Unix System Administration

1. Unix System Administration Chuck Hauser 2007-10-19

2. Cfengine • Automated suite of programs for configuring and maintaining Unix-like computers • Developed by Mark Burgess of Oslo University College • Started in 1993; wanted to replace shell scripts with a declarative language that documented configurations.

3. Some Cfengine Capabilities • Check or set file ownership and permissions • Edit configuration files • Remove unwanted files (“tidy”) • Check integrity of important files • Process management

4. Implementing Cfengine • Primary Documentation: www.cfengine.org • Secondary Documentation: Wikipedia lists several Cfengine links • Software: required packages are at www.sunfreeware.com

5. Additional Useful Info

6. Cfengine Software Packages

7. Installing Packages • Put packages in /var/spool/pkg. • Install in this order: libgcc, db, openssl, cfengine. • Unzip each package:# gunzipÄlibgcc-3.3-sol9-sparc-local.gz • Then install as root:# pkgadd –dÄlibgcc-3.3-sol9-sparc-local

8. Cfengine Directory Structure • After package installation, libraries are in /usr/local/lib and binaries are in /usr/local/sbin. • Cfengine’s production location is /var/cfengine: /var/cfengine/bin stores programs, ./inputs stores configuration files, and ./outputs stores output from cfagent runs in timestamped files. • Additional /var/cfengine directories are created as needed by the Cfengine programs.

9. Setup Script for Cfengine #!/usr/bin/ksh # if [ ! -f /usr/local/sbin/cfagent ] then echo "Quitting, no cfengine programs onÄthis machine!" exit fi if [ ! -d /var/cfengine/bin ] then mkdir -p /var/cfengine/bin chown root:other /var/cfengine/bin fi

10. Setup Script continued cd /usr/local/sbin cp cfagent cfenvgraph cfrun cfdoc cfexecd \ cfservd cfenvd cfkey cfshow vicf \ /var/cfengine/bin if [ ! -d /var/cfengine/inputs ] then mkdir /var/cfengine/inputs fi if [ ! -d /var/cfengine/outputs ] then mkdir /var/cfengine/outputs fi

11. Some Cfengine Programs

12. How It Works • A configuration file describes the state a system should be in • Descriptive, not procedural; does not describe explicitly how to achieve that state • A single cfengine run may result in multiple passes (“convergence”) • Single host setup only requires the cfagent program and a cfagent.conf file that describes the desired configuration

13. The Configuration File • A configuration file consists of actions and classes (also called groups) • Actions either tell the program how to behave or what to do. • Actions are often followed by statements in this form: name = ( list ) • Classes may be used to restrict a particular action to a host that is only a member of that class (group) • May have variables: these may be special internal variables, user-defined strings, or shell environment variables

14. Configuration File Structure • File consists of action sections, which are reserved words followed by a colon • Some sections are for initial settings and definitions: acl, alerts, binservers, broadcast, control, defaultroute, filters, groups, homeservers, ignore, import, strategies, etc. • Other sections perform specific actions: alerts, copy, disks, disable, editfiles, files, links, netconfig, resolve, packages, processes, shellcommands, and tidy • It is not necessary to have or use all sections

15. A cfagent.conf Section links:easyspooler_fix:: /usr/bin/lp -> /usr/bin/llp syslog=true inform=true Actions end with a colon and start a section Classes within an action end with a double-colon

16. A Very Simple Configuration File # cfagent.hello control: actionsequence = ( shellcommands ) shellcommands: “/bin/echo Hello world!” useshell=false To execute: # /var/cfengine/bin/cfagent –f cfagent.hello cfengine:cis:/bin/echo Hello: Hello world!

