What i learnt from my evaluators
Remember that the disk space we have in our 42 sessions is limited to 5 GB. It is enough for the mandatory part of this project. You can stop here and do nothing about it or, in case you plan to do the bonus part, you can use a permanent 30 GB disk quota you are entitled to in /sgoinfre/Perso. (see below conditions to use it without sad surprises)
It is permanent while you are using it. In case you don't use it within 60 days, your Personal disk quota will be removed. do not forget to chmod -R 700 to your personal folder. Keep contest belon 30 GB
mkdir /sgoinfre/Perso/yourusernameThen use this path to save the image of your virtual machine (VM).
Please consider that with 5 GB it is enough for this project including bonus. In my case 3.3GB was enough.
An important decision for this project is about virtual machine connectivity. Virtualbox offers several options. I selected Bridget cause I want to access Born2beRoot from other computers in my network [In this instructions] (https://www.virtualbox.org/manual/ch06.html) you find a summary table with in/out connectivity possibilities offered by each option
| Mode | VM-->Host | VM<--Host | VM1<-->VM2 | VM-->Net/LAN | VM<--Net/LAN |
|---|---|---|---|---|---|
| Host-only | + | + | + | – | – |
| Internal | – | – | + | – | – |
| Bridged | + | + | + | + | + |
| NAT | + | Port forward | – | + | Port forward |
| NATservice | + | Port forward | + | + | Port forward |
Bridge connection
In the middle of this project we got a message from our staff informing about VirtualBox general removal in our campus dueto technical problems. I tried to configure a UEFI machine but i desisted. i got problems installing grub loader when encrypted de logical volumen. I changed my mind in order to be ready for my deadline.
WAIT!!!! Mandatory or bonus??? watch the subject to see the partition scheme. Worth parting VM's hard disk as the bonus request to avoid configuring a new machine for the bonus later.
During the partition, if manual .... first create 3 primary partitions, then encrypt one (it will take time to overwrite it with random data, later use LVM.
debian-12.2.0-amd64-netinst.iso of size 658 MB was my election. One time-consuming task in this project is the VM setup. The bigger the iso image, the longer to set up. It is true that I got an almost bare metal that forced me to install the required packages for this project individually one by one. 25 seconds to download 628 MB. I moved the image to my /sgoinfre/Perso/ directory
At installation time I opted to install nothing
apt install sudoapt install openssh-serverapt install ufwapt install libpam-pwqualityapt install bcInside my script instal.sh there are all commands to install bonus required packages.
1.- a webserver lighttpd.
2.- a data base mariadb.
3.- a FRONT-END scripting languaje php with a bunch of modules.
4.- a content management environment wordpress.
5.- a ftp server vsftpd.
apt install -y wget
apt install -y unzip
apt install -y lighttpd
apt install -y php
apt install -y php-curl
apt install -y php-fpm
apt install -y php-bcmath
apt install -y php-gd
apt install -y php-soap
apt install -y php-zip
apt install -y php-mbstring
apt install -y php-mysqlnd
apt install -y php-cgi
apt install -y php-mysql
apt install -y php-xml
apt install -y php-intl
apt install -y mariadb-server
apt install -y mariadb-client
wget https://wordpress.org/latest.zip
apt install -y vsftpd
I decided to keep the script to configure the server as requested in de project in a git repository.
apt-get install gitYou have to configure your operating system with the UFW (or Firewalla for Rocky) firewall and thus leave only port 4242 open. I also set up a restriction to avoid connections on port 22. thinking about bonus part i also alloe 80 for the web server and 20 and 21 fotr ftp server
ufw deny 22
ufw allow 4242
ufw allow 80
ifw allow ftp
ufw allow ftp-dataI only have to change some lines in /etc/ssh/sshd_config file. This file configures the server that answers incoming ssh connections to my virtual machine.
There is an additional /etc/ssh/ssh_config file that relates to outgoing connections from my virtual machine to another server. I do not touch this client side of the OpenSSH package.
