Top Ten Linux Configuration Tools?

jman251 asks: "I am presenting at a conference in September on a couple of Linux-centric topics. One of these is a collection of tips, tricks, and tools for configuring, securing, and maintaining a Linux-based server. I have a short list of tools I use, but would like some community input on the subject. What tools do you use that make your admin responsibilities easier or more automated on the Linux platform?"

Comments

rm

[bobthemuse]

rm -rf /home

That'll teach those pesky users....

Re:rm

[Punk Walrus]

Only as root... and then you created them, so hush! :)

Re:rm

[geekoid]

you can't have users to torment, if you don't create any.

Re:rm

[Homology]

I used

$ chflags uchg /home/dude

So now "rm -fr /" won't work even as root as it will properly give you :

rm: /home/dude: Operation not permitted

So there you are, you pesky root of all evil. Oh bummer, now I can't make any new files in /home/dude ....

Webmin all the way

[tntguy]

Webmin. Grab Usermin while you're there.

Re:Webmin all the way

[desiderius7]

Amen to that. Being responsible for the administration of about 10 linux boxes that each provide a unique variety of services, Webmin has been invaluable. If I didn't have Webmin, all of my tasks performed through the shell would take about 10 times longer than they currently do from a browser that can lay out my options much more nicely. The key is to know/learn how to do what you want to do from the shell first, so that you have the understanding (and for emergencies), but to then use Webmin to boost your efficiency and help remind you of things that a blank console doesn't.

Re:Webmin all the way

[Anonymous Coward]

Webmin's all well and good for a few machines. But if you're employed maintaining 100s of machines, there are very few real and free options, and I don't personally think webmin is one of them, unless it's become much more scriptable than when I last checked.

cfengine works really well, but you don't appreciate its features until you hit the 70+ machine mark - the "trick" is that cfengine with it's inheritance and boolean class logic excels for systems that are different but have bits in common. Such different bits ALWAYS turn up with 70+ machines, simply because PC-class hardware's failure rate means something will have been changed on some machine somewhere at any given time. But if you've only got tens of machines runnning one OS rather than hundreds running five different OSes, it all seems like very hard work to set up your cfengine configuration files. The other "trick" is that cfengine is mostly multiuser and you can allow different users perform different actions, so when you've got a team of admins of different ability,
johnny-adds-visitor-laptops-to-vlan-17 just can't fuck up mordred-rules-production-database-servers-with-iro n-fist's work, yet _can_ have role-based limited admin abilities.

Dave Lettermans Top 10

[Anonymous Coward]

su
df
du
ls
rm
passwd
chown
vi
more
bash

Hey, you asked for it - No clicky links to read.

Re:Dave Lettermans Top 10

[hackstraw]

su -- better sudo keeps your root password better kept, does more logging, etc

more -- better less (Its not the 70s anymore people, you can search and go backwards in files since less first came about in the mid 80s. With the LESSOPEN varible set to something useful you can "browse" many, many filetypes too).

bash -- better zsh My shell can do anything your shell can do, but better!

Re:Dave Lettermans Top 10

[stevey]

I can logout, the process keeps running, and I can check on the progress later from another location.

Whilst you are correct this works for non-interactive processes, you can't use nohup to keep a copy of say, Lynx, running when you logout. Then return to it later and pick off where you left it.

Instead you should look at GNU Screen which allows this and more.

(It's essentially a windowing system for consoles, with the ability to detach and resume at will, and definately one of my top ten Unix utilities).

Here is one Screen tutorial which explains basic operation well.

