Many of the designations used by manufacturers and sellers to distinguish their products are claimed as trademarks. Where those designations appear in this book, and the publisher was aware of a trademark claim, the designations have been printed with initial capital letters or in all capitals. Ubuntu is a registered trademark of Canonical Limited, and is used with permission. Debian is a registered trademark of Software in the Public Interest Incorporated. CentOS is a registered trademark of Red Hat Inc., and is used with permission. FreeBSD is a registered trademark of The FreeBSD Foundation, and is used with permission. The Linux Tux logo was created by Larry Ewing, [email protected]. The authors and publisher have taken care in the preparation of this book, but make no expressed or implied warranty of any kind and assume no responsibility for errors or omissions. No liability is assumed for incidental or consequential damages in connection with or arising out of the use of the information or programs contained herein. For information about buying this title in bulk quantities, or for special sales opportunities (which may include electronic versions; custom cover designs; and content particular to your business, training goals, marketing focus, or branding interests), please contact our corporate sales department at [email protected] or (800) 382-3419. For government sales inquiries, please contact [email protected]. For questions about sales outside the U.S., please contact [email protected]. Visit us on the web: informit.com Library of Congress Control Number: 2017945559 Copyright © 2018 Pearson Education, Inc. All rights reserved. Printed in the United States of America. This publication is protected by copyright, and permission must be obtained from the publisher prior to any prohibited reproduction, storage in a retrieval system, or transmission in any form or by any means, electronic, mechanical, photocopying, recording, or likewise. For information regarding permissions, request forms and the appropriate contacts within the Pearson Education Global Rights & Permissions Department, please visit www.pearsoned.com/permissions/. ISBN-13: 978-0-13-427755-4 ISBN-10: 0-13-427755-4 1 17 Table of Contents T E RIBUTE TO VI P REFACE F OREWORD A CKNOWLEDGMENTS SECTION ONE: BASIC ADMINISTRATION C 1: W S HAPTER HERE TO TART Essential duties of a system administrator Controlling access Adding hardware Automating tasks Overseeing backups Installing and upgrading software Monitoring Troubleshooting Maintaining local documentation Vigilantly monitoring security Tuning performance Developing site policies Working with vendors Fire fighting Suggested background Linux distributions Example systems used in this book Example Linux distributions Example UNIX distribution Notation and typographical conventions Units Man pages and other on-line documentation Organization of the man pages man: read man pages Storage of man pages Other authoritative documentation System-specific guides Package-specific documentation Books RFC publications Other sources of information Keeping current HowTos and reference sites Conferences Ways to find and install software Determining if software is already installed Adding new software Building software from source code Installing from a web script Where to host Specialization and adjacent disciplines DevOps Site reliability engineers Security operations engineers Network administrators Database administrators Network operations center (NOC) engineers Data center technicians Architects Recommended reading System administration and DevOps Essential tools C 2: B S M D HAPTER OOTING AND YSTEM ANAGEMENT AEMONS Boot process overview System firmware BIOS vs. UEFI Legacy BIOS UEFI Boot loaders GRUB: the GRand Unified Boot loader GRUB configuration The GRUB command line Linux kernel options The FreeBSD boot process The BIOS path: boot0 The UEFI path loader configuration loader commands System management daemons Responsibilities of init Implementations of init Traditional init systemd vs. the world inits judged and assigned their proper punishments systemd in detail Units and unit files systemctl: manage systemd Unit statuses Targets Dependencies among units Execution order A more complex unit file example Local services and customizations Service and startup control caveats systemd logging FreeBSD init and startup scripts Reboot and shutdown procedures Shutting down physical systems Shutting down cloud systems Stratagems for a nonbooting system Single-user mode Single-user mode on FreeBSD Single-user mode with GRUB Recovery of cloud systems C 3: A C R P HAPTER CCESS ONTROL AND OOTLY OWERS Standard UNIX access control Filesystem access control Process ownership The root account Setuid and setgid execution Management of the root account Root account login su: substitute user identity sudo: limited su Disabling the root account System accounts other than root Extensions to the standard access control model Drawbacks of the standard model PAM: Pluggable Authentication Modules Kerberos: network cryptographic authentication Filesystem access control lists Linux capabilities Linux namespaces Modern access control Separate ecosystems Mandatory access control Role-based access control SELinux: Security-Enhanced Linux AppArmor Recommended reading C 4: P C HAPTER ROCESS ONTROL Components of a process PID: process ID number PPID: parent PID UID and EUID: real and effective user ID GID and EGID: real and effective group ID Niceness Control terminal The life cycle of a process Signals kill: send signals Process and thread states ps: monitor processes Interactive monitoring with top nice and renice: influence scheduling priority The /proc filesystem strace and truss: trace signals and system calls Runaway processes Periodic processes cron: schedule commands systemd timers Common uses for scheduled tasks C 5: T F HAPTER HE ILESYSTEM Pathnames Filesystem mounting and unmounting Organization of the file tree File types Regular files Directories Hard links Character and block device files Local domain sockets Named pipes Symbolic links File attributes The permission bits The setuid and setgid bits The sticky bit ls: list and inspect files chmod: change permissions chown and chgrp: change ownership and group umask: assign default permissions Linux bonus flags Access control lists A cautionary note ACL types Implementation of ACLs Linux ACL support FreeBSD ACL support POSIX ACLs NFSv4 ACLs C 6: S I M HAPTER OFTWARE NSTALLATION AND ANAGEMENT Operating system installation Installing from the network Setting up PXE Using kickstart, the automated installer for Red Hat and CentOS Automating installation for Debian and Ubuntu Netbooting with Cobbler, the open source Linux provisioning server Automating FreeBSD installation Managing packages Linux package management systems rpm: manage RPM packages dpkg: manage .deb packages High-level Linux package management systems Package repositories RHN: the Red Hat Network APT: the Advanced Package Tool Repository configuration An example etcapt/sources.list file Creation of a local repository mirror APT automation yum: release management for RPM FreeBSD software management The base system pkg: the FreeBSD package manager The ports collection Software localization and configuration Organizing your localization Structuring updates Limiting the field of play Testing Recommended reading C 7: S S HAPTER CRIPTING AND THE HELL Scripting philosophy Write microscripts Learn a few tools well Automate all the things Don’t optimize prematurely Pick the right scripting language Follow best practices Shell basics Command editing Pipes and redirection Variables and quoting Environment variables