17. Action Sequence Types 1

18. Action Sequence Types 2

19. Action Sequence Types 3

20. Classes (Groups) • Classes may be predefined (also referred to as “fixed” or “hard” classes) or defined in the configuration file • Custom classes are usually defined in the groups section • “Feedback classes:” a class may also be defined using the define statement when actions are performed in other sections (for example, when disable actions are performed):define=boot_server_disabled

21. Predefined Classes • Operating systems: sunos_5_8, sunos_5_9 • Architecture or hardware:sparc, SUNW_Sun_Fire_480R • Host name or IP address: cis, 10_1_12_23 • Date and time stuff: Yr2007, March, Day12, Monday, Hr00, Min45 • Time intervals in minutes or quarter hours: Min00-05, Min05-10, Q1, Q3, HR00_Q1

22. Custom Classes • Can use explicit host name:no_samba = ( cis entityclient ) • Use command that returns true/false:easyspooler_fix =Ä( `/usr/bin/test –x /usr/bin/llpÄ-a ! –L /usr/bin/lp` ) • Use built-in functions:easyspooler =Ä( FileExists(/usr/bin/llp) )

23. Built-in Functions for Classes

24. Using Compound Classes • Dot (.) is a logical AND: nfs.sunos_5_8:: • Later cfengine versions also support ‘&’ for logical AND • Vertical bar (|) is a logical Or: Hr00|Hr12:: • Exclamation point (!) is logical NOT: !Hr00:: • Parentheses override order: dbservers.(sunos_5_8|sunos_5_9):: • Precedence is () – NOT – AND – OR

25. Additional Class Info • The any class is a generic all-inclusive group (same as not specifying a class) • To find all defined classes using the default configuration file: /var/cfengine/bin/cfagent –p –v • To find all defined classes using a configuration file other than cfagent.conf:/var/cfengine/bin/cfagentÄ–p –v –f cfagent.test

26. Sample groups Section groups: datatel = ( IsDir(/datatel) ) # Perform MD5 checksumming on these systems do_checksum = ( cis ) # Defines an EasySpooler system that needs # to have the EasySpooler llp binary used # instead of the default lp command. easyspooler_fix = ( `/usr/bin/testÄ-x /usr/bin/llp -a ! -L /usr/bin/lp` )

27. Sample groups Section continued # Place machines in edit_password_defaults # to edit /etc/default/passwd file edit_password_defaults = ( cis entityclient ) # If at.allow or cron.allow exist, don't need # the .deny files no_atdeny =Ä( IsFile(/etc/cron.d/at.allow) ) no_crondeny =Ä( IsFile(/etc/cron.d/cron.allow) )

28. Control Section • A configuration file must have a control section, otherwise nothing will be done • Sets default variables • Can also be used to define new variables • Defines which actions are carried out and in what order

29. Cfengine Variables • Used for string substitution, similar to a macro processor • Can be defined in the control section for use in other sections:datatel_age_hold = ( 30 ) • May be defined within a specific group, but this must be used carefully – some must be defined globally to avoid runtime errors in the tidy section.

30. Using Variables • Variables are dereferenced either using curly braces or parentheses preceded by a dollar sign:exclude=${unidata_log_files} $(unidata_mnt)/bin • Using undefined variables causes syntax errors.

31. Control: Default Variables • The control section can be used to set numerous variables that control execution • Use access to list who can run cfengine:access = ( root ) • Syslog activates syslog logging when an inform statement is encountered:syslog = ( on )

32. Defining Variables control: cfengine_note =Ä( "# Note: this file managed under cfengine" ) datatel:: unidata_mnt = ( /usr/ud71 ) datatel_owner = ( datatel ) # Database locations datatel_production = Ä( /datatel/coll18/production )

33. List Variables Variables may consist of multiple items separated by a colon: datatel_hold_dirs =Ä( ${datatel_production}/apphome/_HOLD_:Ä${datatel_development}/apphome/_HOLD_:Ä${datatel_test}/apphome/_HOLD_ ) unidata_log_files =Ä( ${unidata_mnt}/bin/udt.errlog:Ä${unidata_mnt}/bin/udtlatch.log:Ä${unidata_mnt}Ä/bin/saved_logs/udtlatch.log )

34. Control Section: actionsequence • The actionsequence variable specifies which actions are carried out and in what order:actionsequence = ( disable links ) • Action sections in the configuration file that are not included in the actionsequence list are not performed

