finger command in Ubuntu

Linux finger command prints user information in the system. You need to install finger package in order to use finger command because it's not installed by default. The finger command can be a threat to system security because attacker can gain information about the system. You can turn off the finger daemon or do not install it in the first place.

Why are we going to install it now? We need to know how the finger command works and see how it can danger our system. You can install finger using apt-get command as always:

luzar@ubuntu:~$ sudo apt-get install finger
Reading package lists... Done
Building dependency tree
Reading state information... Done
The following packages were automatically installed and are no longer
 required:
  libdns32 libisc32Use 'apt-get autoremove' to remove them.
The following NEW packages will be installed:  finger
0 upgraded, 1 newly installed, 0 to remove and 2 not upgraded.
Need to get 18.0kB of archives.
After this operation, 77.8kB of additional disk space will be used.
Get:1 http://us.archive.ubuntu.com hardy/main finger 0.17-11 [18.0kB]
Fetched 18.0kB in 0s (18.8kB/s)
Selecting previously deselected package finger.
(Reading database ... 18970 files and directories currently installed.)
Unpacking finger (from .../finger_0.17-11_i386.deb) ...
Setting up finger (0.17-11) ...
luzar@ubuntu:~$

Here is some information about finger command in manual page:

NAME

     finger - user information lookup program

SYNOPSIS

     finger [-lmsp] [user ...] [user@host ...]

DESCRIPTION

     The finger displays information about the system users.

The finger command is a user information lookup program. What information can we see? We can check that later. The syntax can be as simple as finger user to look for local system and finger user@host for looking into remote system. That's powerful isn't it?

Let's see some finger command examples. Here is an example of finger command without any option or argument specified:

luzar@ubuntu:~$ finger
Login     Name       Tty      Idle  Login Time   Office     Office Phone
luzar     luzar      pts/0          Nov 22 03:01 (192.168.1.6)
root      root      *tty1       29  Nov 22 03:00luzar@ubuntu:~$

If no arguments are specified, finger will print an entry for each user currently logged into the system.

Let's say I want to check some information on user name james. I would write the command as:

luzar@ubuntu:~$ finger james
Login: james                            Name: James Labu
Directory: /home/james                  Shell: /bin/bash
Office: 133, 012345678                  Home Phone: 098765432
On since Sat Nov 22 03:38 (EST) on tty2   15 seconds idle
     (messages off)No mail.No Plan.
luzar@ubuntu:~$

I can also use -s to prints in different layout:

luzar@ubuntu:~$ finger -s james
Login     Name         Tty      Idle  Login Time   Office     Office Phone
james     James Labu  *tty2       17  Nov 22 03:38 133        012345678
luzar@ubuntu:~$

Everything we need to know about user information is there, login name, real name, home directory, shell used, office room and phone numbers, etc.

Now let's see another example with useful options. This time it's how to finger remote host. Use the format as in the example below:

luzar@ubuntu:~$ finger james@ubuntu

If you want to remove finger command from Ubuntu system, use the command in example below:

luzar@ubuntu:~$ sudo apt-get remove finger
Reading package lists... Done
Building dependency tree
Reading state information... Done
The following packages were automatically installed and are no longer
 required:  libdns32 libisc32Use 'apt-get autoremove' to remove them.
The following packages will be REMOVED:  finger
0 upgraded, 0 newly installed, 1 to remove and 2 not upgraded.
After this operation, 77.8kB disk space will be freed.
Do you want to continue [Y/n]? y
(Reading database ... 19000 files and directories currently installed.)
Removing finger ...
luzar@ubuntu:~$ sudo apt-get update

You can run apt-get update after that. Now test finger command again to if it's still running in our system.

luzar@ubuntu:~$ finger
-bash: /usr/bin/finger: No such file or directory
luzar@ubuntu:~$

That's it, no more finger daemon running.

Ubuntu hosts.allow

Ubuntu hosts.allow file is the primary configuration file for TCP Wrapper. We can use hosts.allow file to filter access to our system and to secured a service. Setting up hosts.allow and hosts.deny files like protecting your system with a simple firewall. The complete manual for hosts.allow (and hosts.deny)file can be found in hosts_access manual. The manual contains all information you need to configure the hosts.allow file.

