Top Ten Linux Configuration Tools?

jman251 asks: "I am presenting at a conference in September on a couple of Linux-centric topics. One of these is a collection of tips, tricks, and tools for configuring, securing, and maintaining a Linux-based server. I have a short list of tools I use, but would like some community input on the subject. What tools do you use that make your admin responsibilities easier or more automated on the Linux platform?"

Comments

They all start with "nano -wiR /etc/"

[Ayanami Rei]

Re:They all start with "nano -wiR /etc/"

[kristaps.kaupe]

mine usually starts with `mc' :)

rm

[bobthemuse]

rm -rf /home

That'll teach those pesky users....

Re:rm

[Punk Walrus]

Only as root... and then you created them, so hush! :)

Re:rm

[geekoid]

you can't have users to torment, if you don't create any.

Re:rm

[Homology]

I used

$ chflags uchg /home/dude

So now "rm -fr /" won't work even as root as it will properly give you :

rm: /home/dude: Operation not permitted

So there you are, you pesky root of all evil. Oh bummer, now I can't make any new files in /home/dude ....

Xconfigurator

[superpulpsicle]

Xconfigurator used to be the key thing if you had any graphical needs. But the KDE GUI makes all that graphical tweaking as transparent as windows desktop nowadays.

Webmin all the way

[tntguy]

Webmin. Grab Usermin while you're there.

Re:Webmin all the way

[desiderius7]

Amen to that. Being responsible for the administration of about 10 linux boxes that each provide a unique variety of services, Webmin has been invaluable. If I didn't have Webmin, all of my tasks performed through the shell would take about 10 times longer than they currently do from a browser that can lay out my options much more nicely. The key is to know/learn how to do what you want to do from the shell first, so that you have the understanding (and for emergencies), but to then use Webmin to boost your efficiency and help remind you of things that a blank console doesn't.

Re:Webmin all the way

[wo1verin3]

At the risk of being redundant, when I stumbled across Webmin I was amazed at how simple it made some tasks such as playing with mysql DBs without knowing the syntax. I was new to linux at the time and although knowing the syntax for commands is important, this was a good tool to help me learn.

Re:Webmin all the way

[Anonymous Coward]

Webmin's all well and good for a few machines. But if you're employed maintaining 100s of machines, there are very few real and free options, and I don't personally think webmin is one of them, unless it's become much more scriptable than when I last checked.

cfengine works really well, but you don't appreciate its features until you hit the 70+ machine mark - the "trick" is that cfengine with it's inheritance and boolean class logic excels for systems that are different but have bits in common. Such different bits ALWAYS turn up with 70+ machines, simply because PC-class hardware's failure rate means something will have been changed on some machine somewhere at any given time. But if you've only got tens of machines runnning one OS rather than hundreds running five different OSes, it all seems like very hard work to set up your cfengine configuration files. The other "trick" is that cfengine is mostly multiuser and you can allow different users perform different actions, so when you've got a team of admins of different ability,
johnny-adds-visitor-laptops-to-vlan-17 just can't fuck up mordred-rules-production-database-servers-with-iro n-fist's work, yet _can_ have role-based limited admin abilities.

Webmin is nice

[arfonrg]

I use it on several of my servers to do basic configuration.

Re:Webmin is nice

[John Hurliman]

I'd put Webmin on my #1 list for best Linux admin tools. phpmysql is probably second (or the postgresql equivalent), and all the necessary toolkit apps like nmap, ethereal, netcat, etc.

Re:Webmin is nice

[mkro]

Also, it requires you to run httpd, which on many servers is not worth the security risk.

You let the webserver only accept connections from localhost, and the daemon runs as an unpriviliged user. What am I missing here?

Re:Webmin is nice

[nharmon]

I would say that you're missing that fact you don't run X on a production server (at least...i don't)...

Re:Webmin is nice

[mkro]

Sorry, not trying to troll here, but X for what? I asume accessing the web interface can be done with [e]links/w3m/lynx. No, never tried, but the web pages don't look THAT advanced.

Re:Webmin is nice

[ThisIsFred]

It doesn't require you to run a separate webserver, it comes with its own. There are potential security problems, because in order to modify system configuration files, Webmin must be superuser-equivalent. However, Webmin modules have ACLs, and you can choose to not allow your lesser sysops access to things that might be dangerous.

Webmin has lots of thoughtful touches, like the ability to block certain UIDs and GIDs so that a lesser sysop cannot change the root account (for example). Another bonus is that Webmin users don't have to be regular shell accounts. It's not perfect, but it's still the Swiss Army Knife of configuration utilities.

Re:Webmin is nice

[rokka]

Oh but really. You don't have to run it when you're not configuring something. I guess the lazy guys just lets the deamon run constantly. I do that at home, but I wouldn't keep it alive on a box that actually -does- something. You can always start it when needed.

Dave Lettermans Top 10

[Anonymous Coward]

su
df
du
ls
rm
passwd
chown
vi
more
bash

Hey, you asked for it - No clicky links to read.

Re:Dave Lettermans Top 10

[vicviper]

su
df
du
ls
rm
passwd
chown
vi
more
bash

s/more/less/

Your comment has too few characters per line (currently 3.6).

Re:Dave Lettermans Top 10

[Anonymous Coward]

but he said configuration tools.
rm, su and bash don't seem to relate.
ls could, but thats a stretch

Dave Letterman's IT crew's Top 10

9) your distro's install disks
8) that other distro(that is better)install disks
7) fdisk
6) ???
5) Profit!
4) google.com or tldp.org (rtfw!)
3) lspci (plug and pray baby!)
2) man (it helps to know what your doing with it)
1) your text editor (vi|emacs|jed|nano|whatever)
0) man (rtfm!)