An SSH service will be running on port 4242 only.
sed -i -e '/#Port 22/ s/#Port 22/Port 4242/' /etc/ssh/sshd_configFor security reasons, it must not be possible to connect using SSH as root.
sed -i -e '/#PermitRootLogin/ s/#PermitRootLogin prohibit-password/PermitRootLogin no/' /etc/ssh/sshd_configEither it is not required by the subject i added this restriction to allow only one user to connect through SSH. That is a challenge at evaluation time when new created user has to log in. Manually you will have to change AllowUsers luicasad by AllowUsers luicasad thenewuserlogin . DO NOT SEPARATE LOGINS WITH COMMAS BUT WHITESPACES.
sed -i -e '/^PermitRootLogin no/a AllowUsers luicasad' /etc/ssh/sshd_configI set a banner to welcome an ssh connection
sed -i -e '/#Banner none/ s/#Banner none/Banner \/etc\/ssh\/global_banner.txt' /etc/ssh/sshd_configGathering all ssh settings results this:
sed -i -e '/#Port 22/ s/#Port 22/Port 4242/' /etc/ssh/sshd_config
sed -i -e '/#PermitRootLogin/ s/#PermitRootLogin prohibit-password/PermitRootLogin no/' /etc/ssh/sshd_config
sed -i -e '/^PermitRootLogin no/a AllowUsers luicasad' /etc/ssh/sshd_config
sed -i -e '/#Banner none/ s/#Banner none/Banner \/etc\/ssh\/global_banner.txt/' /etc/ssh/sshd_config
cp /root/Born2beRoot/global_banner.txt /etc/sshAnother improvement I wanted to try was to implement a 2FA.
I installed a Google authenticator library.
apt install -y libpam-google-authenticatorLocally it will generate a time-based token. The token is generated using a local key for the local user plus a UTC timestamp.
I have to pass the local key to my smartphone Google Authenticator app. I do that with an SSH connection from my host machine to the virtual machine. I do that cause the screen of the virtual machine running in Virtualbox does not draw a readable QR for my smartphone. I did not manage to do it, so I logged through SSH for configuration purposes. The command to generate QR for the local key to transfer to your smartphone is:
google-authenticatorOnce the Google Authenticator app in my Smartphone reads my local key QR, starts to generate time-based tokens.
Add these lines to \etc\ssh\sshd_config and ssh will ask for tokens after a correct password.
sed -i -e '/^#PasswordAuthentication/ a ChallengeResponseAuthentication yes' /etc/ssh/sshd_configsed -i -e '/#UsePAM/ s/#UsePAM yes/UsePAM yes/' /etc/ssh/sshd_config is requested in case that openssh-server default configuration did not use PAM as authentication method.
Add this line to /etc/pam.d/sshd
During projec evaluation, you need to create a newuser. Manually add nullok after pam_google_authenticator.so to allow the new user connect via ssh without a 2fa.
sed -i -e '/common-auth/a auth required pam_google_authenticator.so' /etc/pam.d/sshdYour password has to expire every 30 days. We change PASS_MAX_DAYS form 99999 to 30.
sed -i -e '/PASS_MAX_DAYS/ s/99999/30/' /etc/login.defsThe minimum number of days allowed before the modification of a password will be set to 2. We change PASS_MIN_DAYS form 0 to 2.
sed -i -e '/PASS_MIN_DAYS/ s/0/2/' /etc/login.defsThe user has to receive a warning message 7 days before their password expires. This is the default value defined by PASS_WARN_AGE
In former days, inside /etc/login.def password length's settings min and max were configurable. When pluggable authentication modules (PAM) started to be used in the late 1990s those parameters became obsolete. So it is inside etc/pam.d/common-password
Your password must be at least 10 characters long.
sed -i -e '/pam_pwquality.so/ s/retry=3/retry=3 minlen=10/' /etc/pam.d/common-passwordIt must contain an uppercase letter.
sed -i -e '/pam_pwquality.so/ s/retry=3/retry=3 ucredit=-1 /' /etc/pam.d/common-passwordIt must contain a lowercase letter.
sed -i -e '/pam_pwquality.so/ s/retry=3/retry=3 lcredit=-1 /' /etc/pam.d/common-passwordIt must contain a number.
sed -i -e '/pam_pwquality.so/ s/retry=3/retry=3 dcredit=-1 /' /etc/pam.d/common-passwordIt must not contain more than 3 consecutive identical characters.
sed -i -e '/pam_pwquality.so/ s/retry=3/retry=3 maxrepeat=3 /' /etc/pam.d/common-passwordThe password must not include the name of the user.