Here is a default Ubuntu hosts.allow file:

luzar@ubuntu:~$ cat /etc/hosts.allow
# /etc/hosts.allow: list of hosts that are allowed to access the system.
#                   See the manual pages hosts_access(5) and hosts_options(5).
#
# Example:    ALL: LOCAL @some_netgroup
#             ALL: .foobar.edu EXCEPT terminalserver.foobar.edu
#
# If you're going to protect the portmapper use the name "portmap" for the
# daemon name. Remember that you can only use the keyword "ALL" and IP
# addresses (NOT host or domain names) for the portmapper, as well as for
# rpc.mountd (the NFS mount daemon). See portmap(8) and rpc.mountd(8)
# for further information.
#

Example of Ubuntu hosts.allow configurations:

Mostly Closed

ALL: LOCAL @some_netgroup
ALL: .foobar.edu EXCEPT terminalserver.foobar.edu

Booby trap

in.tftpd: LOCAL, .my.domain

That's all.

How to install tcp wrappers in Ubuntu

This is a guide on how to install tcp wrappers in Ubuntu. Tcp wrapper is a host access control in Ubuntu, or Linux in general and other Unix-based system. You can say it is a simple firewall if you want.

Tcp wrapper used tcpd daemon to run the service. The fast way to install a daemon in Ubuntu is by using software package management aptitude. Aptitude is a high-level package management developed for Debian Linux. The upgrade steps are similar to apt-get command. You can see my previous post, Ubuntu aptitude upgrade for aptitude update and upgrade command.

Here is a step by step example of how to install tcp wrappers in Ubuntu using aptitude:

luzar@ubuntu:~$ sudo aptitude install tcpd
Reading package lists... Done
Building dependency tree
Reading state information... Done
Reading extended state information
Initializing package states... Done
Building tag database... Done
The following packages have been automatically kept back:
  libbind9-30 libisc32 libisccc30 libisccfg30
The following packages have been kept back:
  bind9 bind9-host dnsutils linux-image-server linux-server
0 packages upgraded, 0 newly installed, 0 to remove and 9 not upgraded.
Need to get 0B of archives. After unpacking 0B will be used.
Writing extended state information... Done
Reading package lists... Done
Building dependency tree
Reading state information... Done
Reading extended state information
Initializing package states... Done
Building tag database... Done
luzar@ubuntu:~$

That's it.

Ubuntu tcp wrappers

TCP wrappers can be considered as a simple firewall for Ubuntu system. It is a host access control system and also can be used to secured a service. The tcp wrappers contains two files named hosts.allow and hosts.deny.

Here are some basic information about tcp wrappers and how to configure hosts.allow and hosts.deny files:

• Access control pattern based on client (host name/address, user name),


• Access control pattern based on server (process name, host name/address)


• Access will be granted when a (daemon,client) pair matches an entry in the /etc/hosts.allow file.


• Access will be denied when a (daemon,client) pair matches an entry in the /etc/hosts.deny file.


• Otherwise, access will be granted.

Here is the format:

daemon_list : client_list [ : shell command]

• daemon_list is a list of one or more daemon process names (argv[0] values) or server port numbers or wildcards.


• client_list is a list of one or more host names, host addresses, patterns or wildcards that will be matched against the client host name or address.


• shell command is optional


• List elements should be separated by blanks and/or commas.

Wildcards

Here are lists of wildcards support by tcp wrappers:

ALL        The universal wildcard, always matches.
LOCAL      Matches any host whose name does not contain a dot character.
UNKNOWN    Matches any user whose name is unknown, and matches any host whose name
           or address are unknown.
KNOWN      Matches any user whose name is known, and matches any host whose  name
           and address are known.
PARANOID   Matches any host whose name does not match its address.

Shell commands

Shell command should be perform background otherwise you have to wait until the command finished.

  Shell commands should not rely  on  the  PATH  setting  of  the  inetd.
  Instead, they should use absolute path names, or they should begin with
  an explicit PATH=whatever statement.

SERVER ENDPOINT PATTERNS

In order to distinguish clients by the network address that they connect to, use patterns of the form:

process_name@host_pattern : client_list ...

Patterns like these can be used when the machine has different internet addresses with different internet hostnames.

CLIENT USERNAME LOOKUP

Client username information, when available, is logged together with the client host name, and can be used to match patterns like:

daemon_list : ... user_pattern@host_pattern ...

The daemon wrappers can be configured at compile time to perform rule-driven username lookups (default) or to always interrogate the client host. In the case of rule-driven username lookups, the above rule would cause username lookup only when both the daemon_list and the host_pattern match.

Selective username lookups can alleviate the last problem. For example, a rule like:

daemon_list : @pcnetgroup ALL@ALL

would match members of the pc netgroup without doing username lookups, but would perform username lookups with all other systems.

DETECTING ADDRESS SPOOFING ATTACKS

The IDENT (RFC931 etc.)service can be used to detect such and other host address spoofing attacks.

