Securing your Linux lab with resettable user accounts

The Configuration File

Each machine requires a configuration file. On my systems, I named it /etc/reboot-restore.conf, a reasonable name and place to put the file. This file specifies the users with home directories that will be restored when the system reboots.

Each line of the file has the following settings (separated by semicolons): the user name, the encrypted password, and the path to the image file (Listing 1).

Listing 1

/etc/reboot-restore.conf
01 #
02 #       Configuration for users math and english
03 #       math's image is on each machine
04 #       english's image is on a server; you'd replace my.example.com
05 #       with the name of the server
06 math;qcnVJoZLZDRAE;/usr/local/reboot-restore/math_home.tgz
07 english;grrxaQN5BbNTM;http://my.example.com/images/english_home.tar.bz2

Part of restoring the user is restoring the password, which the user could change during a session. usermod, which changes the password, only accepts a password encrypted by the crypt function. Rather than placing the passwords in the configuration file in plain text and letting the restore script do the encryption, I decided to put encrypted passwords in the configuration file for a minimum level of security. To encrypt a password, use the Perl command:

perl -e 'print crypt("password", "salt"),"\n";'

The first argument to crypt is the plaintext password. The second argument is a "salt," which comprises characters used as random input for the encryption algorithm. Only the first two letters of the salt are used, and they will be the first two letters of the encrypted password. The following lines show how I encrypted the password counting for user math and the password writing for user english with the use of arbitrary salts:

$ perl -e 'print crypt("counting","qc"), "\n"'
qcnVJoZLZDRAE
$ perl -e 'print crypt("writing", "gr"), "\n"'
grrxaQN5BbNTM

Blank lines in the configuration are ignored; anything following a # is also ignored. Listing 1 shows the configuration file I used for testing. The directory /usr/local/reboot-restore holds the compressed image file.

The Restoration Program

The configuration file in Listing 1 is read by the program in Listing 2, which does the actual restoration.

Listing 2

reboot-restore.pl
001 #!/usr/bin/perl
002
003 use strict;
004
005 my $conf = $ARGV[0];
006 my $return_value;
007 my $processed = 0;
008 my $processed_ok = 0;
009 my $data;
010 my $result;
011 my $etc_passwd;
012 my $devnull = "> /dev/null 2>&1";
013
014 if ($conf && -r $conf)
015 {
016         open INFILE, "/etc/passwd";
017         while ($data = <INFILE>)
018         {
019                 $etc_passwd .= $data;
020         }
021         close INFILE;
022
023         $result = open INFILE, $conf;
024         if ($result)
025         {
026                 while ($data = <INFILE>)
027                 {
028                         chomp $data;
029                         $data =~ s/#.*$//;
030                         if ($data !~ m/^\s*$/)
031                         {
032                                 process_user($data);
033                                 $processed++;
034                         }
035                 }
036                 close INFILE;
037         }
038         $return_value = ($processed == $processed_ok) ? 0 : 1;
039 }
040
041 exit $return_value;
042
043 sub process_user
044 {
045         my $data = shift;
046         my $user;
047         my $password;
048         my $compressed_file;
049         my $user_info;
050         my $basename;
051         my $result;
052         my $has_temp_file = 0;
053
054         ($user, $password, $compressed_file) = split(/\s*;\s*/, $data);
055
056         if ($user && $password && $compressed_file)
057         {
058                 # restore only users that exist
059                 if ($etc_passwd =~ m/^$user:[^:]+:(.*?)$/m)
060                 {
061                         $user_info = $1;
062                         if ($compressed_file =~ m!^(http|ftp)://!)
063                         {
064                                 $basename = $compressed_file;
065                                 # greedy matching gets
066                                 # the last match
067                                 $basename =~ s!^.*/!!;
068                                 $result =
069                                         system("wget --output-document /tmp/$basename " .
070                                         "$compressed_file $devnull");
071                                 $compressed_file = "/tmp/$basename";
072                                 $has_temp_file = ($result == 0) ? 1 : 0;
073                         }
074                         else
075                         {
076                                 $result = (-e $compressed_file &&
077                                         (! (-z $compressed_file))) ? 0 : 1;
078                         }
079                         if ($result == 0)
080                         {
081                                 restore_user($user_info, $user, $password, $compressed_file);
082                         }
083                         if ($has_temp_file)
084                         {
085                                 unlink $compressed_file;
086                         }
087                 }
088         }
089 }
090
091 sub restore_user
092 {
093         my $user_info = shift;
094         my $user = shift;
095         my $password = shift;
096         my $compressed_file = shift;
097         my $uid;
098         my $gid;
099         my $gecos;
100         my $homedir;
101         my $shell;
102         my $zip_type;
103
104         ($uid, $gid, $gecos,
105         $homedir, $shell) =
106                 split( /:/, $user_info);
107         $zip_type = "";
108         if ($compressed_file =~ m/gz$/)
109         {
110                 $zip_type = "z";
111         }
112         elsif ($compressed_file =~ m/bz2$/)
113         {
114                 $zip_type = "j";
115         }
116         if ($zip_type ne "")
117         {
118                 do_commands(
119                         "rm -rf $homedir $devnull",
120                         "(cd / $devnull; tar x${zip_type}f $compressed_file $devnull)",
121                         "chown -R $user: $homedir $devnull",
122                         "usermod -p '$password' $user $devnull"
123                 );
124                 $processed_ok++;
125         }
126 }
127
128 sub do_commands
129 {
130         my $command;
131         foreach $command (@_)
132         {
133                 # uncomment next to debug
134                 # print $command, "\n";
135                 system($command);
136         }
137 }