Re:Dave Lettermans Top 10

[Badanov]

1) BASH and that means any program that can be included in a BASH shell, ls, cd, rm, mv, chmod, chown, chattr, etc
2) emacs or if FreeBSD, edit
3) PERL
4) IPTables, or if FreeBSD, ipfw
5) ssh
6) telnet
7) gzip/gunzip
8) any of the c compilers, plus gmake or make
9) If setting up a Unix/Linux server inside a private network, nfs
10) If a database is needed then postgreSQL, plus the DBI stuffies, plus DBD, etc. May as well include an Apache web server with mod_perl

Re:Dave Lettermans Top 10

[hackstraw]

su -- better sudo keeps your root password better kept, does more logging, etc

more -- better less (Its not the 70s anymore people, you can search and go backwards in files since less first came about in the mid 80s. With the LESSOPEN varible set to something useful you can "browse" many, many filetypes too).

bash -- better zsh My shell can do anything your shell can do, but better!

Re:Dave Lettermans Top 10

[ewtrowbr]

I recently discoverd that I can use nohup to start a lengthy process from a remote ssh session, hang up, and check on it later. for example...

nohup emerge sync &
( or nohup make && make install & )
tail -f nohup.out
exit

This is the coolest thing in the world, because I can logout, the process keeps running, and I can check on the progress later from another location.

This is probably no suprise to the graybeards out there, but is sparkly to a n00b like me.

Re:Dave Lettermans Top 10

[stevey]

I can logout, the process keeps running, and I can check on the progress later from another location.

Whilst you are correct this works for non-interactive processes, you can't use nohup to keep a copy of say, Lynx, running when you logout. Then return to it later and pick off where you left it.

Instead you should look at GNU Screen which allows this and more.

(It's essentially a windowing system for consoles, with the ability to detach and resume at will, and definately one of my top ten Unix utilities).

Here is one Screen tutorial which explains basic operation well.

Re:Dave Lettermans Top 10

[hackstraw]

what are the advatages of zsh over bash

1) programable tab completion - yes folks there is more to tab completion besides beeping all the time. When I hit cd fooTAB the list of completions only shows _directories_ beginning with foo

2) sane invocation - zsh is the only shell that has one file that is sourced _on all invocations of the shell_ so you can do stuff like have a consistant PATH and other env stuff

3) global aliases - zsh provides an alias that works _anywhere on the commandline_ I have 'G' mapped to '| grep -i', I have 'L' mapped to '| less' and 'vi' mapped to 'vim' (why? So sudo vi FILE gives me vim if the system has vim), etc, etc

4) the only shell that supports working 'vi' style history editing

5) multiple commandline commands are not rewritten as commands with ';' in them (what I typed is what I get, see 4)

6) too many features to name. Like I said, my shell can do anything your shell can do, but better.

Re:Dave Lettermans Top 10

[Rei]

I'm reminded a bit of the ABCs of UNIX here...

A is for awk, which runs like a snail
B is for biff, which reads all your mail
C is for cc, as hackers recall
D is for dd, the command that does all
E is for emacs, which rebinds your keys
F is for fsck, which rebuilds your trees
G is for grep, a clever detective
H is for halt, which may seem defective
I is for indent, which rarely amuses
J is for join, which nobody uses
K is for kill, which makes you the boss
L is for lex, which is missing from DOS
M is for more, from which less was begot
N is for nice, which really is not
O is for od, which prints out things nice
P is for passwd, which reads in strings twice
Q is for quota, a Berkeley-type fable
R is for ranlib, for sorting a table
S is for spell, which attempts to belittle
T is for true, which does very little
U is for uniq, which is used after sort
V is for vi, which is hard to abort
W is for whoami, which tells you your name
X is, well, X, of dubious fame
Y is for yes, which makes an impression, and
Z is for zcat, which handles compression

Re:Dave Lettermans Top 10

[tjw]

what are the advatages of zsh over bash? Pros Cons?

Personally I find both useful. I prefer zsh for my interactive shell because it has many features that I think make it a better tool for that job:

1. vi bindings work like tcsh
2. preexec function that allows me to update xterm title bars before the command runs in them
3. multiple output redirection (e.g. date > out1 > out2)

On the other hand, I much prefer bash for writing shell scripts because it has many features that make it a better tool for that job:

1. supports TCP and UDP filehandles (e.g. /dev/tcp/localhost/80)
2. nice array variables
3. installed on just about every linux system

YMMV

Re:Dave Lettermans Top 10

[sonicattack]

1) programable tab completion - yes folks there is more to tab completion besides beeping all the time. When I hit cd fooTAB the list of completions only shows _directories_ beginning with foo

"Bash" also supports programmable tab completion - it's possible to do stuff such as:

Tab completion after the command ...

... unzip, which will only complete filenames ending with ".zip"

... kill, will give you a full list of PID's to kill.

... killall, will complete process names.

... ping, telnet, ftp, will complete to entries in /etc/hosts

... insmod, will complete module names to be loaded.

... rmmod, will complete to loaded modules to unload.



And my favorite:

apt-get install, which will complete to packages known to apt

There are lots more of them, and of course, since it's programmable, more can be added to suite ones needs.

Re:Dave Lettermans Top 10

[macshit]

zsh also has some extremely annoying properties, especially its tendency to assign essentially every[*] single non-alphumeric character a "magic" meaning (e.g., = as a filename prefix seems to be something like "which").

Personally I think zsh is a great example of "lots of features and no taste."

[*] Yes, I'm exaggerating -- I'm sure there are a few without... :-)

Re:Dave Lettermans Top 10

[Matt Perry]

1) programable tab completion

Bash has programable tab completion. In fact, you should check out the Bash Programmable Completion package if you are a bash user. That contains a bunch of completions for commonly used commands and their options.

5) multiple commandline commands are not rewritten as commands with ';' in them (what I typed is what I get, see 4)

That's the default in bash, too. If you aren't getting that behaviour it's because you turned the cmdhist option on (or your distro did). "shopt -u cmdhist" will turn that back off.

Re:Dave Lettermans Top 10

[MrDelSarto]

If you read the man page

-X or --no-init
Disables sending the termcap initialization and deinitialization strings to the terminal. This is sometimes desirable if the deinitialization string does something unnecessary, like clearing the screen.

you can even set it with LESS=X ; export LESS

Re:Dave Lettermans Top 10

[StressedEd]

Of course I could read other posts before hitting "Reply", as mentioned in another thread:
bash completion
is a good start.

Not The FP

[jo42]

man and vi

Seriously.

