10 Quick Tips About sudo command for Linux systems

Overview

sudo stands for superuser do. It allows authorized users to execute command as an another user. Another user can be regular user or superuser. However, most of the time we use it to execute command with elevated privileges.

sudo command works in conjunction with security policies, default security policy is sudoers and it is configurable via /etc/sudoers file. Its security policies are highly extendable. One can develop and distribute their own policies as plugins.

How it’s different than su

In GNU/Linux there are two ways to run command with elevated privileges:

◈ Using su command
◈ Using sudo command

su stands for switch user. Using su, we can switch to root user and execute command. But there are few drawbacks with this approach.

◈ We need to share root password with another user.
◈ We cannot give controlled access as root user is superuser
◈ We cannot audit what user is doing.

sudo addresses these problems in unique way.

1. First of all, we don’t need to compromise root user password. Regular user uses its own password to execute command with elevated privileges.
2. We can control access of sudo user meaning we can restrict user to execute only certain commands.
3. In addition to this all activities of sudo user are logged hence we can always audit what actions were done. On Debian based GNU/Linux all activities are logged in /var/log/auth.log file.

Later sections of this tutorial sheds light on these points.

Hands on with sudo

Now, we have fair understanding about sudo. Let us get our hands dirty with practical. For demonstration, I am using Ubuntu. However, behavior with another distribution should be identical.

Allow sudo access

Let us add regular user as a sudo user. In my case user’s name is lpicentral

1) Edit /etc/sudoers file as follows:

$ sudo visudo

2) Add below line to allow sudo access to user lpicentral:

lpicentral ALL=(ALL) ALL

In above command:

◈ lpicentral indicates user name
◈ First ALL instructs to permit sudo access from any terminal/machine
◈ Second (ALL) instructs sudo command to be allowed to execute as any user
◈ Third ALL indicates all command can be executed as root

Execute command with elevated privileges

To execute command with elevated privileges, just prepend sudo word to command as follows:

$ sudo cat /etc/passwd

When you execute this command, it will ask lpicentral’s password and not root user password.

Execute command as an another user

In addition to this we can use sudo to execute command as another user. For instance, in below command, user lpicentral executes command as a devesh user:

$ sudo -u devesh whoami
[sudo] password for lpicentral:
devesh

Built in command behavior

One of the limitation of sudo is – Shell’s built in command doesn’t work with it. For instance, history is built in command, if you try to execute this command with sudo then command not found error will be reported as follows:

$ sudo history
[sudo] password for lpicentral:
sudo: history: command not found

Access root shell

To overcome above problem, we can get access to root shell and execute any command from there including Shell’s built in.

To access root shell, execute below command:

$ sudo bash

After executing this command – you will observe that prompt sign changes to pound (#) character.

Recipes

In this section we’ll discuss some useful recipes which will help you to improve productivity. Most of the commands can be used to complete day-to-day task.

Execute previous command as a sudo user

Let us suppose you want to execute previous command with elevated privileges, then below trick will be useful:

$ sudo !4

Above command will execute 4th command from history with elevated privileges.

sudo command with Vim

Many times we edit system’s configuration files and while saving we realize that we need root access to do this. Because this we may lose our changes. There is no need to get panic, we can use below command in Vim to rescue from this situation:

:w !sudo tee %

In above command:

◈ Colon (:) indicates we are in Vim’s ex mode
◈ Exclamation (!) mark indicates that we are running shell command
◈ sudo and tee are the shell commands
◈ Percentage (%) sign indicates all lines from current line

Execute multiple commands using sudo

So far we have executed only single command with sudo but we can execute multiple commands with it. Just separate commands using semicolon (;) as follows:

$ sudo -- bash -c 'pwd; hostname; whoami'

In above command:

◈ Double hyphen (–) stops processing of command line switches
◈ bash indicates shell name to be used for execution
◈ Commands to be executed are followed by –c option

Run sudo command without password

When sudo command is executed first time then it will prompt for password and by default password will be cached for next 15 minutes. However, we can override this behavior and disable password authentication using NOPASSWD keyword as follows:

lpicentral ALL=(ALL) NOPASSWD: ALL

Restrict user to execute certain commands

To provide controlled access we can restrict sudo user to execute only certain commands. For instance, below line allows execution of echo and ls commands only

lpicentral ALL=(ALL) NOPASSWD: /bin/echo /bin/ls

Insights about sudo

Let us dig more about sudo command to get insights about it.