Re:Dave Lettermans Top 10

[hackstraw]

what are the advatages of zsh over bash

1) programable tab completion - yes folks there is more to tab completion besides beeping all the time. When I hit cd fooTAB the list of completions only shows _directories_ beginning with foo

2) sane invocation - zsh is the only shell that has one file that is sourced _on all invocations of the shell_ so you can do stuff like have a consistant PATH and other env stuff

3) global aliases - zsh provides an alias that works _anywhere on the commandline_ I have 'G' mapped to '| grep -i', I have 'L' mapped to '| less' and 'vi' mapped to 'vim' (why? So sudo vi FILE gives me vim if the system has vim), etc, etc

4) the only shell that supports working 'vi' style history editing

5) multiple commandline commands are not rewritten as commands with ';' in them (what I typed is what I get, see 4)

6) too many features to name. Like I said, my shell can do anything your shell can do, but better.

Re:Dave Lettermans Top 10

[Rei]

I'm reminded a bit of the ABCs of UNIX here...

A is for awk, which runs like a snail
B is for biff, which reads all your mail
C is for cc, as hackers recall
D is for dd, the command that does all
E is for emacs, which rebinds your keys
F is for fsck, which rebuilds your trees
G is for grep, a clever detective
H is for halt, which may seem defective
I is for indent, which rarely amuses
J is for join, which nobody uses
K is for kill, which makes you the boss
L is for lex, which is missing from DOS
M is for more, from which less was begot
N is for nice, which really is not
O is for od, which prints out things nice
P is for passwd, which reads in strings twice
Q is for quota, a Berkeley-type fable
R is for ranlib, for sorting a table
S is for spell, which attempts to belittle
T is for true, which does very little
U is for uniq, which is used after sort
V is for vi, which is hard to abort
W is for whoami, which tells you your name
X is, well, X, of dubious fame
Y is for yes, which makes an impression, and
Z is for zcat, which handles compression

Re:Dave Lettermans Top 10

[Matt Perry]

1) programable tab completion

Bash has programable tab completion. In fact, you should check out the Bash Programmable Completion package if you are a bash user. That contains a bunch of completions for commonly used commands and their options.

5) multiple commandline commands are not rewritten as commands with ';' in them (what I typed is what I get, see 4)

That's the default in bash, too. If you aren't getting that behaviour it's because you turned the cmdhist option on (or your distro did). "shopt -u cmdhist" will turn that back off.

Not The FP

[jo42]

man and vi

Seriously.

Doom...

[lordbry]

As admin tool.

http://www.cs.unm.edu/~dlchao/flake/doom/

In a word

[Camel Pilot]

"What tools do you use that make your admin responsibilities easier or more automated on the Linux platform"

Perl is your friend

Re:In a word

[mike77]

Perl is your friend

my ass, perl is GOD

Re:In a word

[AvantLegion]

>> Perl is your friend

Well it sure doesn't act like it sometimes.

Hmm..

[wbav]

Most of the pc's I see are windows, so I'd have to say my most used tool is fdisk.

Knoppix is a nice solution too when I don't have time.

Computer Management..

[bdigit]

I use Computer Management. It's located under Administrative Tools in the Control Panel. It's really great for... wait a minute... looks around... wrong site...

takes a couple steps back...

CVS (or insert your favorite alternative here)

[-dsr-]

CVS or your favorite equivalent is vital in any multi-sysadmin environment. Operating without your configurations in CVS is like juggling priceless eggs in variable gravity.

Hmmmmm.

[eigerface]

Emacs! No, vi! No, Arrrrrrgh!

Re:Hmmmmm.

[DarkHelmet]

Pico: A choice that will piss both sides off equally.

Re:Hmmmmm.

[Skald]

Emacs! No, vi! No, Arrrrrrgh!

While Emacs may be your Top Ten Configuration Tools, I'm pretty sure Vi only counts as one. :-)

Re:Hmmmmm.

[override11]

Ed is teh suck, Notepad rules!

N073P@D OWNZ JOO!

Re:Hmmmmm.

[hawaiian717]

You obviously don't know what a real text editor is capable of.

Editing text files?

Tripwire

[nharmon]

Tripwire is a very easy to use intrustion detection system. If you follow the documentation, and implement it properly (storing the statically linked binary + database files on read-only media), it will make things very hard on a potential hacker.