35. actionsequence continued Classes may be used for control in the actionsequence statement:actionsequence = ( tidy.Hr03 disable links.ThisClass editfiles links.ThatClass )

36. The import Section • The import section is used for reading additional configuration files:import: piopen:: cf.app_piopen • For breaking large configuration files into smaller files or for using separate files for special processing

37. Inheritance and import Files • The main (or parent) file is completely parsed before the import file is read • Variables and groups in the parent file are inherited in the imported file, but variables and groups in the imported file are not visible in the parent file

38. The disable Section • Cfengine will disable files (and directories) by renaming them instead of deleting them (as opposed to the tidy action). • If no destination name is specified, the file will be renamed by appending the suffix .cfdisabled to the file name. • disable can also be used to rotate files such as logs.

39. disable syntax disable: class:: /filename dest=filename define=classlist syslog=true/on/false/off inform=true/on/false/off action=disable/warn …

40. A disable Example disable: easyspooler_fix:: /usr/bin/lp syslog=true inform=true no_boot_server.(sunos_5_8|sunos_5_9):: # Don't run boot services /etc/rc3.d/S16boot.server dest=cfdisabled.S16boot.server define=boot_server_disabled syslog=true Feedback class

41. The editfiles Section • Performs line-based editing on text files (or limited binary editing) after making a backup of the file to be edited • Supports simple regular-expressions • Syntax different from other actions:editfiles: class:: { file-to-be-edited action “quoted-string…” }

42. Sample editfiles Section editfiles: sunos_5_8|sunos_5_9:: # IIPS Baseline 4.5 # Set TCP initial sequence number # generation to RFC 1948 # unique-per-connection-ID { /etc/default/inetinit ReplaceAll "TCP_STRONG_ISS=[01]“ÄWith "TCP_STRONG_ISS=2" }

43. Sample editfiles Section continued # IIPS Baseline 5.1 # Enable TCP connection tracing by inetd # (this is independent of any TCP Wrappers # logging). { /etc/default/inetd PrependIfNoSuchLine "$(cfengine_note)" UnCommentLinesContaining "LOGGING=" ReplaceAll "LOGGING=NO“ÄWith "LOGGING=YES" DefineClasses "modified_inetd_conf" }

44. The filters Section The filters section does not perform actions, instead it is used for defining selection criteria that may be used in the files or processes sections. filters: { root_owned_files Owner: "root" Result: "Owner" }

45. The files section The files section can be used for • File creation • Checking the existence, ownership, and permssions of files • Changing the ownership and permissions of files • Testing for setuid root programs

46. Syntax for files files: classes:: /file-object mode=mode owner=uid-list group=gid-list action=fixall/other-options/warnall links=false/stop/traverse/follow/tidy ignore=pattern include=pattern exclude=pattern …

47. Correcting File Permissions files: datatel:: ${datatel_production}/apphome mode=o+rw,g+rw,o-rwx owner=datatel group=users action=fixall ignore=_HOLD_ ignore=_PH_ ignore=BP recurse=inf

48. Sample report of correcting file permissions Checking file(s) in Ä/datatel/coll18/production/apphome cfengine:cis: Owner of Ä/datatel/coll18/production/apphome/DATA/DATA_P/ÄPAYROLL.EXPORTS/200710MO was 1010, setting to 100 cfengine:cis: Owner of Ä/datatel/coll18/production/apphome/DATA/DATA_P/ÄPAYROLL.EXPORTS/200710PT was 1010, setting to 100 cfengine:cis: Owner of Ä/datatel/coll18/production/apphome/DATA/DATA_X/ÄXCSD.DIRECTORY/DCA*804*071*14536.SEQ was 1006, Äsetting to 100

49. Creating Files # IIPS Baseline 6.5# Make sure the machine tracks# failed login attempts /var/adm/loginlog owner=root group=sys mode=600 action=create

50. File Monitoring • Cfengine provides a file monitoring facility similar to the Tripwire program. • Any file flagged for file monitoring in the files section will have its md5 checksum registered in a checksums database. • On subsequent cfengine passes the file will have its md5 checksum computed and compared with the previously stored value; a warning will be issued if the values do not match.