$ ls -l /usr/bin/sudo
-rwsr-xr-x 1 root root 145040 Jun 13  2017 /usr/bin/sudo

If you observe file permissions carefully, setuid bit is enabled on sudo. When any user runs this binary it will run with the privileges of the user that owns the file. In this case it is root user.

To demonstrate this, we can use id command with it as follows:

$ id
uid=1002(lpicentral) gid=1002(lpicentral) groups=1002(lpicentral)

When we execute id command without sudo then id of user lpicentral will be displayed.

$ sudo id
uid=0(root) gid=0(root) groups=0(root)

But if we execute id command with sudo then id of root user will be displayed.

Continue reading

Grep Command in Unix Shell script

Q) How to use the grep command in unix or linux bash scripts to search for a pattern match?

You might have used the grep command to search for a string in a file on the unix command line. Here we will see how to use the grep command in a bash script.

Consider the below file with data

> cat sample_file.txt
linux storage
unix distributed system
linux file server
debian server
fedora backup server

Let see the bash script that prints the lines which contain the word server in it. The bash script code is shown below:

>vi grep_script.sh

#!/bin/bash

WORD=server
INPUT_FILE=sample_file.txt
grep "$WORD" $INPUT_FILE

Now we will execute this script and see what the output is

> bash grep_script.sh

linux file server
debian server
fedora backup server

Here in the script we have hardcoded the filename and the search pattern. We will see how to pass these as arguments from the command line to the script. The bash script is:

>vi grep_script_command_line.sh

#!/bin/bash

INPUT_FILE=$1
WORD=$2
grep "$WORD" $INPUT_FILE

Now run the script as shown below:

> bash grep_script_command_line.sh sample_file.txt server

Continue reading

Cut Command in Unix ( Linux) Examples

Cut command in unix (or linux) is used to select sections of text from each line of files. You can use the cut command to select fields or columns from a line by specifying a delimiter or you can select a portion of text by specifying the range or characters. Basically the cut command slices a line and extracts the text.

Unix Cut Command Example

We will see the usage of cut command by considering the below text file as an example

> cat file.txt
unix or linux os
is unix good os
is linux good os

1. Write a unix/linux cut command to print characters by position?

The cut command can be used to print characters in a line by specifying the position of the characters. To print the characters in a line, use the -c option in cut command

cut -c4 file.txt
x
u
l

The above cut command prints the fourth character in each line of the file. You can print more than one character at a time by specifying the character positions in a comma separated list as shown in the below example

cut -c4,6 file.txt
xo
ui
ln

This command prints the fourth and sixth character in each line.

2 .Write a unix/linux cut command to print characters by range?

You can print a range of characters in a line by specifying the start and end position of the characters.

cut -c4-7 file.txt
x or
unix
linu

The above cut command prints the characters from fourth position to the seventh position in each line. To print the first six characters in a line, omit the start position and specify only the end position.

cut -c-6 file.txt
unix o
is uni
is lin

To print the characters from tenth position to the end, specify only the start position and omit the end position.

cut -c10- file.txt
inux os
ood os
good os

If you omit the start and end positions, then the cut command prints the entire line.

cut -c- file.txt

3. Write a unix/linux cut command to print the fields using the delimiter?

You can use the cut command just as awk command to extract the fields in a file using a delimiter. The -d option in cut command can be used to specify the delimiter and -f option is used to specify the field position.

cut -d' ' -f2 file.txt
or
unix
linux

This command prints the second field in each line by treating the space as delimiter. You can print more than one field by specifying the position of the fields in a comma delimited list.

cut -d' ' -f2,3 file.txt
or linux
unix good
linux good

The above command prints the second and third field in each line.

Note: If the delimiter you specified is not exists in the line, then the cut command prints the entire line. To suppress these lines use the -s option in cut command.

4. Write a unix/linux cut command to display range of fields?

You can print a range of fields by specifying the start and end position.

cut -d' ' -f1-3 file.txt

The above command prints the first, second and third fields. To print the first three fields, you can ignore the start position and specify only the end position.

cut -d' ' -f-3 file.txt

To print the fields from second fields to last field, you can omit the last field position.

cut -d' ' -f2- file.txt

5. Write a unix/linux cut command to display the first field from /etc/passwd file?

The /etc/passwd is a delimited file and the delimiter is a colon (:). The cut command to display the first field in /etc/passwd file is

cut -d':' -f1 /etc/passwd

6. The input file contains the below text

> cat filenames.txt
logfile.dat
sum.pl
add_int.sh

Using the cut command extract the portion after the dot.