/bin/bash

[llywelynelysium]

What good are all your commands with no shell? ? ?

Cfengine: It's all you need

[kognate]

cfengine (http://www.cfengine.org) is
the best automation tool for unix and unix-like
environments. Hands down.

It's a little hard to configure sometimes, but
worth the effort.

Tim.

[geekoid]

It's easy to use, I just pick up the phone, ask Tim to fix this Linux thing.
Easy-peasy.
Or I just do what Vigor tells me to do.

Re:Webmin is nice

[John Hurliman]

I'd put Webmin on my #1 list for best Linux admin tools. phpmysql is probably second (or the postgresql equivalent), and all the necessary toolkit apps like nmap, ethereal, netcat, etc.

Several points of view....

[gmuslera]

... the most important tool is the brain :) As an admin, whatever you do, if you don't think enough on it you deserve what could happen.

As "admin suite", i.e. a single program to do a lot of administrative tasks, maybe YaST could be a good start. I'm not use webmin, tried it some years ago and don't liked the idea, but could be useful for a lot of people too.

And about individual tools, well, bash, vi, perl, mc, awk, the gnu text/file/shell utilities (cat, grep, ls, cut, chmod, etc) are essential.

Last but not least, a "tool" is also something that help you to use what you have available already. Man pages, the HOWTO collection, a lot of O'Reilly books, and Google are examples of that kind of tools.

Re:The one true Text Editor!

[alexborges]

Vi user 1: KILL THE TROLL

Vi user 2: Mesmerize this so-called-pico-mesiah

Slashdot winfiend1: I for one....

Slashdot winfiend2: Imagine a ....

Emacs user 1: Damn, the vimers beat us to the hangin!... we cant say kill him, they already did...

Emacs user 2: Its Gnu-Pic.... oh wait...

My Top 10:

[Punk Walrus]

Your needs may vary...

• vi - Yeah, yeah... vi and emacs wars. I started with vi on a Sun system in 1989, and so it's what I like.
• ifconfig - Without it, you're kind of lost, at least on the network.
• testparm - I use a lot of Samba at work, and this is a great tool for checking what I screwed up in my smb.conf in vi!
• man -k - Okay, what I want to do starts with...?
• grep - Great trying to find that paramenter you want to change in httpd. or squid.conf. Even better, "grep -v '#'" to weed out all those comments...
• tail -f - Great for keeping track of logs realtime in a vtty or xterm window. Like tail -f /var/log/messages
• crontab -e - For keeping stuff on schedule.

That's all I can think of now. I'll think of others later.

Dang!

[itwerx]

I can't believe with all these posts that the only one(s) that actually respond to the question are about Webmin!
Don't get me wrong, Webmin is great, it's at the top of my list fer shure, but that's not the be-all and end-all of systems management!! What about actual convenient tools like MRTG, Novell's eDirectory, RedCarpet, etc. etc.?
Heck, I'm reading this article hoping to pick up a few tips myself and all I'm seeing are scripting languages and text-editor flame wars, (all of which can/should be moderated Off-topic or Funny).
So, anybody actually got anything useful to contribute besides Webmin?

Re:Shouldn't you be asking

[Sivar]

"Ed is the standard text editor."

And ed doesn't waste space on my Timex Sinclair. Just look:

-rwxr-xr-x 1 root 24 Oct 29 1929 /bin/ed
-rwxr-xr-t 4 root 1310720 Jan 1 1970 /usr/ucb/vi
-rwxr-xr-x 1 root 5.89824e37 Oct 22 1990 /usr/bin/emacs

Of course, on the system *I* administrate, vi is symlinked to ed.
Emacs has been replaced by a shell script which 1) Generates a syslog
message at level LOG_EMERG; 2) reduces the user's disk quota by 100K;
and 3) RUNS ED!!!!!!

"Ed is the standard text editor."

Let's look at a typical novice's session with the mighty ed:

golem$ ed

?
help
?
?
?
quit
?
exit
?
bye
?
hell o?
?
eat flaming death
?
^C
?
^C
?
^D
?

