CompTIA Security_ Deluxe Study Guide_ SY0-201 - Emmett Dulaney [278]
2. Type the command cd /tmp.
3. Type the command chmod 444 *.
4. When you are finished, exit the terminal window.
Lab B.13: Change the Default Permissions for all Newly Created Files in Linux
This lab requires a Linux workstation.
The umask utility/value is used to determine the default permissions on newly created files. On most systems, the umask default is 022, meaning that newly created files have permissions of 644 (rw-r--r--).
In this exercise, the value will be changed to 026, meaning that newly created files will have permissions of 640 (rw-r-----). To accomplish this change, follow these steps:
1. From the desktop, choose Programs Accessories Terminal.
Your menu choices might differ slightly based upon the Linux distribution you are using.
2. Type the command: umask 026.
3. This setting makes the value temporary. To make it permanent, type the command cd /etc.
4. Use any editor (such as Vi) to open the profile file and change the default entry in it from umask 022 to umask 026. Save your change and exit the editor.
5. When you are finished, exit the terminal window.
Lab B.14: View all Linux Logins
This lab requires a Linux workstation.
The lastlog utility can be used to generate a list of every user account and the last time they logged in to the system. Unfortunately, it lists the account even if the user associated with it has never logged in.
In this exercise, you’ll get a list of user accounts and then remove all the entries that have never logged in so that you are left with only accounts that have actually accessed the workstation:
1. As root, from the desktop, choose Programs Accessories Terminal.
Your menu choices might differ slightly based upon the Linux distribution you are using.
2. Type the command lastlog | grep -vi “never”.
3. Make a list of the usernames and verify that each is a legitimate account that should be accessing your system.
4. To see each login of a particular account (providing the wtmp file has not been parsed), use that account with the last command. For example, to see the logins for the user christine, type the command last christine.
5. When you are finished, exit the terminal window.
Lab B.15: Change the Group Associated with Files
This lab requires a Linux workstation.
The root user has the ability to do anything on the system, from deleting the entire operating system to changing miniscule settings. Between those two ends of the spectrum resides the ability to change the owner or group associated with files.
In this exercise, you change the group associated with all files beneath a directory to root. This action can be useful if a user quits and you need to give access permissions to others. This exercise uses the user account staley, but it should be changed to one that exists on your system:
1. As root, from the desktop, choose Programs Accessories Terminal.
Your menu choices might differ slightly based upon the Linux distribution that you are using.
2. Type the command cd /home/staley.
3. Type the command chgrp root *.*.
4. When you are finished, exit the terminal window.
You could similarly change the owner by using chown in place of chgrp.
Lab B.16: View Failed Login Attempts
This lab requires a Linux workstation.
One of the signs that an attacker might be attempting to break into a system will be failed login attempts. The /var/log/faillog file keeps track of failed authentication attempts. Follow these steps to view this information on a workstation:
1. As root, from the desktop, choose Programs Accessories Terminal.
Your menu choices might differ slightly based upon the Linux distribution that you are using.
2. Type the command faillog. The list that appears, if any, will show accounts that have not had a successful login since the last failure.
3. Type the command faillog -a. The list that appears will show all failed login attempts, including those that have since had a successful authentication.