First reverse the text in each line and then apply the command on it.

rev filenames.txt | cut -d'.' -f1

Continue reading

Learn Git Command with Practical Examples on Linux

Git is distributed version control system. It is primarily used by software developers for their source code management. Git is free and open source software and many large organizations use it to manage their huge code base.

Git user initial configuration

First we have to configure settings for Git user. We can make these settings for all repositories present on current system or for a particular repository. Let us understand this with example:

User identity

In Git we can specify user identity by providing its name and e-mail address. This information will be used during each commit operation. Execute below command in terminal to assign identity:

$ git config --global user.name "LPICentral User"
$ git config --global user.email "lpicentraluser@lpicentral.blogspot.com"

Editor

This setting configures editor, which will be used while providing commit message:

$ git config --global core.editor vim

Compression

This setting configures compression level to be used. Valid range for compression is -1 to 9. -1 value indicates zlib compression and is default compression level. 0 value means no compression, and 1 to 9 are various speed/size tradeoffs, 9 being slowest.

$ git config --global core.compression 2

Diff tool

This setting configures diff viewer tool. For example, below command configures vimdiff as a diff tool:

$ git config --global diff.tool vimdiff

In above commands we have used –global option everywhere, which will make this configuration global. It means that same configuration will be applied to all repositories present on current system. To make configuration repository specific just remove –global option.

List configuration

To list Git configuration execute below command in terminal:

$ git config -l

This command will generate following output:

core.repositoryformatversion=0
core.filemode=true
core.bare=false
core.logallrefupdates=true
core.editor=vim
core.compression=2
user.name=LPICentral User
user.email=lpicentraluser@lpicentral.blogspot.com
diff.tool=vimdiff

Git repositories

Repository is a location where source code is stored. We can either create new repository or use existing repository. To create new empty repository execute below command:

$ mkdir my-repo.git
$ cd my-repo.git
$ git init --bare
Initialized empty Git repository in my-repo.git

This method will be useful when you are starting with new project. Another method is to use existing repository. Such a repository is hosted on remote server like GitHub. To download remote repository use clone command as follows:

$ git clone https://github.com/lpicentraluser/my-repo.git
In above command last argument is path of remote repository.

Git workflow

In this section we’ll discuss git workflow.

Introduce new changes

First step is to introduce new changes. It can be addition of new file or updating existing files. Let us create a new file and modify existing file

$ touch AUTHORS                                  # Create new file
$ echo "New Contents" >> README                  # Update existing file
.

Check repository status

Git is content tracking system, it will identify above two changes. Let us check repository status:

$ git status -s
 M README
?? AUTHORS

In above output letter M appears before README which indicates that existing file is modified. Whereas ?? appears before AUTHORS which indicates that this is new file and Git is not aware about it hence such a file is called untracked file.

Add file to changeset

Let us instruct Git to track this new file. We can achieve this using add command. This operation will start tracking changes made to this file.

$ git add AUTHORS

Let us check repository status now:

$ git status -s
A  AUTHORS
M README

Above output shows A before AUTHORS which indicates that this file is newly added under Git. We can add any number of files using this command.

Remove file from changeset

Let us instruct Git to untrack this newly added file. We can achieve this using reset command. This operation will remove file from changeset

$ git reset AUTHORS
$ git status -s
 M README
?? AUTHORS

Above output shows that AUTHORS file is not tracked by Git.

Commit changes

In Git, files which are part of changeset will form a commit. Each commit will get unique ID. Let us create changeset first

$ git add AUTHORS
$ git add README

Now let us commit changes to local repository with commit message. In below command -m argument indicates commit message.

$ git commit -m "Updated README and added AUTHORS"

When you execute above command it will generate following output:

[master 0b124eb] Updated README and added AUTHORS
 2 files changed, 1 insertion(+)
 create mode 100644 AUTHORS

Review changes

In this section we’ll discuss commands which will allow us to review repository changes.

View commit log

Repository can contain multiple commits by multiple authors. We can use log command to view all available commits:

$ git log

When you execute above command it will generate following output:

commit 0b124eb6d0109d837f6f9396c9937406abd3f456 (HEAD -> master)
Author: LPICentral User <lpicentraluser@lpicentral.blogspot.com>
Date:   Fri Jul 27 21:06:55 2018 +0530

    Updated README and added AUTHORS

This is commit we had created earlier. In above command:

◈ Hexadecimal ID represents a commit ID
◈ Author section of commit shows details about who made these changes
◈ Date section shows date and timestamp of commit

View short commit log

Above command will show detailed information about each commit. To view short description about each commit use –oneline option as follows:

$ git log --oneline

When you execute above command, it will generate following output:

0b124eb (HEAD -> master) Updated README and added AUTHORS

View commit

Commit ID is associated with each changeset. We can use this ID with show command to view commit contents.