Vim and regex

[sielwolf]

That's all ya need ;p

Doom...

[lordbry]

As admin tool.

http://www.cs.unm.edu/~dlchao/flake/doom/

In a word

[Camel Pilot]

"What tools do you use that make your admin responsibilities easier or more automated on the Linux platform"

Perl is your friend

Re:In a word

[mike77]

Perl is your friend

my ass, perl is GOD

Re:In a word

[AvantLegion]

>> Perl is your friend

Well it sure doesn't act like it sometimes.

Hmm..

[wbav]

Most of the pc's I see are windows, so I'd have to say my most used tool is fdisk.

Knoppix is a nice solution too when I don't have time.

Computer Management..

[bdigit]

I use Computer Management. It's located under Administrative Tools in the Control Panel. It's really great for... wait a minute... looks around... wrong site...

takes a couple steps back...

Re:Add tool name here - once.

[AkaXakA]

PHPMyAdmin

Make your life easier...

[MadWicKdWire]

My at least top 4...

grep
gawk
xargs
for

CVS (or insert your favorite alternative here)

[-dsr-]

CVS or your favorite equivalent is vital in any multi-sysadmin environment. Operating without your configurations in CVS is like juggling priceless eggs in variable gravity.

Hmmmmm.

[eigerface]

Emacs! No, vi! No, Arrrrrrgh!

Re:Hmmmmm.

[Tezkah]

You forgot about ed!

Computer Scientists love ed, not just because it comes first alphabetically, but because it's the standard. Everyone else loves ed because it's ED!

"Ed is the standard text editor."

And ed doesn't waste space on my Timex Sinclair. Just look:

- -rwxr-xr-x 1 root 24 Oct 29 1929 /bin/ed
- -rwxr-xr-t 4 root 1310720 Jan 1 1970 /usr/ucb/vi
- -rwxr-xr-x 1 root 5.89824e37 Oct 22 1990 /usr/bin/emacs

Of course, on the system *I* administrate, vi is symlinked to ed. Emacs has been replaced by a shell script which 1) Generates a syslog
message at level LOG_EMERG; 2) reduces the user's disk quota by 100K; and 3) RUNS ED!!!!!!

"Ed is the standard text editor."

Let's look at a typical novice's session with the mighty ed:

golem> ed
?
help
?
?
?
quit
?
exit
?
bye
?
he llo?
?
eat flaming death
?
^C
?
^C
?
^D
?

- ---
Note the consistent user interface and error reportage. Ed is generous enough to flag errors, yet prudent enough not to overwhelm the novice with verbosity.

"Ed is the standard text editor."

Ed, the greatest WYGIWYG editor of all.

ED IS THE TRUE PATH TO NIRVANA! ED HAS BEEN THE CHOICE OF EDUCATED AND IGNORANT ALIKE FOR CENTURIES! ED WILL NOT CORRUPT YOUR PRECIOUS
BODILY FLUIDS!! ED IS THE STANDARD TEXT EDITOR! ED MAKES THE SUN SHINE AND THE BIRDS SING AND THE GRASS GREEN!!

When I use an editor, I don't want eight extra KILOBYTES of worthless help screens and cursor positioning code! I just want an EDitor!! Not a "viitor". Not a "emacsitor". Those aren't even WORDS!!!! ED! ED! ED IS THE STANDARD!!!
TEXT EDITOR.

When IBM, in its ever-present omnipotence, needed to base their "edlin" on a UNIX standard, did they mimic vi? No. Emacs? Surely you jest. They chose the most karmic editor of all. The standard.

Ed is for those who can *remember* what they are working on. If you are an idiot, you should use Emacs. If you are an Emacs, you should not be vi. If you use ED, you are on THE PATH TO REDEMPTION. THE SO-CALLED "VISUAL" EDITORS HAVE BEEN PLACED HERE BY ED TO TEMPT THE FAITHLESS. DO NOT GIVE IN!!! THE MIGHTY ED HAS SPOKEN!!!

?

Re:Hmmmmm.

[DarkHelmet]

Pico: A choice that will piss both sides off equally.

Re:Hmmmmm.

[Skald]

Emacs! No, vi! No, Arrrrrrgh!

While Emacs may be your Top Ten Configuration Tools, I'm pretty sure Vi only counts as one. :-)

Re:Hmmmmm.

[override11]

Ed is teh suck, Notepad rules!

N073P@D OWNZ JOO!

Re:Hmmmmm.

[hawaiian717]

You obviously don't know what a real text editor is capable of.

Editing text files?

CSSH

[olympus_coder]

Run all the servers (or lab gentoo boxes) at once. Great for mass updates,testing, etc.

Source Forge Page

Tripwire

[nharmon]

Tripwire is a very easy to use intrustion detection system. If you follow the documentation, and implement it properly (storing the statically linked binary + database files on read-only media), it will make things very hard on a potential hacker.

Re:Tripwire

[challahc]

AIDE is good too. I think tripwire is only open source if you get the academic source release. AIDE is open source.

Re:Tripwire

[EvilAlien]

Tripwire != IDS

Tripwire is a file integrity auditing tool to ensure that files that should remain static do in fact remain static.

I would have to say that the top of any config tool list will have to be $favoritetexteditor. Each distribution is going to have a number of tools, both text and GUI, but the text editior rules *NIX when it comes down to indispensible configuration tools. Webwin deserves to be on the list just because it is a non-distro specific config tool... I personally don't use it, but lots of people do.

Otherwise, toss YaST, redhat/fedora-config-foo, drakfoo, etc-update, and so on to the list.

If the list was to be extended beyond Linux, the AIX people out there would probable love to see smitty on there.

/bin/bash

[llywelynelysium]

What good are all your commands with no shell? ? ?

BIND

[TheRealMindChild]

I would really love a nice BIND configuration utility. Something where a whole package like webmin isnt necessary, but it makes life a whole lot easier. Redhats bindconf/redhat-bind-config was nice once upon a time, but getting it to run on anything but redhat requires about 2 gigs worth of obscure dependancies... I want something I can throw on say, a slackware machine, and it just go.

