8.9. Other Configurations: Time Synchronization, Logs, Sharing Access…
The many elements listed in this section are good to know for anyone who wants to master all aspects of configuration of the GNU/Linux system. They are, however, treated briefly and frequently refer to the documentation.
The timezone, configured during initial installation, is a configuration item for the tzdata package. To modify it, use the dpkg-reconfigure tzdata
command, which allows you to choose the timezone to be used in an interactive manner. Its configuration is stored in the /etc/timezone
file. Additionally, the corresponding file in the /usr/share/zoneinfo
directory is copied in /etc/localtime
; this file contains the rules governing the dates where daylight saving time is active, for countries that use it.
When you need to temporarily change the timezone, use the TZ
environment variable, which takes priority over the configured system default:
$
date
Wed Mar 28 15:51:19 CEST 2012
$
TZ="Pacific/Honolulu" date
Wed Mar 28 03:51:21 HST 2012
8.9.2. Time Synchronization
Time synchronization, which may seem superfluous on a computer, is very important on a network. Since users do not have permissions allowing them to modify the date and time, it is important for this information to be precise to prevent confusion. Furthermore, having all of the computers on a network synchronized allows better cross-referencing of information from logs on different machines. Thus, in the event of an attack, it is easier to reconstruct the chronological sequence of actions on the various machines involved in the compromise. Data collected on several machines for statistical purposes won't make a great deal of sense if they are not synchronized.
8.9.2.1. For Workstations
Since work stations are regularly rebooted (even if only to save energy), synchronizing them by NTP at boot is enough. To do so, simply install the ntpdate package. You can change the NTP server used if needed by modifying the /etc/default/ntpdate
file.
Servers are only rarely rebooted, and it is very important for their system time to be correct. To permanently maintain correct time, you would install a local NTP server, a service offered in the ntp package. In its default configuration, the server will synchronize with pool.ntp.org and provide time in response to requests coming from the local network. You can configure it by editing the /etc/ntp.conf
file, the most significant alteration being the NTP server to which it refers. If the network has a lot of servers, it may be interesting to have one local time server which synchronizes with the public servers and is used as a time source by the other servers of the network.
8.9.3. Rotating Log Files
Log files can grow, fast, and it is necessary to archive them. The most common scheme is a rotating archive: the log file is regularly archived, and only the latest X
archives are retained. logrotate
, the program responsible for these rotations, follows directives given in the /etc/logrotate.conf
file and all of the files in the /etc/logrotate.d/
directory. The administrator may modify these files, if they wish to adapt the log rotation policy defined by Debian. The logrotate(1) man page describes all of the options available in these configuration files. You may want to increase the number of files retained in log rotation, or move the log files to a specific directory dedicated to archiving them rather than delete them. You could also send them by e-mail to archive them elsewhere.
8.9.4. Sharing Administrator Rights
Frequently, several administrators work on the same network. Sharing the root passwords is not very elegant, and opens the door for abuse due to the anonymity such sharing creates. The solution to this problem is the sudo
program, which allows certain users to execute certain commands with special rights. In the most common use case, sudo
allows a trusted user to execute any command as root. To do so, the user simply executes sudo command
and authenticates using their personal password.
When installed, the sudo package gives full root rights to members of the sudo
Unix group. To delegate other rights, the administrator must use the visudo
command, which allows them to modify the /etc/sudoers
configuration file (here again, this will invoke the vi
editor, or any other editor indicated in the EDITOR
environment variable). Adding a line with username
ALL=(ALL) ALL
allows the user in question to execute any command as root.
More sophisticated configurations allow authorization of only specific commands to specific users. All the details of the various possibilities are given in the sudoers(5) man page.
8.9.5. List of Mount Points
The
/etc/fstab
file gives a list of all possible mounts that happen either automatically on boot or manually for removable storage devices. Each mount point is described by a line with several space-separated fields:
device to mount: this can be a local partition (hard drive, CD-ROM) or a remote filesystem (such as NFS).
This field is frequently replaced with the unique ID of the filesystem (which you can determine with blkid device
) prefixed with UUID=
. This guards against a change in the name of the device in the event of addition or removal of disks, or if disks are detected in a different order.
mount point: this is the location on the local filesystem where the device, remote system, or partition will be mounted.
type: this field defines the filesystem used on the mounted device. ext4
, ext3
, vfat
, ntfs
, btrfs
, xfs
are a few examples.
A complete list of known filesystems is available in the mount(8) man page. The swap
special value is for swap partitions; the auto
special value tells the mount
program to automatically detect the filesystem (which is especially useful for disk readers and USB keys, since each one might have a different filesystem);
options: there are many of them, depending on the filesystem, and they are documented in the mount
man page. The most common are
rw
or ro
, meaning, respectively, that the device will be mounted with read/write or read-only permissions.
noauto
deactivates automatic mounting on boot.
user
authorizes all users to mount this filesystem (an operation which would otherwise be restricted to the root user).
defaults
means the group of default options: rw
, suid
, dev
, exec
, auto
, nouser
and async
, each of which can be individually disabled after defaults
by adding nosuid
, nodev
and so on to block suid
, dev
and so on. Adding the user
option reactivates it, since defaults
includes nouser
.
backup: this field is almost always set to 0
. When it is 1
, it tells the dump
tool that the partition contains data that is to be backed up.
check order: this last field indicates whether the integrity of the filesystem should be checked on boot, and in which order this check should be executed. If it is 0
, no check is conducted. The root filesystem should have the value 1
, while other permanent filesystems get the value 2
.
Example 8.5. Example /etc/fstab
file:
# /etc/fstab: static file system information.
#
# <file system> <mount point> <type> <options> <dump> <pass>
proc /proc proc defaults 0 0
# / was on /dev/sda1 during installation
UUID=c964222e-6af1-4985-be04-19d7c764d0a7 / ext3 errors=remount-ro 0 1
# swap was on /dev/sda5 during installation
UUID=ee880013-0f63-4251-b5c6-b771f53bd90e none swap sw 0 0
/dev/scd0 /media/cdrom0 udf,iso9660 user,noauto 0 0
/dev/fd0 /media/floppy auto rw,user,noauto 0 0
arrakis:/shared /shared nfs defaults 0 0
The last entry in this example corresponds to a network filesystem (NFS): the /shared/
directory on the arrakis server is mounted at /shared/
on the local machine. The format of the /etc/fstab
file is documented on the fstab(5) man page.
8.9.6. locate
and updatedb
The locate
command can find the location of a file when you only know part of the name. It sends a result almost instantaneously, since it consults a database that stores the location of all the files on the system; this database is updated daily by the updatedb
command. There are multiple implementations of the locate
command and Debian picked mlocate for its standard system.
mlocate
is smart enough to only return files which are accessible to the user running the command even though it uses a database that knows about all files on the system (since its updatedb
implementation runs with root rights). For extra safety, the administrator can use PRUNEDPATHS
in /etc/updatedb.conf
to exclude some directories from being indexed.