---
Note the consistent user interface and error reportage. Ed is
generous enough to flag errors, yet prudent enough not to overwhelm
the novice with verbosity.

"Ed is the standard text editor."

Ed, the greatest WYGIWYG editor of all.

Re:CVS (or insert your favorite alternative here)

[hackstraw]

Also, it kills me to see *NIX people still using passwords all the damn time. CVS + ssh keys = godlike.

Things I do. syslog to a common place. I have cloning scripts to dup a machine to a basic setup (poor mans jumpstart but faster and easier).

Perl and sed come in handy. Rsync (again with ssh keys) is good.

Oh yeah, /usr/local over nfs is good too. The only issue is that you may have to configure some packages to use a local filesystem for configuration files, keys, etc.

With these tips and tricks I can do whatever I need to do over a dialup connection anywhere in the world (I've only tested this from coast to coast in the US thought, but I believe it will scale worlwide :)

SSH.

[Olinator]

Don't know if this is quite what you were looking for, but it's the first thing that popped into my mind...
There are four of us who do *nix admin for over 600 *nix machines, more than half of which are linux boxes (both workstations and servers.) SSH with X displayback on a 100Mbit switched network is such a godsend I can't even begin to imagine life without it. I probably generate more SSH sessions in a normal workday than I do HTTP sessions. (Yes, that does include /. reloads, why do you ask? :-)

I also think it's well worth your while to understand SSH's more esoteric tunneling capabilities... Recently I had to support a research group who was doing a demo at JPL and they were behind a very restrictive firewall but needed to do control and image transfer from a robot framework here in Massachusetts, and the researchers who'd coded the software hadn't implemented any kind of authentication layer. We were able to do everything using SSH tunneling over one of the three ports allowed through JPL's firewall (and they could IMAP their mail from our servers as a side bonus) without exposing our servers or JPL to unencrypted protocols of any kind.

Ole

Command line

[kbahey]

Whatever runs from the bash command line is good enough for me.

No bloated fancy GUI needed, can run remotely over a secure ssh connection, and has all the raw power you need.

I am not a luddite. For some tasks, I will use the GUI tool (e.g. Mandrake Control Center, or Webmin) to do things, when it is faster to do so. But the bulk of what I do is command line.

A tendency toward self improvement

[delcielo]

Seriously, you need to have a drive to constantly learn more. That's more valuable than any pre-written config tool out there.

I know that's not what you wanted; but it's really true. A desire to constantly increase your own knowledge is paramount.

My List

[np_bernstein]

1. Nagios: monitors your servers/services, amails, pages, sends a carrier pigeon when one goes down.

2. Logwatch: Logwatch is something that should be used by every Unix/Linux SA everywhere. It gives you a daily snapshot of events in your logs

3. Mon: Nice, simple, easy. If your webserver goes down, your secondary can bring up a virtual ip a couple of seconds later. No more annoying three am phone calls

4. Snort/ACID: lets me know if a virus breaks out, or if there are stupid script kiddies trying to brute force their way in.

5. Nessus: run it early, run it often. Figure out any holes you have in your security, and make sure you fix them.

There's more, but you should really do some of your own homework.

Single machine or multiple machines?

[ComputerSlicer23]

I've always like the "redhat-config" series of tools on RedHat or RedHat derived products.

• chkconfig and service are valuable for doing things.
• yum, apt, autorpm are all nice tools.
• logwatch is great.
• PAM isn't an application, but using PAM and LDAP can make having users spread across machines is a snap.
• tripwire is a great tool
• kickstart does wonders if you have to install lots of machines. I use it to completely document every scriptable part of an install.
• WebMin is great, but it worries me from a security perspective.
• gq is a great LDAP editor that I use to edit LDAP entries for users.
• Software like Bastielle Linux (a script that attempts to harden a machine)
• iptables, iproute2 (including ip and tc) are wonderful for networking.
• cron, sh, sed, awk, perl and python are used in conjunction quite a bit.
• fuser and lsof are used frequently by to to figure out what is going on.
• ethereal and tcpdump are tools of the gods.
• ssh is a thing of beauty.
• encrypted swap is fun.
• Nagios, MRTG, and sar are very useful for profiling and monitoring of your machines.