Even better would be something that also tied into dhcpd (these are the ISC daemons Im talking about, folks), that would serve to configuring them both, even on working together in a ddns/dhcp setup.

Cfengine: It's all you need

[kognate]

cfengine (http://www.cfengine.org) is
the best automation tool for unix and unix-like
environments. Hands down.

It's a little hard to configure sometimes, but
worth the effort.

Re:Cfengine: It's all you need

[dannyrap]

I wholeheartedly agree. A combination of cfengine and cvs makes maintaining hordes of systems SO much easier. You can start thinking of a server in terms of +cvsserver +dnsserver +mailclient +kerberosclient and know that the right sets of configuration files will get on each machine. It is a steep learning curve to get it going. You'll have to pretty much lock yourself in the server room for a couple of days. But you'll gain the time back easily within a couple of months.

We use this in combination with OS autoinstallation scripts to deploy new servers really quickly. Autoinstall to get a base OS on. A few minutes to get hostname/IP right. Cfengine to blast the right packages and config files. Voila...working dns server, or web server, etc.

Danny

Tim.

[geekoid]

It's easy to use, I just pick up the phone, ask Tim to fix this Linux thing.
Easy-peasy.
Or I just do what Vigor tells me to do.

RCS and Bastille-Linux

[mrhandstand]

Bastille after I have the server built. The interactive mode also provides a great security tutorial.

RCS to provide rollback and change control.

No professionally administered Linux box should be without it.

I've been using Ruby for little utilities...

[tcopeland]

...to help maintain various GForge systems.

Nothing fancy, just twiddling configuration files (httpd.conf, etc), pushing data into a PostgreSQL database, automating StatCVS runs, etc. I keep them in CVS, of course, here.

Several points of view....

[gmuslera]

... the most important tool is the brain :) As an admin, whatever you do, if you don't think enough on it you deserve what could happen.

As "admin suite", i.e. a single program to do a lot of administrative tasks, maybe YaST could be a good start. I'm not use webmin, tried it some years ago and don't liked the idea, but could be useful for a lot of people too.

And about individual tools, well, bash, vi, perl, mc, awk, the gnu text/file/shell utilities (cat, grep, ls, cut, chmod, etc) are essential.

Last but not least, a "tool" is also something that help you to use what you have available already. Man pages, the HOWTO collection, a lot of O'Reilly books, and Google are examples of that kind of tools.

Re:The one true Text Editor!

[alexborges]

Vi user 1: KILL THE TROLL

Vi user 2: Mesmerize this so-called-pico-mesiah

Slashdot winfiend1: I for one....

Slashdot winfiend2: Imagine a ....

Emacs user 1: Damn, the vimers beat us to the hangin!... we cant say kill him, they already did...

Emacs user 2: Its Gnu-Pic.... oh wait...

sudo, screen

[raddan]

sudo!

Learn it in detail. If you work with other people on the same machine, it will make your life a lot easier.

screen is pretty handy, too. Being able to detach sessions is also nice for when you've started sprouting icycles from your nostrils from the cold, cold server room.

It also has to be said...

[hndrcks]

...when you have portaged the very latest version and compiled it from source for your processor and architecture... it still isn't configured.

...which I believe is what this poll is about. Top Ten Configuration Tools.

My Top 10:

[Punk Walrus]

Your needs may vary...

• vi - Yeah, yeah... vi and emacs wars. I started with vi on a Sun system in 1989, and so it's what I like.
• ifconfig - Without it, you're kind of lost, at least on the network.
• testparm - I use a lot of Samba at work, and this is a great tool for checking what I screwed up in my smb.conf in vi!
• man -k - Okay, what I want to do starts with...?
• grep - Great trying to find that paramenter you want to change in httpd. or squid.conf. Even better, "grep -v '#'" to weed out all those comments...
• tail -f - Great for keeping track of logs realtime in a vtty or xterm window. Like tail -f /var/log/messages
• crontab -e - For keeping stuff on schedule.

That's all I can think of now. I'll think of others later.

Dang!

[itwerx]

I can't believe with all these posts that the only one(s) that actually respond to the question are about Webmin!
Don't get me wrong, Webmin is great, it's at the top of my list fer shure, but that's not the be-all and end-all of systems management!! What about actual convenient tools like MRTG, Novell's eDirectory, RedCarpet, etc. etc.?
Heck, I'm reading this article hoping to pick up a few tips myself and all I'm seeing are scripting languages and text-editor flame wars, (all of which can/should be moderated Off-topic or Funny).
So, anybody actually got anything useful to contribute besides Webmin?

Re:Dang!

[lspd]

Don't get me wrong, Webmin is great, it's at the top of my list fer shure, but that's not the be-all and end-all of systems management!! What about actual convenient tools like MRTG, Novell's eDirectory, RedCarpet, etc. etc.?

Huh? I'm not that familiar with eDirectory or RedCarpet, but MRTG isn't an all in one configuration interface like webmin. I though the only webmin alternatives were commercial products like:

Ensim
Plesk
Cpanel

Are there free software uber-configuration products other than Webmin? I tend to stick to the command line over ssh myself.

Re:Dang!

[Anonymous Coward]

Here are some very good tools IMHO.

nagios - monitor remote server, setup notifications via email, pager, etc. Comes with many plugins to monitor specific thins like disk usage or ports.

ganglia - sort of like mrtg geared towards clusters.
Very easy to setup but requires multicast communication between nodes.
You can see one here
http://wulf.chem.valdosta.edu:8000/ganglia/

Kerberos and OpenLDAP - if you ever need to maintain a large number of machines sharing common authentication. Kerberos enabled SSH is a great way to avoid typing passwords or sharing key for passwordless authentication.

Systemimager - if you have many machine sharing common configuration (like corporate network or server farm) this is absolutely a must. Very easy to configure and use. Images that systemimager create can be chrooted to just like regular systems. Creating image, updating image, updating machines is very easy and fast.

Finally Debian is the best tool (and a distro) for maintaining a stable, reliable Linux system that does not get in your way like YAST or other "candy " tools. While Debian is a bit harder to get used to then GUI-centric distros like Fedora and SuSe, the benefit of learning Debian is great if you are serious about Linux.