sed -i -e '/pam_pwquality.so/ s/retry=3/retry=3 reject_username /' /etc/pam.d/common-passwordThe password must have at least 7 characters that are not part of the former password.
sed -i -e '/pam_pwquality.so/ s/retry=3/retry=3 difok=7 /' /etc/pam.d/common-passwordThe root password has to comply with this policy.
sed -i -e '/pam_pwquality.so/ s/retry=3/retry=3 enforce_for_rootedr /' /etc/pam.d/common-passwordGathering all password restrictions settings results in this:
sed -i -e '/PASS_MAX_DAYS/ s/99999/30/' /etc/login.defs
sed -i -e '/PASS_MIN_DAYS/ s/0/2/' /etc/login.defs
sed -i -e '/PASS_WARN_AGE/ s/7/7/' /etc/login.defs
sed -i -e '/pam_pwquality.so/ s/retry=3/retry=3 enforce_for_root/' /etc/pam.d/common-password
sed -i -e '/pam_pwquality.so/ s/retry=3/retry=3 difok=7 /' /etc/pam.d/common-password
sed -i -e '/pam_pwquality.so/ s/retry=3/retry=3 reject_username /' /etc/pam.d/common-password
sed -i -e '/pam_pwquality.so/ s/retry=3/retry=3 maxrepeat=3 /' /etc/pam.d/common-password
sed -i -e '/pam_pwquality.so/ s/retry=3/retry=3 dcredit=-1 /' /etc/pam.d/common-password
sed -i -e '/pam_pwquality.so/ s/retry=3/retry=3 lcredit=-1 /' /etc/pam.d/common-password
sed -i -e '/pam_pwquality.so/ s/retry=3/retry=3 ucredit=-1 /' /etc/pam.d/common-password
sed -i -e '/pam_pwquality.so/ s/retry=3/retry=3 minlen=10/' /etc/pam.d/common-passwordAccording to what we read when we execute visudo command, we have to create a configuration file, inside /etc/sudoers.d folder, where we will insert a set of directives.
To know which editor is configured as visudo you can execute
sudo update-alternatives --config editorAuthentication using sudo has to be limited to 3 attempts in the event of an incorrect password.
echo "Defaults passwd_tries=3" > /etc/sudoers.d/configurationA custom message of your choice has to be displayed if an error due to a wrong password occurs when using sudo. Be aware of the inverte usage of ' and " in this command. This is due to the fact of sudo requires the error message to be between quotes.
echo 'Defaults badpass_message="Password for luicasad42 virtual machine sudo mode INCORRECT"' >> /etc/sudoers.d/configurationEach action using sudo has to be archived, both inputs and outputs. By default, all sudo incidents will be logged in /var/log/auth.log. However, it is not dedicated to sudo logs.
I create a logfile for logging either input and output messages to/from sudo. I create the file in folder /var/log/sudo.
mkdir /var/log/sudo
touch /var/log/sudo/logfile
echo "Defaults iolog_dir=/var/log/sudo" >> /etc/sudoers.d/configuration
echo "Defaults logfile=/var/log/sudo/logfile" >> /etc/sudoers.d/configuration
echo "Defaults log_input, log_output" >> /etc/sudoers.d/configurationA security setting is to force to have a tty connection to the machine to be entitled to use sudo command. This will avoid that a simple cron script upscales privileges.
echo "Defaults requiretty" >> /etc/sudoers.d/configurationThe TTY mode has to be enabled for security reasons. With this only user logged in a terminal can use sudo privileges. A cron job would not be entitled to gain privileges when requiretty is present.
echo "Defaults requiretty" >> /etc/sudoers.d/configurationAnother security setting is to restrict the path to commands that a sudoer can use.
echo "Defaults secure_path='/usr/sbin:/usr/bin:/sbin:/bin'" >> /etc/sudoers.d/configurationGathering all sudo configuration instruction results in this:
mkdir /var/log/sudo
touch /var/log/sudo/logfile
echo "Defaults passwd_tries=3" > /etc/sudoers.d/configuration
echo "Defaults badpass_message='INCORRECT Password for sudo mode'" >> /etc/sudoers.d/configuration
echo "Defaults iolog_dir=/var/log/sudo" >> /etc/sudoers.d/configuration
echo "Defaults logfile=/var/log/sudo/logfile" >> /etc/sudoers.d/configuration
echo "Defaults log_input, log_output" >> /etc/sudoers.d/configuration
echo "Defaults requiretty" >> /etc/sudoers.d/configuration
echo "Defaults secure_path='/usr/sbin:/usr/bin:/sbin:/bin'" >> /etc/sudoers.d/configurationThe crontab files edited with crontab -u <user> -e are located inside /var/spool/cron/crontabs folder.