Before accepting a client request, the wrappers can use the IDENT service to find out that the client did not send the request at all. When the client host provides IDENT service, a negative IDENT lookup result (the client matches UNKNOWN@host) is strong evidence of a host spoofing attack.

Ubuntu ssh keys

Ubuntu ssh key is referred to the RSA key fingerprint released by ssh server for a client. It's also known as a host key used to identify a client identity.

When a client first time request for ssh, the server will send its public key. If the client trust the server and accepted the public key, it will stored in the server as an identity of that client.

Here is an example of first time ssh login attempt by a client:

aura@ubuntu:~$ ssh -l luzar 192.168.1.3
The authenticity of host '192.168.1.3 (192.168.1.3)' can't be established.
RSA key fingerprint is 8f:8f:a9:8a:47:58:3c:a8:2c:ce:6f:1d:45:dc:86:c9.
Are you sure you want to continue connecting (yes/no)?

If a client reject the public key, ssh will be terminated:

Are you sure you want to continue connecting (yes/no)? no
Host key verification failed.
aura@ubuntu:~$

So user need to accept the ssh server public key to connect into the server. When the user accepted the public key, it'll be stored in the user's home directory, in a hidden file named .ssh/known_hosts. The next time the same user ask to connect using ssh, the server will look for the user .ssh/known_hosts file and compare the fingerprint. Here is an example of user ssh private key stored in the .ssh/known_hosts file:

Ubuntu change permissions on file

In order to be able to change permissions on file in Ubuntu, user need to know the basic of Ubuntu permissions. There is a guide on Ubuntu permissions in the previous post. You can check Linux file permissions guide to learn how Ubuntu permissions work.

Here is an example on Ubuntu change permissions on file. To differentiate a file and a folder is by looking at the first bit of the permission set. A normal file is indicate with - , while a folder is indicate by d , which means directory. Here is an example:

Ubuntu permissions on file:

luzar@ubuntu:~$ ls -l
total 4
-rw-r--r-- 1 luzar luzar 0 2011-05-21 03:43 file.txt
drwx------ 2 luzar luzar 4096 2011-05-21 03:43 folder
luzar@ubuntu:~$

The Ubuntu command used to change permissions on file is chmod. Here are some examples on Ubuntu change permissions on file using octal method and code method:

Example 1 - Ubuntu change permissions on file; give owner full permissions, group and others a read and execute permissions.

Using octal method:

luzar@ubuntu:~$ chmod 755 file.txt
luzar@ubuntu:~$ ls -l
total 4
-rwxr-xr-x 1 luzar luzar 0 2011-05-21 03:43 file.txt
drwx------ 2 luzar luzar 4096 2011-05-21 03:43 folder
luzar@ubuntu:~$

Using code method:
(Based on current permissions Ubuntu permissions on file)

luzar@ubuntu:~$ chmod ugo+x file.txt
luzar@ubuntu:~$ ls -l
total 4
-rwxr-xr-x 1 luzar luzar 0 2011-05-21 03:43 file.txt
drwx------ 2 luzar luzar 4096 2011-05-21 03:43 folder
luzar@ubuntu:~$

Example 2 - Ubuntu change permissions on file; give full permissions for owner but no permission for group and others.

Using octal method:

luzar@ubuntu:~$ chmod 700 file.txt
luzar@ubuntu:~$ ls -l
total 4
-rwx------ 1 luzar luzar 0 2011-05-21 03:43 file.txt
drwx------ 2 luzar luzar 4096 2011-05-21 03:43 folder
luzar@ubuntu:~$

Using code method:
(Based on current permissions in example 1)

luzar@ubuntu:~$ chmod go-rx file.txt
luzar@ubuntu:~$ ls -l
total 4
-rwx------ 1 luzar luzar 0 2011-05-21 03:43 file.txt
drwx------ 2 luzar luzar 4096 2011-05-21 03:43 folder
luzar@ubuntu:~$

Example 3 - Ubuntu change permissions on file; Give full permissions for owner, group and others.

Using octal method:

luzar@ubuntu:~$ chmod 777 file.txt
luzar@ubuntu:~$ ls -l
total 4
-rwxrwxrwx 1 luzar luzar 0 2011-05-21 03:43 file.txt
drwx------ 2 luzar luzar 4096 2011-05-21 03:43 folder
luzar@ubuntu:~$

Using code method:
(Based on current permissions in example 2)

luzar@ubuntu:~$ chmod go+rwx file.txt
luzar@ubuntu:~$ ls -l
total 4
-rwxrwxrwx 1 luzar luzar 0 2011-05-21 03:43 file.txt
drwx------ 2 luzar luzar 4096 2011-05-21 03:43 folder
luzar@ubuntu:~$

*Note: Using the code method, the command depends on the current permissions. List the current permissions with ls -l command so you can decide to add (+) or remove (-) certain permission.