Who exactly is your target audience? People who've never seen UNIX, people who've worked on UNIX environment for years? What is it you are attempting to accomplish with them?

Most of my list would be boring to people who know a lot about UNIX, however some of them are Linux specific.

Re:Webmin is nice

[ThisIsFred]

It doesn't require you to run a separate webserver, it comes with its own. There are potential security problems, because in order to modify system configuration files, Webmin must be superuser-equivalent. However, Webmin modules have ACLs, and you can choose to not allow your lesser sysops access to things that might be dangerous.

Webmin has lots of thoughtful touches, like the ability to block certain UIDs and GIDs so that a lesser sysop cannot change the root account (for example). Another bonus is that Webmin users don't have to be regular shell accounts. It's not perfect, but it's still the Swiss Army Knife of configuration utilities.

Re:CVS (or insert your favorite alternative here)

[hackstraw]

Until someone steals your ssh key. Then they will be godlike too.

Sure, ssh keys are convenient, but they don't always replace passwords.

Passwords suck. Oh, and I have a 10 character passphrase on my privatekey that sits on my password protected computer.

I would guestimate that the liklihood that a password has been found or guessed or shown up in a plain text file (my ISP used to have a world readable radius logfile that had passwords in it) or sniffed is much greater than someone logging into my laptop (I have no remote services running) or physically beating me up and getting my key and passphrase from me.

I love the classic:

sj (misstyped su)

followed by the root password in plaintext. Gotta love that!

My Top Ten

[genkael]

1) Yast (I know it's SuSE centric, but it's being open sourced!)
2) OpenSSH... Oh yeah baby!
3) GCC and make... DUH!
4) FTP...I know I know SFTP if you prefer
5) Perl...YUM and even better with perl expect
6) Bash...we all need a CLI
7) Jumpstart...If you manage a lot of solaris boxes, this is your friend
8) Sendmail or postfix...pick your poison
9) nmap...oh yeah, let the Windows guys drool
10) Nagios...monitor that network in style!

Your question is flawed, thus you have no answers.

[moorley]

UN*X/Linux doesn't work that way. You are looking for a one size fits all administrative interface and it doesn't exist.

But I can sum up some the key points and bits of wisdom I have picked up over the years.

1) Ascii text is your friend. 98% of all the configuration files for UN*X programs live in ascii files and they "usually" live in /etc. You can use this to write program to update different pieces as needed. Any problem you do, you can undo. You can then run a program or use "kill -HUP" to get a process to reread that configuration.

2) Pick a programming language. Perl, AWK, Sed, ksh, all of them. You can use that programming language to role out changes as needed, or make a lot of changes really quickly. RSH/SSH allows you to do that across multiple systems. Use it carefully!

3) Design your environment. If you know what you are going to be using the servers, workstations and/or Linux embedded appliances for you can better decide how to automate it.

4)"Crunchy Cookie, Liquid Center".
In the end you will be automating certain administrative tasks over and over, but not all of them. That's why one size fits all won't work. It becomes a bloated security hole, so you only automate what you need and you automate it in an original and secure fashion.

As for some rock solid TLA recommendations.

SSH - SSH is your friend and as a replacement for RSH and its ilk you can use it to securely automate tasks. read up on ssh-agent for automating ssh access across multiple machines.

mon - How do you know it's working if you don't test it? You need to turn on monitoring, the more specific the test and monitor the better. mon is a good PERL framework for performing any test, and it has a lot of prepackaged/contributed test scripts that come in handy.

LDAP - Lots of UN*X environments are moving to LDAP to store enterprise wide information. It depends on how big of a UN*X environment you are setting up but having a centralized directory ala LDAP can be quite handy.