A regular-user does not require sudo privileges for scheduling a task.
A regular user does not require to be logged for the task be executed on a regular basis.
sudo systemctl status ssh
sudo systemctl start ssh
sudo systemctl enable sshsudo apt install ufw sudo ufw enable sudo ufw limit ssh
ip addr show
Your script must always be able to display the following information
• The architecture of your operating system and its kernel version.
KERNEL_RELEASE=`uname --kernel-release`
KERNEL_VERSION=`uname --kernel-version`
OPERATING_SYSTEM=`uname --operating-system`
MACHINE_ARCHITECTURE=`uname --machine`• The number of physical and virtual processors.
CPUS=`grep "physical id" /proc/cpuinfo |sort | uniq | wc -l `
PHYSICAL_CORES=`grep "cpu cores" /proc/cpuinfo | uniq | sed 's/cpu cores *\t: //'`
VIRTUAL_CORES=`grep "^processor" /proc/cpuinfo |sort | uniq | wc -l `• The current available RAM on your server and its utilization rate as a percentage.
TOTAL_RAM=`cat /proc/meminfo |grep MemTotal | sed 's/MemTotal://' | sed 's/ //g' | sed 's/kB//'`
AVAI_RAM=`cat /proc/meminfo |grep MemAvailable | sed 's/MemAvailable://' | sed 's/ //g' | sed 's/kB//'`
USED_RAM=`bc <<< "scale=2; (${TOTAL_RAM} - ${AVAI_RAM}) / 1024 / 1024"`
TOTAL_RAM=`bc <<< "scale=2; ${TOTAL_RAM} / 1024 / 1024"`
USED_RAM_PERC=`bc <<< "scale=2; (${USED_RAM} / ${TOTAL_RAM}) * 100"`• The current available memory on your server and its utilization rate as a percentage.
MEM_TOTAL= `cat /
• The current utilization rate of your processors as a percentage.
I used this [reference] (https://www.kernel.org/doc/Documentation/filesystems/proc.txt) to learn about. All of the numbers reported in this file are aggregates since the system first booted.
| Usr | nice | sys | idl | iow | irq | softirq | steal | guest | guest_nice | |
|---|---|---|---|---|---|---|---|---|---|---|
| cpu | 882 | 1 | 817 | 483007 | 3082 | 0 | 396 | 0 | 0 | 0 |
| cpu0 | 238 | 0 | 195 | 120874 | 754 | 0 | 60 | 0 | 0 | 0 |
| cpu1 | 206 | 1 | 130 | 120920 | 368 | 0 | 297 | 0 | 0 | 0 |
| cpu2 | 210 | 0 | 226 | 120325 | 1309 | 0 | 25 | 0 | 0 | 0 |
| cpu3 | 226 | 0 | 265 | 120887 | 650 | 0 | 13 | 0 | 0 | 0 |
The sum of all numerical values in a row gives total time since boot. Utilization rate is the complementary of twiddling thumbs rate.
CPU_USAGE_RATE=`cat /proc/stat | grep 'cpu ' | sed 's/cpu //g' | awk '{split($0,t," "); for(i=NF;i>0;i--) s = s + $i; print $i } END {print 1 - ($4/s) }'• The date and time of the last reboot.
-b option in who command show last boot timestamp.
LAST_BOOT=`who -b | sed 's/[a-z ]*//'`• Whether LVM is active or not.
Inside /etc/fstab the path of logic volumes managed by the device mapper start by /dev/mapper. I count the number of lines in fstab containing the word mapper`. If count is greater than zero then i set the flag to YES.
LVM_IN_USE="NO"
if [[ $(grep 'mapper' /etc/fstab | wc -l) -gt 0 ]];
then
LVM_IN_USE="YES"
fi• The number of active connections.