Re:Dang!

[ahaning]

nmap
ethereal/tcpdump
I've also heard that nessus is nice to use.
And, I've just remembered, google.

But, really, it doesn't seem like it would be easy to have a Linux Sysadmin's Toolkit CD where you could run programs on a live system (rather than boot into another one like with Knoppix) due to the different systems out there using different distros with different file tree structures and different versions of [g]libc.

Also, most of the tools are so simplistic that it's hardly worth mentioning them. Need to reset a root password and you don't know the current one? Mount the filesystem and edit /etc/shadow. Most things are done using simple tools, rather than complicated applications.

Also, FWIW, screen is likely very useful to many admins. I just find it useful for keeping terminals available without cluttering up my desktop. An added benefit is that I can ssh in from elsewhere and work with them from there, too. I've wanted for a while to fiddle with ratpoison to get a similar effect for X programs.

Re:Shouldn't you be asking

[Sivar]

"Ed is the standard text editor."

And ed doesn't waste space on my Timex Sinclair. Just look:

-rwxr-xr-x 1 root 24 Oct 29 1929 /bin/ed
-rwxr-xr-t 4 root 1310720 Jan 1 1970 /usr/ucb/vi
-rwxr-xr-x 1 root 5.89824e37 Oct 22 1990 /usr/bin/emacs

Of course, on the system *I* administrate, vi is symlinked to ed.
Emacs has been replaced by a shell script which 1) Generates a syslog
message at level LOG_EMERG; 2) reduces the user's disk quota by 100K;
and 3) RUNS ED!!!!!!

"Ed is the standard text editor."

Let's look at a typical novice's session with the mighty ed:

golem$ ed

?
help
?
?
?
quit
?
exit
?
bye
?
hell o?
?
eat flaming death
?
^C
?
^C
?
^D
?

---
Note the consistent user interface and error reportage. Ed is
generous enough to flag errors, yet prudent enough not to overwhelm
the novice with verbosity.

"Ed is the standard text editor."

Ed, the greatest WYGIWYG editor of all.

Re:CVS (or insert your favorite alternative here)

[hackstraw]

Also, it kills me to see *NIX people still using passwords all the damn time. CVS + ssh keys = godlike.

Things I do. syslog to a common place. I have cloning scripts to dup a machine to a basic setup (poor mans jumpstart but faster and easier).

Perl and sed come in handy. Rsync (again with ssh keys) is good.

Oh yeah, /usr/local over nfs is good too. The only issue is that you may have to configure some packages to use a local filesystem for configuration files, keys, etc.

With these tips and tricks I can do whatever I need to do over a dialup connection anywhere in the world (I've only tested this from coast to coast in the US thought, but I believe it will scale worlwide :)

The ultimate server admin tool

[lspd]

netstat -nlp

Turn off all the services you don't need.

My 10

[thenextpresident]

vim
sudo
apt-get
wget
rsync
ssh
ps
php
per l
make

Perl, vi and cron

[kevin_conaway]

vi for editing perl.
vi for adding perl scripts into crontab.

theres not much else to do

SSH.

[Olinator]

Don't know if this is quite what you were looking for, but it's the first thing that popped into my mind...
There are four of us who do *nix admin for over 600 *nix machines, more than half of which are linux boxes (both workstations and servers.) SSH with X displayback on a 100Mbit switched network is such a godsend I can't even begin to imagine life without it. I probably generate more SSH sessions in a normal workday than I do HTTP sessions. (Yes, that does include /. reloads, why do you ask? :-)

I also think it's well worth your while to understand SSH's more esoteric tunneling capabilities... Recently I had to support a research group who was doing a demo at JPL and they were behind a very restrictive firewall but needed to do control and image transfer from a robot framework here in Massachusetts, and the researchers who'd coded the software hadn't implemented any kind of authentication layer. We were able to do everything using SSH tunneling over one of the three ports allowed through JPL's firewall (and they could IMAP their mail from our servers as a side bonus) without exposing our servers or JPL to unencrypted protocols of any kind.

Ole

Re:SSH.

[codepunk]

Hey you cannot possibly admin 600 machines with 4 guys, Microsoft said so!

I was thinking the same thing, I have active ssh connections to servers nearly around the clock.

Ever notice...

[davidej]

how boring it gets wading through all the posters trying to be clever..?

Re:CVS (or insert your favorite alternative here)

[Dezer]

It's all about subversion . Quite mature - can import former CVS collections, too.

Command line

[kbahey]

Whatever runs from the bash command line is good enough for me.

No bloated fancy GUI needed, can run remotely over a secure ssh connection, and has all the raw power you need.

I am not a luddite. For some tasks, I will use the GUI tool (e.g. Mandrake Control Center, or Webmin) to do things, when it is faster to do so. But the bulk of what I do is command line.

A tendency toward self improvement

[delcielo]

Seriously, you need to have a drive to constantly learn more. That's more valuable than any pre-written config tool out there.

I know that's not what you wanted; but it's really true. A desire to constantly increase your own knowledge is paramount.

My List

[np_bernstein]

1. Nagios: monitors your servers/services, amails, pages, sends a carrier pigeon when one goes down.

2. Logwatch: Logwatch is something that should be used by every Unix/Linux SA everywhere. It gives you a daily snapshot of events in your logs

3. Mon: Nice, simple, easy. If your webserver goes down, your secondary can bring up a virtual ip a couple of seconds later. No more annoying three am phone calls

4. Snort/ACID: lets me know if a virus breaks out, or if there are stupid script kiddies trying to brute force their way in.

5. Nessus: run it early, run it often. Figure out any holes you have in your security, and make sure you fix them.

There's more, but you should really do some of your own homework.

Re:CVS (or insert your favorite alternative here)

[zeromemory]

> CVS + ssh keys = godlike.

Until someone steals your ssh key. Then they will be godlike too.

Sure, ssh keys are convenient, but they don't always replace passwords.

Radmind

[jonpublic]

we at the university of michigan use radmind to update and deploy software to our linux environment. it is a great tool that helps us centrally manage our environment and rapidly deploy security updates. update one machine, take a snapshot of the differences, and push it out to 50 machines or more. command line freaks will love it.

learn more at radmind.org

Actually...

