packages without verification [y/N]? y

Output:

Reading package lists... Done
Building dependency tree
Reading state information... Done
The following extra packages will be installed:
  dbus-x11 dolphin-kde4 kappfinder-kde4 kde-icons-oxygen kde4libs-bin kdebase-bin-kde4 kdebase-data-kde4 kdebase-kde4 kdebase-runtime
  kdebase-runtime-bin-kde4 kdebase-runtime-data kdebase-runtime-data-common kdebase-workspace kdebase-workspace-bin kdebase-workspace-data
  kdelibs5 kdelibs5-data kdepasswd-kde4 kdepimlibs-data kdepimlibs5 kfind-kde4 klipper-kde4 konqueror-kde4 konqueror-nsplugins-kde4
  konsole-kde4 ksysguard-kde4 ksysguardd-kde4 kwin-kde4 kwrite-kde4 libcapseo0 libcaptury0 libclucene0 libexiv2-0 libgpgme11 libkonq5
  libkonq5-templates libphonon4 libplasma1 libpth20 libqimageblitz4 libraptor1 librasqal0 librdf0 libsoprano4 libstreamanalyzer0
  libstreams0 libstrigiqtdbusclient0 systemsettings-kde4
Suggested packages:
  kdebase kde-i18n sword-frontend gpgsm
Recommended packages:
  exiv2 raptor-utils redland-utils
The following NEW packages will be installed:
  dbus-x11 dolphin-kde4 kappfinder-kde4 kde-icons-oxygen kde4-core kde4libs-bin kdebase-bin-kde4 kdebase-data-kde4 kdebase-kde4
  kdebase-runtime kdebase-runtime-bin-kde4 kdebase-runtime-data kdebase-runtime-data-common kdebase-workspace kdebase-workspace-bin
  kdebase-workspace-data kdelibs5 kdelibs5-data kdepasswd-kde4 kdepimlibs-data kdepimlibs5 kfind-kde4 klipper-kde4 konqueror-kde4
  konqueror-nsplugins-kde4 konsole-kde4 ksysguard-kde4 ksysguardd-kde4 kwin-kde4 kwrite-kde4 libcapseo0 libcaptury0 libclucene0 libexiv2-0
  libgpgme11 libkonq5 libkonq5-templates libphonon4 libplasma1 libpth20 libqimageblitz4 libraptor1 librasqal0 librdf0 libsoprano4
  libstreamanalyzer0 libstreams0 libstrigiqtdbusclient0 systemsettings-kde4
0 upgraded, 49 newly installed, 0 to remove and 2 not upgraded.
Need to get 105MB of archives.
After unpacking 204MB of additional disk space will be used.
Do you want to continue [Y/n]? y
WARNING: The following packages cannot be authenticated!
  libphonon4 libstreams0 libstreamanalyzer0 kdelibs5-data kde4libs-bin kdelibs5 libstrigiqtdbusclient0 libkonq5-templates libkonq5
  dolphin-kde4 kappfinder-kde4 kdebase-data-kde4 kdebase-bin-kde4 kdepasswd-kde4 kfind-kde4 konqueror-nsplugins-kde4 konqueror-kde4
  konsole-kde4 kwrite-kde4 kdebase-kde4 kdebase-workspace-data libplasma1 ksysguardd-kde4 ksysguard-kde4 kdebase-workspace-bin klipper-kde4
  kwin-kde4 systemsettings-kde4 kdebase-workspace kdepimlibs-data kdepimlibs5 kde4-core...
Install these packages without verification [y/N]? y
Get:1 http://ppa.launchpad.net gutsy/main libphonon4 4:4.0.0-0ubuntu2~gutsy1~ppa1 [164kB]
Get:2 http://archive.ubuntu.com gutsy-backports/universe kde-icons-oxygen 4:4.0.0-0ubuntu1~gutsy1 [45.4MB]
Get:3 http://in.archive.ubuntu.com gutsy/main dbus-x11 1.1.1-3ubuntu4 [34.8kB]
................
...
.........
Setting up systemsettings-kde4 (4:4.0.0-0ubuntu7~gutsy1~ppa1) ...
Setting up kdebase-workspace (4:4.0.0-0ubuntu7~gutsy1~ppa1) ...
Setting up kde4-core (3.3~gutsy1~ppa1) ...
Processing triggers for libc6 ...
ldconfig deferred processing now taking place

Note: It may take some time to install kde 4. You also need to disable compiz 3d desktop effect support.

References:

=> Kubuntu Project - Be Free with KDE 4.0

One of our regular reader asks:

I’d like to discover information about who is currently using the system. When a user logs in what files are updated in UNIX / Linux?

Linux / UNIX have utmp and wtmp files to keep login records. Following three files keeps track of all logins and logouts to the system.