I use ss command. Socket statisitics command. Option H shows no header. Option t shows tcp sockets. Option a show all sockets , listening or no.
ACTIVE_CONNECTIONS=`ss -Hta | grep ESTAB | wc -l`• The number of users using the server.
who does not print headers.
LOGGED_USERS=`who | wc -l`• The IPv4 address of your server and its MAC (Media Access Control) address.
-I does not depend on name resolution. Display all network addresseses configures on all network interfaces.
IP_ADDRESS=`hostname -I`• The number of commands executed with the sudo program.
SUDO_COMMANDS=`sudo journalctl /usr/bin/sudo | grep COMMAND | wc -l`I already openned port 80 at firewall configuration
Unzip wordpress package in /var/www/. Rename html folder to html_old, rename wordpress folder as html and set recursively to html 755 permisions.
To show this functionality i will allow a guest connection to vsftpd server service.
1.- Create a directory for downloading files `mkdir -p /var/ftp/tothom` . The flag `-p` allows to create the path of intermediate directories if they do not exists.
2.- Assign `nobody:nogroup` permission to download directory `chown nobody:nogroup /var/ftp/tothom`.
These are special users and groups that are used to provide the most restrictive access permissions possible. The **nobody** user is a system account that does not have any shell access. It is typically used to run system services and daemons that do not require user interaction. The **nogroup** group is a group that does not have any members. It is typically used to group together system files and folders that should not be accessible to any users or groups.The reason for assigning the permissions "nobody:nogroup" to a folder is to make it as secure as possible. This is because the nobody user and the nogroup group have the least amount of privileges on the system. This means that only authorized users with special privileges will be able to access or modify the folder's contents.
3.- Copy some files to the download directory.
4.- Edit `/etc/vsftpd.config` and instruct the service to allow anonymous connection from guest users. Change `anonymous_enable=NO` by `anonymous_enable=YES. Avoid local users to connect to this service changing `local_enable=YES` by `local_enable=NO`. Inform the server about which is the download directory `anon_root=/var/ftp/tothom`.
####### Conexion with Safari
####### Login as guest/Anonymous
####### Finder visualization of tothom download directory
The -c flag in shasum command to check a signature file like this 362eeadd85368b4f4dcfd7480b574fa37a8b0650 luicasad42.vdi, when executed in the file's folder will show
either:
luicasad42.vdi: OK`or
luicasad42.vdi: FAILED
shasum: WARNING: 1 computed checksum did NOT matchWhy you get sda3 and the subject shows sda5?
In the subject, there is an extended partion.
The traditional DOS MBR partition table supports up to four primary partitions and an unlimited number of logical partitions within an extended partition. So sda1 .. sda4 are primary partitions. When you have a number higher than 4 you can infer any of the previous partitions was extended.
However, the GPT partition table, which is more modern, supports a larger number of partitions. In GPT, the theoretical maximum number of partitions is 128, of which up to 32 can be primary partitions, while the rest must be logical partitions within an extended partition.
lsblk output comments parittion table visualization
Let's create this scenario: Root is logged in the main console and one user has two ssh conections:
who output is
luicasad@luicasad42:~$ who -H
NOMBRE LÍNEA TIEMPO COMENTARIO
root tty1 2023-12-14 10:14
luicasad pts/0 2023-12-14 10:17 (192.168.0.99)
luicasad pts/1 2023-12-14 10:18 (192.168.0.99)
users output is:
luicasad@luicasad42:~$ users
luicasad luicasad rootImportant
The subjec request The number of users using the server
If you prefer users command, instead of users | wc -w is better users | awk '{for(i=NF;i >0;i--) print $i}' | uniq | wc -l .
if you prefer who commnad, instead of who | wc -l is better who | awk '{print $1}' | uniq | wc -l.
To replay sudo session logs.
The subject request us "Each action using sudo has to be archived, both inputs and outputs. The log file has to be saved in the /var/log/sudo/ folder."
Do you wonder what is this usefull for?
