Securing your Linux lab with resettable user accounts
The Configuration File
Each machine requires a configuration file. On my systems, I named it /etc/reboot-restore.conf, a reasonable name and place to put the file. This file specifies the users with home directories that will be restored when the system reboots.
Each line of the file has the following settings (separated by semicolons): the user name, the encrypted password, and the path to the image file (Listing 1).
Listing 1
Part of restoring the user is restoring the password, which the user could change during a session. usermod, which changes the password, only accepts a password encrypted by the crypt function. Rather than placing the passwords in the configuration file in plain text and letting the restore script do the encryption, I decided to put encrypted passwords in the configuration file for a minimum level of security. To encrypt a password, use the Perl command:
perl -e 'print crypt("password", "salt"),"\n";'
The first argument to crypt is the plaintext password. The second argument is a "salt," which comprises characters used as random input for the encryption algorithm. Only the first two letters of the salt are used, and they will be the first two letters of the encrypted password. The following lines show how I encrypted the password counting for user math and the password writing for user english with the use of arbitrary salts:
$ perl -e 'print crypt("counting","qc"), "\n"' qcnVJoZLZDRAE $ perl -e 'print crypt("writing", "gr"), "\n"' grrxaQN5BbNTM
Blank lines in the configuration are ignored; anything following a # is also ignored. Listing 1 shows the configuration file I used for testing. The directory /usr/local/reboot-restore holds the compressed image file.
The Restoration Program
The configuration file in Listing 1 is read by the program in Listing 2, which does the actual restoration.
Listing 2
The program gets the name of the configuration file from its first command-line argument (line 5) then reads the contents of the /etc/passwd file (lines 16-21). Then it reads the configuration file. For each line that is in the proper format (line 54-56), the program checks to see whether it is for a valid user (lines 59). The program then downloads the image file if it's not local (lines 64-72) and stores it in a temporary file. After that, the script calls the restore_user subroutine, passing along the user's /etc/passwd information as a parameter.
That subroutine separates the user information (lines 104-106), figures out the image file's compression type (lines 107-115) then calls commands in lines 118-123 to
- remove the user's home directory,
- decompress the image file (thus re-creating the home directory),
- change the ownership of the directory and its files, and
- restore the user's password.
The change of ownership is necessary in case the machines are not all exactly identical; if machine A has user math as user number 501 and machine B has user math as user number 502, the image's ownership flags must change to suit the machine.
If the image file was downloaded, the restore subroutine gets rid of the temporary file (lines 83-86). After all the lines in the configuration are processed, the script ends, returning 0 (no errors), if every line processed was OK, returning 1 otherwise.
This script should be placed in a reasonable system-level location on each machine that needs the restore capability. In this example, I created the directory /usr/local/reboot-restore and put the reboot-restore.pl script in that directory on each machine. At this point, make sure the script permissions are set to executable.
Invoking the Script
Finally, you need to make sure the script is executed whenever the machine is rebooted. The easiest way to do this is to invoke it from the /etc/rc.d/rc.local file. This script is executed as the last step in the startup process. For this example, I added these lines to the file:
/usr/local/reboot-restore/reboot-restore.pl \ /etc/reboot-restore.conf
When the system starts, rc.local will invoke the script and restore the original user environment.
Infos
- Deep Freeze: http://www.faronics.com/html/deepfreeze.asp
« Previous 1 2
Buy Linux Magazine
Subscribe to our Linux Newsletters
Find Linux and Open Source Jobs
Subscribe to our ADMIN Newsletters
Support Our Work
Linux Magazine content is made possible with support from readers like you. Please consider contributing when you’ve found an article to be beneficial.
News
-
OSJH and LPI Release 2024 Open Source Pros Job Survey Results
See what open source professionals look for in a new role.
-
Proton 9.0-1 Released to Improve Gaming with Steam
The latest release of Proton 9 adds several improvements and fixes an issue that has been problematic for Linux users.
-
So Long Neofetch and Thanks for the Info
Today is a day that every Linux user who enjoys bragging about their system(s) will mourn, as Neofetch has come to an end.
-
Ubuntu 24.04 Comes with a “Flaw"
If you're thinking you might want to upgrade from your current Ubuntu release to the latest, there's something you might want to consider before doing so.
-
Canonical Releases Ubuntu 24.04
After a brief pause because of the XZ vulnerability, Ubuntu 24.04 is now available for install.
-
Linux Servers Targeted by Akira Ransomware
A group of bad actors who have already extorted $42 million have their sights set on the Linux platform.
-
TUXEDO Computers Unveils Linux Laptop Featuring AMD Ryzen CPU
This latest release is the first laptop to include the new CPU from Ryzen and Linux preinstalled.
-
XZ Gets the All-Clear
The back door xz vulnerability has been officially reverted for Fedora 40 and versions 38 and 39 were never affected.
-
Canonical Collaborates with Qualcomm on New Venture
This new joint effort is geared toward bringing Ubuntu and Ubuntu Core to Qualcomm-powered devices.
-
Kodi 21.0 Open-Source Entertainment Hub Released
After a year of development, the award-winning Kodi cross-platform, media center software is now available with many new additions and improvements.