The program gets the name of the configuration file from its first command-line argument (line 5) then reads the contents of the /etc/passwd file (lines 16-21). Then it reads the configuration file. For each line that is in the proper format (line 54-56), the program checks to see whether it is for a valid user (lines 59). The program then downloads the image file if it's not local (lines 64-72) and stores it in a temporary file. After that, the script calls the restore_user subroutine, passing along the user's /etc/passwd information as a parameter.

That subroutine separates the user information (lines 104-106), figures out the image file's compression type (lines 107-115) then calls commands in lines 118-123 to

  • remove the user's home directory,
  • decompress the image file (thus re-creating the home directory),
  • change the ownership of the directory and its files, and
  • restore the user's password.

The change of ownership is necessary in case the machines are not all exactly identical; if machine A has user math as user number 501 and machine B has user math as user number 502, the image's ownership flags must change to suit the machine.

If the image file was downloaded, the restore subroutine gets rid of the temporary file (lines 83-86). After all the lines in the configuration are processed, the script ends, returning 0 (no errors), if every line processed was OK, returning 1 otherwise.

This script should be placed in a reasonable system-level location on each machine that needs the restore capability. In this example, I created the directory /usr/local/reboot-restore and put the reboot-restore.pl script in that directory on each machine. At this point, make sure the script permissions are set to executable.

Invoking the Script

Finally, you need to make sure the script is executed whenever the machine is rebooted. The easiest way to do this is to invoke it from the /etc/rc.d/rc.local file. This script is executed as the last step in the startup process. For this example, I added these lines to the file:

/usr/local/reboot-restore/reboot-restore.pl \
 /etc/reboot-restore.conf

When the system starts, rc.local will invoke the script and restore the original user environment.

The Author

J. David Eisenberg teaches Computer and Information Technology classes at Evergreen Valley College in San Jose, CA. He also does feral cat trapping on campus. He lives with his two cats, Marco Polo and Big Tony.

Read full article as PDF:

Related content

  • System Recovery with tar

    Use a tarball to restore your system in next to no time – without a complete re-install.

  • Admin Workshop: Backups with Rsync

    It is often inefficient to fire up a tape drive whenever you need to back up files or restore a backup. The Rsync tool pushes critical files to a second computer, where you can access them easily.

  • Mondo and Mindi

    Mondo shows that backups don’t need to be time consuming or difficult. This amazingly simple tool backs up complete hard disks or individual directories.

  • Partimage

    Protect your system and preserve your configuration with this powerful backup tool.

  • Partition Backup

    A partition backup offers several advantages over legacy, file-based backup alternatives, and using a backup server adds even more convenience. We’ll show you some free tools for partition backup over the network.

comments powered by Disqus

Direct Download

Read full article as PDF:

News