PAM/NIS - Plug In Authentication Modules. You can use these to have a centralized authentication server, cuts down on password updates. NIS+ is a tried and true system for stitching UNIX Systems together but I've only seen it installed in 1 UN*X environment and I've worked in several.

If you are looking for a prebuilt system or paradigm like Microsoft Server then you need to look to Redhat, Debian, else you are going to work from the need/application outwards.

Whatever you do more than once you will automate. When you no longer can budget the amount of UN*X Admins you will need you will start to build "tools" to delegate routine tasks, these will eventually become web pages, the web page will become an application. The application will become an acronym. The acronym will become a skill. The skill will become a job requirement HR will use to backfill a position. That's the way it goes.

Enjoy!

WRONG QUESTION

[nusratt]

Ask for the Top Ten tools, and most of your time spent reading the responses will be wasted, because of the overlap of the answers. If people list what they *genuinely* think are the Top Ten, there will be very few answers which are unusual or surprising (and still useful).

I think it would more useful to ask for the Top Ten MOST OVERLOOKED tools, or the most under-used, the most mis-used, or the ones whose full power is forgotten, unrecognized, or unused.

Re:More or Less ?

[LinuxHam]

and the console spits out junk until you close that shell.

Just so you know, when you accidentally cat a binary file and it changes all the letters in your console to garbage characters, just blindly type

reset

and hit Enter. Fixes it every time.

Blbbbbph.....

[Dr. Evil]

If Perl is God, then nobody would be able to understand the bible.

... oh wait.

Pico, you dick mods.

[teamhasnoi]

WTF? I can't have Pico as my #1?

When I don't have time to figure out goddamn control chars, and just want to edit a config file without having to resort to IRC, man pages, and poor documentation -

I USE FUCKING PICO.

All the commands are right there. On the screen.

Maybe this elitist attitude is why Linux isn't ready for the desktop. Now mod me Troll, bitches.

Keychain

[YetAnotherDave]

I regularly access dozens of *nix systems (mostly linux & solaris). I love the fact that I can enter my privatekey password once on booting my laptop, and then have a tool handle all the ssh-agents in subsequent sessions. Entering one (very long and tangled :) password once is so much nicer than having to enter passwords every time I connect to a new system...

http://www.gentoo.org/proj/en/keychain.xml

Also, (obligatory) perl is great and larry wall is my hero...

make + cfengine + cvs + LDAP

[MrChuck]

You don't admin a domain with "vi" [where by vi I mean all editors].

• Task: Add this printer to 200 machines. You have 5 different un*xes (and different versions of each of those around).
• We need to change the sudo file on 200 servers.
  no, nfs is not used
• Update /etc/mail/access on 6 machines in 4 locations (and 3 continents). Oh, we forgot this, do it again.
• Make sure $THIS is in the sybase's crontab on all the sybase server.
• Patch all the Solaris 7 machines with this new patch cluster. It's urgent. (and we have 50 of those machines scattered around the world).
• Change the (locally stored) root password on all the machines we take care of because X just got fired, but we couldn't tell you till now).
• Rebuild the 2 HA database servers (one at a time) and make sure they have the current patches and access to the new partitions on the SAN

vi! webmin. heh.

My partner took the Solaris Advanced Certification tests (someone else was paying and what the hell). She screwed up the parts about AdminTool. Someone who'd been using Unix since the 80s. She came home raging: AdminTool!! If I ever hired a senior admin and they kicked up admin tool, I'd fire them before the windows finished opening.

I find these single machine solutions quite quaint.

No, I'm delighted to have my cfengine scripts that go through /etc/ and make sure that inetd.conf is stripped, and that rpcbind and nfs aren't running on standalone servers and that the Right Stuff is in the Right Config files and that permissions are correct.

Best part is that I can run it again anytime later to redo that (or with '-n' to just show me what's changed).

And if it uses CVS to pull down $Today's configs, then so be it.