$ git show 0b124eb6d0109d837f6f9396c9937406abd3f456

When you execute above command it will generate following output:

commit 0b124eb6d0109d837f6f9396c9937406abd3f456 (HEAD -> master)
Author: LPICentral User <lpicentraluser@lpicentral.blogspot.com>
Date:   Fri Jul 27 21:06:55 2018 +0530
    Updated README and added AUTHORS
diff --git a/AUTHORS b/AUTHORS
new file mode 100644
index 0000000..e69de29
diff --git a/README b/README
index 980a0d5..5680123 100644
--- a/README
+++ b/README
@@ -1 +1,2 @@
 Hello World!
+New Contents

View diff

Diff command allows us to review changes before creating changeset. Diff command shows the differences between repository and local workspace. Let us modify README file and view differences

$ echo "Generating diff" >> README
$ git diff
diff --git a/README b/README
index 5680123..3158230 100644
--- a/README
+++ b/README
@@ -1,2 +1,3 @@
 Hello World!
 New Contents
+Generating diff

In above command:

◈ + sign indicates changes which are added to file
◈ – sign indicates changes which are removed from file

Working with remote repositories

So far we were working with local repository only. Other developers cannot use changes which are made by us as they are local. Hence code collaboration is not possible. This section will describe commands which will allow us to interact with remote repositories

Publish changes to remote repository

We can publish local changes to remote repository so that other developers can use it. Before publishing changes we have to create changeset and local commit. We can publish changes using push command as follows:

$ git push

This command copies changes from local workspace to remote repository. In Git, this operation is referred as push operation.

Sync workspace with remote repository

Many developers can publish their workspace changes to remote repository. Git allows us to download those changes and sync workspace with repository. We can achieve this using pull command:

$ git pull

In Git, this operation is referred as pull operation.

Miscellaneous Git commands

This section discusses miscellaneous Git commands which will be useful to perform day-to-day tasks:

Modify latest commit

Git allows us to modify latest commit. We can use this method to avoid creation of new commit. It is mostly used to modify previous commit message. To modify latest commit use –amend option as follows:

$ echo "Yet another new change" >> README
$ git add README
$ git commit --amend -m "This is amended commit

Now let us check the commit log:

$ git log
commit 8bf67aec1d1de87f03ab6aae93940b17826fde1c (HEAD -> master)
Author: LPICentral User <lpicentraluser@lpicentral.blogspot.com>
Date:   Fri Jul 27 21:54:55 2018 +0530

    This is amended commit

If you observe above output carefully then we can see new commit message, its ID and new timestamp.

Remove untracked files

Untracked files are those which are unknown to Git. We can remove all untracked files using clean command.

Let us create few untracked files:

$ touch delete-me-1 delete-me-2 delete-me-3

To remove all above untracked file use clean command with -f option as follows:

$ git clean -f
Removing delete-me-1
Removing delete-me-2
Removing delete-me-3

Please note that this command will remove files permanently hence use it with caution.

View commits of particular author

If we use log command then it shows commits of all authors. To view commits of particular author use –author flag as follows:

$ git log --author=LPICentral

When you execute above command it will list all the commits of LPICentral authors as follows:

commit 8bf67aec1d1de87f03ab6aae93940b17826fde1c (HEAD -> master)
Author: LPICentral User <lpicentraluser@lpicentral.blogspot.com>
Date:   Fri Jul 27 21:54:55 2018 +0530

    This is amended commit

View history of each file line by line

To view line by line history we can use blame command.

$ git blame README

When you execute above command it will generate following output:

76294131 (LPICentral User         2018-07-27 21:12:11 -0700 1) Hello World!
8bf67aec (LPICentral User         2018-07-27 21:54:55 +0530 2) New changes
8bf67aec (LPICentral User         2018-07-27 21:54:55 +0530 3) Yet another changes

In above command:

◈ First column indicates commit ID
◈ Second column indicates author
◈ Third column indicates timestamps
◈ Last column indicates line number and file content

View diff from staging area

When you create changeset using add command then file is logically moved to staging area. Let us see with this example:

$ echo "Let us demonstrate staging area" >> README
$ git add README
$ git diff

Above command will not show any difference as file is move to staging area. Let us use –staged operation to view differences:

$ git diff --staged
diff --git a/README b/README
index 74729a2..8bc5ffd 100644
--- a/README
+++ b/README
@@ -1,3 +1,4 @@
 Hello World!
 New changes
 Yet another changes
+Let us demonstrate staging area

Continue reading

WC Command Examples - Count of Lines, Words, Characters - Unix / Linux

WC command in unix or linux is used to find the number of lines, words and characters in a file. The syntax of wc command is shown below:

wc [options] filenames

You can use the following options with the wc command.