=> /var/run/utmp : List of current login sessions.
=> /var/log/wtmp : Database of past user logins / previous login sessions.
=> /var/log/lastlog : Last logins information about users

How do I access login records files?

These are a binary log files, and grows linearly at its end. So you cannot view records using cat or other text based utilities. The file <utmp.h> declares the structures used to record information about current users in the file. This can be accessed using C programs or other specialized utilities:

Suggested readings:

  • Man pages - ac(1), date(1), last(1), login(1), who(1), getutent(3), updwtmp(3), init(8), wtmp(5)
  • Header file /usr/include/utmp.h

There are two ways to allow / restrict system login to specific user groups only. The simplest method is to use a PAM module called pam_listfile.so. Another option is to use login access control table. Locking down system login access is very important task if you need a secure system.

The system administrator is free to choose how individual service-providing applications will authenticate users. Many new admins not aware of PAM and related services. In this tip you are going to use authentication (auth) group, which authenticate a user and set up user credentials.

Deny or allow access to groups using PAM

pam_listfile is a PAM module which provides a way to deny or allow access to services based on an arbitrary file. Service can be any one of the following
=> su
=> sudo
=> ftp
=> Mail Service (MTA/POP3/IMAP)
=> SSH
=> Samba
=> Crond
=> Squid and many others

How do I setup pam_listfile PAM module for group based login?

Let us say you would like to allow login to only members of wheel (root user) and webdev groups.

Step # 1: Create /etc/login.group.allowed file

/etc/login.group.allowed filename contains one line per group listed. If the group name is found, then login is allowed; else authorization request denied:
# vi /etc/login.group.allowed
Add group names:
root
wheel
webdev

Save and close the file.

Step # 2: Allow group based login to all services

Open /etc/pam.d/system-auth file if you are using Redhat / RHEL / Fedora / CentOS Linux. If you are using Debian / Ubuntu Linux use /etc/pam.d/common-auth file:
# vi /etc/pam.d/system-auth
You must add the following config directive at the top of the file:
auth required pam_listfile.so onerr=fail item=group sense=allow file=/etc/login.group.allowed
Where,

  • auth required pam_listfile.so : Pam module name required for allowing group based login
  • onerr=fail : What to do if something weird happens like being unable to open the file or busy disk I/O. In our case login is denied till weird problem is sorted out.
  • item=group : Check for group name
  • sense=allow : The authorization request to succeed if group name found in /etc/login.group.allowed file
  • file=/etc/login.group.allowed : Filename contains one line per group name listed. If the group name is found, then if sense=allow, PAM_SUCCESS is returned, causing the authorization request to succeed.

Caution: Please note that by adding above line you are forcing this configuraion on all login services including ssh, telnet, mail, su, sudo and all PAM aware services. If you need login restrictions for specific service modify specific service located in /etc/pam.d/service-name file.

Save and close the file. This will only allow users that belong to the root, wheel and webdev group to login to the system. You can apply above technique to:

  • User names
  • Shell
  • Tty names
  • Rhost / Ruser (remote login host / user id)

The config can be reversed to denied login to specific group name by modify the configuration file. This is left as exercise to our reader (hint type man pam_listfile).

=> Related PAM config FAQ : Linux PAM configuration that allows or deny user login via the sshd server

Generally service such as ssh, screen, expect, telnet etc use pty (pseudo-terminals) in master – slave mode for login and other purposes. If pty setting is too low many users will not able to login to system using ssh or other commands. In this tip I will explain how to increase the maximum number of pseudo-terminals.

pty man page defines pseudo-terminal as follows:

A pseudo-terminal is a pair of virtual character devices that provide a bidirectional communication channel. One end of the channel is called the master; the other end is called the slave. The slave end of the pseudo-terminal provides an interface that behaves exactly like a classical terminal. A process that expects to be connected to a terminal, can open the slave end of a pseudo-terminal and then be driven by a program that has opened the master end. Anything that is written on the master end is provided to the process on the slave end as though it was input typed on a terminal.

List the maximum number of Pseudo-terminals

Just run the following command to list / display the maximum number of Pseudo-terminals under Linux
$ cat /proc/sys/kernel/pty/max
Output:

1024

Increase the maximum number of Pseudo-terminals (PTY)

If you have large Linux installation such as University or ISP login service you need to increase the PTYs to allow more login sessions. Open kernel configuration file - /etc/sysctl.conf:
# vi /etc/sysctl.conf
Append following config directive (support 5120 ptys)
kernel.pty.max = 5120
Save and close the file. Reload the changes:
# sysctl -p
Verify that the new maximum number of pseudo-terminals value is changed, enter:
$ cat /proc/sys/kernel/pty/max

Further readings

=> Refer to sysctl, proc, and pty man pages for more information.