To check if a privileged user has goodwill we can use this command:
sudoreplay -d /var/log/sudo -l user luicasad
dic 14 12:24:56 2023 : luicasad : HOST=luicasad42 ; TTY=pts/0 ; CWD=/home/luicasad/Born2beRoot ; USER=root ; TSID=000004 ; COMMAND=/usr/bin/cat /var/spool/cron/crontabs/root
dic 14 12:37:17 2023 : luicasad : HOST=luicasad42 ; TTY=pts/1 ; CWD=/home/luicasad ; USER=root ; TSID=000005 ; COMMAND=/usr/bin/mkdir /root/pulling_leg
dic 14 12:37:58 2023 : luicasad : HOST=luicasad42 ; TTY=pts/1 ; CWD=/home/luicasad ; USER=root ; TSID=000006 ; COMMAND=/usr/bin/touch /root/pulling_leg/goodmornign.txt
dic 14 12:39:20 2023 : luicasad : HOST=luicasad42 ; TTY=pts/1 ; CWD=/home/luicasad ; USER=root ; TSID=000007 ; COMMAND=/usr/bin/cp Born2beRoot/install.sh /root/pulling_leg
dic 14 12:39:53 2023 : luicasad : HOST=luicasad42 ; TTY=pts/1 ; CWD=/home/luicasad ; USER=root ; TSID=000008 ; COMMAND=/usr/bin/cat /root/pulling_leg/install.sh
dic 14 13:03:43 2023 : luicasad : HOST=luicasad42 ; TTY=pts/1 ; CWD=/home/luicasad ; USER=root ; TSID=000009 ; COMMAND=/root/Born2beRoot/config.shTo replay command and see what the user saw, at the speed he saw it, we can use this command
root@luicasad42:~# sudoreplay -d /var/log/sudo 000009
Replaying sudo session: /root/Born2beRoot/config.sh
mkdir: no se puede crear el directorio «/var/log/sudo»: El fichero ya existe
Skipping adding existing rule
Skipping adding existing rule (v6)
Skipping adding existing rule
Skipping adding existing rule (v6)
addgroup: El grupo `user42' ya existe.
adduser: El usuario `luicasad' ya es un miembro de `user42'.
adduser: El usuario `luicasad' ya es un miembro de `sudo'.
sudo:x:27:luicasad
user42:x:1001:luicasad
Replay finished, press any key to restore the terminal.
root@luicasad42:~# My crontab line for executing monitoring script was:
*/10 * * * * sh /root/Born2beRoot/monitoring.sh >/dev/null 2>&1and at the same time monitoring.sh file had this shebang #!/usr/bin/bash
My intention was to use bash commands to monitor the system, but i was using shell to execute it.
Note
Let's look carefully at the details of these commands:
root@luicasad42:~# which bash
/usr/bin/bash
root@luicasad42:~# which sh
/usr/bin/sh
root@luicasad42:~# which dash
/usr/bin/dash
root@luicasad42:~# cd /usr/bin
root@luicasad42:/usr/bin# ls -hal bash
-rwxr-xr-x 1 root root 1,3M abr 23 2023 bash
root@luicasad42:/usr/bin# ls -hal sh
lrwxrwxrwx 1 root root 4 ene 5 2023 sh -> dash
root@luicasad42:/usr/bin# ls -hal dash
-rwxr-xr-x 1 root root 123K ene 5 2023 dash
root@luicasad42:/usr/bin# OMG!!! I was instructing cron to execute a script that uses bash commands with dash. I notice that bash is 10 times bigger than dash. Now I start to understand, perhaps, the reason why cron was not executing correctly and i spend 3 days changing my bash commands.
I gave execution permission to monitoring and changed crontab line to
*/10 * * * * /root/Born2beRoot/monitoring.sh >/dev/null 2>&1Inside /etc/ssh/sshd_config there is a directive AcceptEnv LANG LC_* allowing client's terminals to pass therir local environment variables to the server.
The iterm2 in my Mac had not locale configuration. the ssh server warned me about it.
During debian installation o created two users: root and luicasad.
After hardening password policy i changed both users passwords with passwordto fullfill new rules settled inside /etc/pam.d/common-password.