-l : Prints the number of lines in a file.
-w : prints the number of words in a file.
-c : Displays the count of bytes in a file.
-m : prints the count of characters from a file.
-L : prints only the length of the longest line in a file.

Let see how to use the wc command with few examples. Create the following file in your unix or linux operating system.

> cat unix_wc.bat
Oracle Storage
unix distributed system
linux file server
debian server
Oracle backup server

WC Command Examples:

1. Printing count of lines

This is the most commonly used operation to find the number of lines from a file. Run the below command to display the number of lines:

wc -l unix_wc.bat
5 unix_wc.bat

Here in the output, the first field indicates count and second field is the filename

2. Displaying the number of words.

Just use the -w option to find the count of words in a file. This is shown below:

wc -w unix_wc.bat
13 unix_wc.bat

3. Print count of bytes, count of characters from a file

We can use the -c and -m options to find the number of bytes and characters respectively in a file.

> wc -c unix_wc.bat
92 unix_wc.bat
> wc -m unix_wc.bat
92 unix_wc.bat

4. Print the length of longest line

The -L option is used to print the number of characters in the longest line from a file.

wc -L unix_wc.bat
23 unix_wc.bat

In this example, the second line is the longest line with 23 characters.

5. Print count of lines, words and characters.

If you dont specify any option to the wc command, by default it prints the count of lines, words and characters. This is shown below:

wc unix_wc.bat
 5 13 92 unix_wc.bat

6. Wc help

For any help on the wc command, just run the wc --help on the unix terminal.

Continue reading

Chmod Command Examples in Unix / Linux

Chmod (change mode) is one of the most frequently used commands in unix or linux operating system. The chmod command is used to change the file or directory access permissions. To know about the access permissions of a file or directory, use the ls -l command as shown below:

$ ls -l sample.sh
-rwx-rw-r-- 1 matt deploy 94 Oct  4 03:12 sample.sh

Here in the above example: Use matt has the read, write and execute permissions on the file. Group deploy has read and write permissions. Others have only the read permission.
File and Directory permissions:

There are three different permissions. They are: 

◈ Read (4): Permitted to read the contents of the file. In case of directory, you can view all the files and sub-directories in that directory.
◈ Write (2): Permitted to write to the file. In case of directory, you can create files and sub-directories.
◈ Execute (1): Execute the file as a program/shell script. In case of directory, You can enter into that directory.

Here in the above, the numbers in the brackets represents the numeric values for the corresponding permissions. If you want to have a combination of permissions add the required numbers. For example, for read and execute, it is 4+1=5.

The syntax of chmod command is 

chmod [options] mode filename

THe important options are:

-R : recursively change the permissions of a directory.
-v : Verbose

Chmod Examples in Linux / Unix: 

1. Give read, write and execute permissions to everyone. 

Read, write and execute: 4+2+1=7

$ chmod 777 sample.sh

In the above example, you can see that the permissions are specified with a three digit number. The first digit is for user permissions, second is for group and third is for others permission. This type of representation is called octal representation. Alternatively, you can use the symbolic representation to give the permissions.

chmod ugo+rwx sample.sh

We will see more details about the symbolic representation later.

2. Give read permission to user, write permission to group and execute permission to others. 

$ chmod 421 sample.sh

3. Recursive permissions to directory 

To give read and write permissions to all the users to a directory (including files and subdirectories) use the recursive option -R.

chmod -R 666 /dir

Symbolic Representation of Permissions: 

The following symbols are used to represent the users, groups and others:

u : User
g : Group
o : Others a : All (user, group and others)

The following symbols represent the permissions:

r : read
w : write
x : execute

The following symbols represent the permissions grant or revoke:

+ : Additional permissions. Selected permissions are added.
- : Revoke the permissions. Selected permissions are revoked.
= : Specific permissions. Only selected permissions are assigned.

Examples: 

1. Remove write permission from group 

$ chmod g-w sample.sh

This will only removes the write permission for the group.

2. Add new permission execute to others 

$ chmod o+x sample.sh

In addition to the existing permissions, this will add execute permission to others.

3. Give only read permissions to the user 

$ chmod u=w sample.sh

This will remove the existing permissions to the user and gives only write permission to the user.

Continue reading