[IronChefMorimoto]

To configure Linux, I refer to the Windows XP blue CD-ROM boot screen AFTER I give up on installing Linux.

Dammit. I hate being a Linux virgin. Or does a semi-successful installation of Mandrake Linux 8.x on a Dell laptop count? No? Still got the Linux cherry? DAMMIT!

IronChefMorimoto

Re:Actually...

[sharkey]

I hate being a Linux virgin.

You're preaching to the choir. Or did you mean that you're new to using/installing Linux?

just basic tools...

[Siva]

"Kill zcat," sed ed.
"Awk!" sed perl.
"Make sum nice tee, joe," sed man.

Single machine or multiple machines?

[ComputerSlicer23]

I've always like the "redhat-config" series of tools on RedHat or RedHat derived products.

• chkconfig and service are valuable for doing things.
• yum, apt, autorpm are all nice tools.
• logwatch is great.
• PAM isn't an application, but using PAM and LDAP can make having users spread across machines is a snap.
• tripwire is a great tool
• kickstart does wonders if you have to install lots of machines. I use it to completely document every scriptable part of an install.
• WebMin is great, but it worries me from a security perspective.
• gq is a great LDAP editor that I use to edit LDAP entries for users.
• Software like Bastielle Linux (a script that attempts to harden a machine)
• iptables, iproute2 (including ip and tc) are wonderful for networking.
• cron, sh, sed, awk, perl and python are used in conjunction quite a bit.
• fuser and lsof are used frequently by to to figure out what is going on.
• ethereal and tcpdump are tools of the gods.
• ssh is a thing of beauty.
• encrypted swap is fun.
• Nagios, MRTG, and sar are very useful for profiling and monitoring of your machines.

Who exactly is your target audience? People who've never seen UNIX, people who've worked on UNIX environment for years? What is it you are attempting to accomplish with them?

Most of my list would be boring to people who know a lot about UNIX, however some of them are Linux specific.

Re:Single machine or multiple machines?

[ComputerSlicer23]

http://www.flyn.org/projects/cryptoswap/index.html

Googling around, that's the best link I've seen, but it's relatively short. I haven't looked into in about a year. There is a patch to mount that will allow you to use let you setup cryptoloop (the loopback block device with encryption built in). The maintainer of mount (Andries Bouwer), however wouldn't accept the patch for some legalistic reasons (copyright and/or encryption, I've forgotten the details). Try "man losetup" for information on how to get crypto loop working.

What you do, is have no swap partition, then at the end of the bootup sequence run losetup to setup loopback encryption to either a file or a partition. Then initialize the swap file or partition using mkswap, then swapon /dev/loop0 (or whatever loop device you used).

So something like this:

losetup -e DES /dev/loop0 /tmp/swapfile mkswap /dev/loop0 swapon /dev/loop0 However, I can't seem to get that working, as my RHEL doesn't have DES as a modules, and losetup doesn't support AES yet. So there's probably a kernel patch to track down. However, it sounds like Mandrake supports this out of the box.

Finally, I'm not much of a 2.6 user, what I described above will work in 2.4. 2.6 I believe either has in the main tree, or it's coming "Real Soon Now", a feature called dm-crypt. dm stands for device mapper. It's the low level replacement for the guts of LVM from the 2.4 kernel. It sounds like a layered/plugin type feature, one of which you can put LVM on top of. Some clever fellows decide to put crypto on top of it. I don't know a thing about that, and have never used it. However, search for dm-crypto in google, here's the most useful page I found in a single query:

http://www.saout.de/misc/dm-crypt/

Good luck.

Kirby

MOD PARENT DOWN

[Anonymous Coward]

Plagiarism isn't cool. the original post

Computer Management ?

[mailtomomo]

Is it like Anger management ?

Re:More or Less ?

[tntguy]

"more", in its "standard" *NIX form, is forward-scroll only, among many other limitations. "less" takes care of all those limitations. Think if it as "less" is "vi" and "more" is "ex" (or "edlin", from the DOS days if you're unfamiliar with ancient tools).

Re:CVS (or insert your favorite alternative here)

[hackstraw]

Until someone steals your ssh key. Then they will be godlike too.

Sure, ssh keys are convenient, but they don't always replace passwords.

Passwords suck. Oh, and I have a 10 character passphrase on my privatekey that sits on my password protected computer.

I would guestimate that the liklihood that a password has been found or guessed or shown up in a plain text file (my ISP used to have a world readable radius logfile that had passwords in it) or sniffed is much greater than someone logging into my laptop (I have no remote services running) or physically beating me up and getting my key and passphrase from me.

I love the classic:

sj (misstyped su)

followed by the root password in plaintext. Gotta love that!

My Top Ten

[genkael]

1) Yast (I know it's SuSE centric, but it's being open sourced!)
2) OpenSSH... Oh yeah baby!
3) GCC and make... DUH!
4) FTP...I know I know SFTP if you prefer
5) Perl...YUM and even better with perl expect
6) Bash...we all need a CLI
7) Jumpstart...If you manage a lot of solaris boxes, this is your friend
8) Sendmail or postfix...pick your poison
9) nmap...oh yeah, let the Windows guys drool
10) Nagios...monitor that network in style!

Your question is flawed, thus you have no answers.

[moorley]

UN*X/Linux doesn't work that way. You are looking for a one size fits all administrative interface and it doesn't exist.

But I can sum up some the key points and bits of wisdom I have picked up over the years.

1) Ascii text is your friend. 98% of all the configuration files for UN*X programs live in ascii files and they "usually" live in /etc. You can use this to write program to update different pieces as needed. Any problem you do, you can undo. You can then run a program or use "kill -HUP" to get a process to reread that configuration.

2) Pick a programming language. Perl, AWK, Sed, ksh, all of them. You can use that programming language to role out changes as needed, or make a lot of changes really quickly. RSH/SSH allows you to do that across multiple systems. Use it carefully!

3) Design your environment. If you know what you are going to be using the servers, workstations and/or Linux embedded appliances for you can better decide how to automate it.