Then created a newuser with adduser. Checking it with chage, i got:
luicasad@luicasad42:~$ sudo chage -l newuser
Último cambio de contraseña :dic 14, 2023
La contraseña caduca : ene 13, 2024
Contraseña inactiva : nunca
La cuenta caduca : nunca
Número de días mínimo entre cambio de contraseña : 2
Número de días máximo entre cambio de contraseña : 30
Número de días de aviso antes de que caduque la contraseña : 7
luicasad@luicasad42:~$ I thought every thing was ok, but it was not. Again abluis-m openned my eyes.
I went to my evaluation with these conditions for users created at debian installation:
luicasad@luicasad42:~$ sudo chage -l luicasad
Último cambio de contraseña :nov 10, 2023
La contraseña caduca : nunca
Contraseña inactiva : nunca
La cuenta caduca : nunca
Número de días mínimo entre cambio de contraseña : 0
Número de días máximo entre cambio de contraseña : 99999
Número de días de aviso antes de que caduque la contraseña : 7
luicasad@luicasad42:~$ Facing incorreclty a subject that requested us
1.-Your password has to expire every 30 days.
2.-The minimum number of days allowed before the modification of a password will be set to 2.
3.-The user has to receive a warning message 7 days before their password expires.
Note
I learnt that : The password command do not takes information from /etc/login.defs as it does adduser
Important
The command chage -m 2 -M 30 luicasad solved my problem
luicasad@luicasad42:~$ sudo chage -l luicasad
Último cambio de contraseña :dic 14, 2023
La contraseña caduca : ene 13, 2024
Contraseña inactiva : nunca
La cuenta caduca : nunca
Número de días mínimo entre cambio de contraseña : 2
Número de días máximo entre cambio de contraseña : 30
Número de días de aviso antes de que caduque la contraseña : 7
luicasad@luicasad42:~$Copy pasted from our intranet
-
If you want to use sgoinfre, you must create a directory in
/sgoinfre/Perso/your42login.If the name of a folder is different from a login, it will be deleted. -
A quota of 30GB/dir. If more, it will be deleted.
-
You can give the rights you want to your dir, but we strongly recommend a chmod -R 700
-
This share is not intended to have a high level of availability, durability, or performance. It is there to help you out, and we recommend that you use another storage media for your important data.
-
The data on this share may be deleted without any notice.
Install a specific package i awk '{}'
apt install [package-name] Remove a specific package
apt remove [package-name] Remove all the data, application and configuration files,
apt remove --purge [package-name] Remove orphaned dependencies from system
apt autoremovedpkg -l list all installed packages and its status
| Syntax | Description | Example |
|---|---|---|
| dpkg -i {.deb package} | Install the package | dpkg -i zip_2.31-3_i386.deb |
| dpkg -i {.deb package} | Upgrade package if it is installed else install a fresh copy of package | dpkg -i zip_2.31-3_i386.deb |
| dpkg -R {Directory-name} | Install all packages recursively from directory | dpkg -R /tmp/downloads |
| dpkg -r {package} | Remove/Delete an installed package except configuration files | dpkg -r zip |
| dpkg -P {package} | Remove/Delete everything including configuration files | dpkg -P apache-perl |
| dpkg -l | List all installed packages, along with package version and short description | dpkg -l dokg -l|less dpkg -l 'apache' dpkg -l | grep -i 'sudo' |
| dpkg -l {package} | List individual installed packages, along with package version and short description | dpkg -l apache-perl |
| dpkg -L {package} | Find out files are provided by the installed package i.e. list where files were installed | dpkg -L apache-perl dpkg -L perl |
| dpkg -c {.Deb package} | List files provided (or owned) by the package i.e. List all files inside debian .deb package file, very useful to find where files would be installed | dpkg -c dc_1.06-19_i386.deb |
| dpkg -S {/path/to/file} | Find what package owns the file i.e. find out what package does file belong | dpkg -S /bin/netstat dpkg -S /sbin/ippool |
| dpkg -p {package} | Display details about package package group, version, maintainer, Architecture, display depends packages, description etc | dpkg -p lsof |
| dpkg -s {package}| grep Status | Find out if Debian package is installed or not (status) | dpkg -s lsof | grep Status |
Delete rule
ufw status numbered
ufw delete [number] Add negative rule
ufw deny 22Add positive rule
ufw allow 4242remove Create groups user42 adduser luicasad sudo //logout and login
https://www.linuxtuto.com/how-to-install-wordpress-on-debian-12/