Ubuntu change permissions on folder

We have learned how Ubuntu permissions work in the Linux file permissions guide. Here is a guide on how to change Ubuntu permissions on folder.

Examples of Ubuntu change permissions on folder:

Ubuntu current permissions on folder:

luzar@ubuntu:~$ ls -l
total 4
drwxr-xr-x 2 luzar luzar 4096 2011-05-20 12:38 folder
luzar@ubuntu:~$

The Ubuntu command we are going to use is chmod. The chmod command is used to change file mode bits. So now we are going to practice the Ubuntu change permissions on folder with some examples:

Example 1 - Change group permissions on folder to execute only and others to read and execute.

The Octal method:

luzar@ubuntu:~$ chmod 715 folder
luzar@ubuntu:~$ ls -l
total 4
drwx--xr-x 2 luzar luzar 4096 2011-05-20 12:38 folder
luzar@ubuntu:~$

The code method:
(Based on Ubuntu current permissions on folder)

luzar@ubuntu:~$ chmod g-r folder
luzar@ubuntu:~$ ls -l
total 4
drwx--xr-x 2 luzar luzar 4096 2011-05-20 12:38 folder
luzar@ubuntu:~$

Example 2 - Change others permissions on folder to read only and group to read, write and execute.

The Octal method:

luzar@ubuntu:~$ chmod 774 folder
luzar@ubuntu:~$ ls -l
total 4
drwxrwxr-- 2 luzar luzar 4096 2011-05-20 12:38 folder
luzar@ubuntu:~$

The code method:
(Based on Ubuntu permissions in example 1)

luzar@ubuntu:~$ chmod g+rw folder/
luzar@ubuntu:~$ chmod o-x folder/
luzar@ubuntu:~$ ls -l
total 4
drwxrwxr-- 2 luzar luzar 4096 2011-05-20 12:38 folder
luzar@ubuntu:~$

Example 3 - Give no permissions on folder for group and others.

The Octal method:

luzar@ubuntu:~$ chmod 700 folder
luzar@ubuntu:~$ ls -l
total 4
drwx------ 2 luzar luzar 4096 2011-05-20 12:38 folder
luzar@ubuntu:~$

The code method:
(Based on Ubuntu permissions in example 2)

luzar@ubuntu:~$ chmod go-rwx folder/
luzar@ubuntu:~$ ls -l
total 4
drwx------ 2 luzar luzar 4096 2011-05-20 12:38 folder
luzar@ubuntu:~$

*Note: Using the code method, the command depends on the current permissions. List the current permissions with ls -l command so you can decide to add (+) or remove (-) certain permission.

That's all. Permissions on Ubuntu is not so complicated. You just need some times to get used to it. My advice is, just use one way of changing the Ubuntu permissions. Choose the one which suit you, either the octal method or the code method.

Linux file permissions guide

Linux permission is unique and interesting. To change Linux permission for a file or a folder, user needs to understand the basic concept of the permission. Linux has two basic permission types; file ownership and file permission. Let's see with an example:



luzar@ubuntu:~$ ls -l /root/
total 4
drwxr-xr-x 2 luzar luzar 4096 2011-05-20 06:05 folder
luzar@ubuntu:~$

From the example, we can see that the folder (blue) has ownership (green) and permission (red) highlighted. First let's look at the ownership. Linux has two ownerships, Owner and Group. As we can see from the example, the folder's owner is luzar and the folder's group is also luzar.

As you can see in the example, the Linux permission contains several characters. It looks complicated, but actually it's not. The basic is simple:

[d] [rwx] [r-x] [r-x]

The Linux permission basically is a combination of three permission types for three different groups.

[d] - Indicates folder, files, link, special file, socket, named pipe
[rwx] - Owner
[r-x] - Group
[r-x] - Others/world

Permission types:
r = read permission. View the file or folder.
w = write permission. Create or edit file.
x = execute permission. Run file.
- = no permission.

That's all. So the permission folder above means the owner which is root can view, edit and execute, while the group and others can only read and execute the folder.

Wait, how do we change the permission?

There are two ways we can use to change Linux permissions on folder.

Way number one is the octal system:
1 - Execute (x)
2 - Write (w)
4 - Read (r)

Way number two is using code system:
u - user/owner
g - group
o - others