4)"Crunchy Cookie, Liquid Center".
In the end you will be automating certain administrative tasks over and over, but not all of them. That's why one size fits all won't work. It becomes a bloated security hole, so you only automate what you need and you automate it in an original and secure fashion.

As for some rock solid TLA recommendations.

SSH - SSH is your friend and as a replacement for RSH and its ilk you can use it to securely automate tasks. read up on ssh-agent for automating ssh access across multiple machines.

mon - How do you know it's working if you don't test it? You need to turn on monitoring, the more specific the test and monitor the better. mon is a good PERL framework for performing any test, and it has a lot of prepackaged/contributed test scripts that come in handy.

LDAP - Lots of UN*X environments are moving to LDAP to store enterprise wide information. It depends on how big of a UN*X environment you are setting up but having a centralized directory ala LDAP can be quite handy.

PAM/NIS - Plug In Authentication Modules. You can use these to have a centralized authentication server, cuts down on password updates. NIS+ is a tried and true system for stitching UNIX Systems together but I've only seen it installed in 1 UN*X environment and I've worked in several.

If you are looking for a prebuilt system or paradigm like Microsoft Server then you need to look to Redhat, Debian, else you are going to work from the need/application outwards.

Whatever you do more than once you will automate. When you no longer can budget the amount of UN*X Admins you will need you will start to build "tools" to delegate routine tasks, these will eventually become web pages, the web page will become an application. The application will become an acronym. The acronym will become a skill. The skill will become a job requirement HR will use to backfill a position. That's the way it goes.

Enjoy!

WRONG QUESTION

[nusratt]

Ask for the Top Ten tools, and most of your time spent reading the responses will be wasted, because of the overlap of the answers. If people list what they *genuinely* think are the Top Ten, there will be very few answers which are unusual or surprising (and still useful).

I think it would more useful to ask for the Top Ten MOST OVERLOOKED tools, or the most under-used, the most mis-used, or the ones whose full power is forgotten, unrecognized, or unused.

Re:More or Less ?

[LinuxHam]

and the console spits out junk until you close that shell.

Just so you know, when you accidentally cat a binary file and it changes all the letters in your console to garbage characters, just blindly type

reset

and hit Enter. Fixes it every time.

Blbbbbph.....

[Dr. Evil]

If Perl is God, then nobody would be able to understand the bible.

... oh wait.

Pico, you dick mods.

[teamhasnoi]

WTF? I can't have Pico as my #1?

When I don't have time to figure out goddamn control chars, and just want to edit a config file without having to resort to IRC, man pages, and poor documentation -

I USE FUCKING PICO.

All the commands are right there. On the screen.

Maybe this elitist attitude is why Linux isn't ready for the desktop. Now mod me Troll, bitches.

Make a list as you go

[taradfong]

To me, *nix mastery involves learning a bunch of little tricks. There is no 'grand unified front end' that will do it all. Over time, you'll memorize the ones you use all the time. But some you'll figure out but forget if you don't write them down somewhere (e.g., how to do a 'find' with regular expressions and execute a command on each result). I keep mine in a wiki, a bit haphazzard, but always ready on the web and easy to edit, which means you'll use it.

Oh yeah, learn regular expressions. The O'Reilly book is great. The time investment *will* pay off.

Keychain

[YetAnotherDave]

I regularly access dozens of *nix systems (mostly linux & solaris). I love the fact that I can enter my privatekey password once on booting my laptop, and then have a tool handle all the ssh-agents in subsequent sessions. Entering one (very long and tangled :) password once is so much nicer than having to enter passwords every time I connect to a new system...

http://www.gentoo.org/proj/en/keychain.xml

Also, (obligatory) perl is great and larry wall is my hero...

RPM

[Nailer]

RPM records the MD5sum, change time, permissions, and a bunch of other stuff on every file it installs.

This is saved into the RPM database in /var/lib/rpm.

You can use RPM as an IDS by backing up the database to a read-only media and then use, for example:

rpm -V coreutils procps net-tools --dbpath /mnt/cdrom

To see if someone's installed a root kit (if someone has, they'll have to at least modify top, ps, and netstat, which are included in these packages).

Unlike tripwire, you're not forever having to update policy files.

/bin/sash

[greydmiyu]

What good is your shell without commands? :P

*drake

[MicroBerto]

OK, nobody is posting good config tools except for webmin. Even I am guilty as I first posted rkhunter.

If you look at Mandrake, there's tons of great config tools there:

diskdrake for disk partitioning

harddrake for hardware configuration

userdrake for user configging (or userconf)

XFdrake for X config

mousedrake for mouse config

printerdrake absolutely rules for CUPS, better than localhost:631 if you ask me

drakconf for ALL mandrake tools together

rpmdrake is good for package managing...

Oh and of course linuxconf is still nice! netconf is the network partition of that I think. The list goes on i bet

Ahem

[sparkz]

Good for you, though it's probably not a great idea to name customers on a public forum like this. Advertising "JPL have exactly 3 open ports on their firewall" isn't the kind of thing they'd necessarily choose to air in public. Just my 2p,

Re:Ahem

[Olinator]

1. They have more than one firewall, and I didn't name the subunit of JPL.
2. those are outgoing ports, so that's useful information only if you're already on the inside...

Ole

make + cfengine + cvs + LDAP

[MrChuck]

You don't admin a domain with "vi" [where by vi I mean all editors].

• Task: Add this printer to 200 machines. You have 5 different un*xes (and different versions of each of those around).
• We need to change the sudo file on 200 servers.
  no, nfs is not used
• Update /etc/mail/access on 6 machines in 4 locations (and 3 continents). Oh, we forgot this, do it again.
• Make sure $THIS is in the sybase's crontab on all the sybase server.
• Patch all the Solaris 7 machines with this new patch cluster. It's urgent. (and we have 50 of those machines scattered around the world).
• Change the (locally stored) root password on all the machines we take care of because X just got fired, but we couldn't tell you till now).
• Rebuild the 2 HA database servers (one at a time) and make sure they have the current patches and access to the new partitions on the SAN

vi! webmin. heh.

My partner took the Solaris Advanced Certification tests (someone else was paying and what the hell). She screwed up the parts about AdminTool. Someone who'd been using Unix since the 80s. She came home raging: AdminTool!! If I ever hired a senior admin and they kicked up admin tool, I'd fire them before the windows finished opening.

I find these single machine solutions quite quaint.

No, I'm delighted to have my cfengine scripts that go through /etc/ and make sure that inetd.conf is stripped, and that rpcbind and nfs aren't running on standalone servers and that the Right Stuff is in the Right Config files and that permissions are correct.

Best part is that I can run it again anytime later to redo that (or with '-n' to just show me what's changed).

And if it uses CVS to pull down $Today's configs, then so be it.

Re:make + cfengine + cvs + LDAP

[cashcraft]

Webmin can really screw you up though. I tried to use it on a Cobalt (old sun) server, and it totally messed the server up.

Personally, I say that there is nothing better than a command line, your favorite text editor and Google (or any other searh engine to find answers). cfengine does sound nice, though.

But, for those of you who dislike the command line, Linuxconf, http://www.solucorp.qc.ca/linuxconf/ works nicley for me under redhat and cobalt 5.

And, for automation, what would we do without cron and at?

An experienced system's administrator

[macdaddy]

Seriously, that's the number one configuration tool you could possibly own. It always baffles me how many "Technology Coordinators" or other official IT guys know jack (or less!) about systems administration. These are the type of people you'd never consider giving root to on a server you administer. These are the type of people that don't understand why a server that's a month old would need to have patches and other updates done on any of the hundreds of packages that run on it. (I ran into this comment again just the other day by an "admin") Hands down the best tool available on the market today for Linux system configuration is a half-assed decent administrator. That's one area where you can't afford to be a cheapskate.

I second cfengine

[kaybee]

Admitedly when I started writing my book (Automating UNIX and Linux Administration) I had barely used cfengine and it was going to be just a small part of my book, but it turned out that I liked it so much that it became one of the major focuses in the book.

I think that even with as few as 5 systems it is worth the effort... especially if the systems are largely similar.

Re:No, no! (nano nano) nanoo nanoo

[ReNeGaDe75]

Nano also doesn't depend on any major packages. Pico is part of pine. And I don't want to install an entire email client that I will NEVER use (and have heard terrible things about) just to use a text editor. Nano works out of the box.

I've also heard nano is a smaller executable and runs much faster. I haven't really tested that, however.

Interesting poem, but...

[jonadab]

> A is for awk, which runs like a snail
Yeah, these days we use Perl for that stuff.
> B is for biff, which reads all your mail
Emacs/Gnus takes care of this, thanks. (Yeah, I know that's not really
what biff does, but hey, it's what the poem says.)
> C is for cc, as hackers recall
C is for nursing along old legacy code that hasn't had the good graces to be
rewritten in a real language yet; for new stuff we use high-level languages.
> D is for dd, the command that does all
I must admit that this one is still handy from time to time...
> E is for emacs, which rebinds your keys
Can't live without that...
> F is for fsck, which rebuilds your trees
One word: journaling.
> G is for grep, a clever detective
I admit I still occasionally use this, but Perl's regexen are more powerful.
> H is for halt, which may seem defective
I usually use shutdown or init when I need to do hardware maintenance.
> I is for indent, which rarely amuses
Emacs does this automatically, of course. Has for years.
> J is for join, which nobody uses
Indeed, what does it even do? From a quick look at the man page, it looks
at first glance like a Perl one-liner, give or take a dozen strokes.
> K is for kill, which makes you the boss
I do still use this sometimes.
> L is for lex, which is missing from DOS
Isn't that one of those C things? Its days are numbered.
> M is for more, from which less was begot
With eshell (the Emacs shell), there's no need for a pager any longer.
This letter should now go to man, IMO.
> N is for nice, which really is not
Here's another one I must admit to using occasionally. Also renice.
> O is for od, which prints out things nice
I had to use man to even find out what this does, and then it turns out
to be something I'd almost never use, but if I did need that functionality,
I could do it in a Perl one-liner faster than look up the od manpage again.
> P is for passwd, which reads in strings twice
> Q is for quota, a Berkeley-type fable
Okay, those might still be relevant.
> R is for ranlib, for sorting a table
Definitely a Perl job, that.
> S is for spell, which attempts to belittle
Emacs has ispell/aspell integration these days.
> T is for true, which does very little
Indeed.
> U is for uniq, which is used after sort
Another thing we use Perl for in the modern era.
> V is for vi, which is hard to abort
If you really want vi (*WHY*?), Emacs has a version of it built in.
> W is for whoami, which tells you your name
If you need a program for that, commands aren't going to solve your problems.
> X is, well, X, of dubious fame
Emacs has better colors if you use X. 24-bit. Without it, 16 colors.
> Y is for yes, which makes an impression, and
I suppose...
> Z is for zcat, which handles compression
Most of us use either zip (or Archive::Zip) or gzip (or Zlib) for that now.
We'll say zip, because it starts with z and so won't screw up the poem any
worse than I already have ;-)

Re:Or sudo

[Nailer]

I think rm -rf / is right... [ra@gentoo ~] $ rm --help Usage: rm [OPTION]... FILE...

Yes, but rm FILE [OPTIONS] is much safer. Compare hitting enter to early when deleting a directory.

Man pages are generally unmaintained. Eg, man resolv.conf says the file is generally unnecessary as most machines have a DNS server installed on them.

That _is_ a consideration.

[Ayanami Rei]

And I would move to joe if I ever encountered a configuration file that contained anything but US-ASCII, which I have not.

And even if I did (let's say I was looking at a file with messages in multiple languages), nano won't munge the Unicode, it would just ignore it. I definitely wouldn't be using a terminal-based editor when entering text with extended character sets in a document.

Right.

[soccerisgod]

My 10 favorite linux configuration tools? Let's see:

• Left little finger
• Left ring finger
• Left middle finger
• Left index finger
• Left thumb
• Right little finger
• Right ring finger
• Right middle finger
• Right index finger
• Right thumb

Yapp, that sums it up nicely.

Re:More or Less ?

[vern0n]

you can also type 'tack' then q this is the way i fix it