1.1 Assignments this weekIndex

Check the due date for each assignment and put a reminder in your agenda, calendar, and digital assistant.

• Read All The Words, Do, and then Submit via Blackboard:
  • Assignment #02 HTML – Course Linux Server simple commands
  • Assignment #03 HTML – working with files: PS1, find, mkdir, mv
  • Bonus (optional) Assignment #04 HTML – the VIM text editor
  • Really do Read All The Words. You don’t get a second chance to get it right.

1.2 Lab work this weekIndex

• Assignment #02 HTML will have you change your CLS password.
• Assignment #03 HTML is ready

• Bonus (optional) Assignment #04 HTML is ready

• Finish the above assignments, which involve work on the first two worksheets.
  • The worksheets will be easier once we cover File System and Pathnames.

1.3 Upcoming testsIndex

Read the Test Instructions (all the words) before your first midterm test.

1. First Midterm test: 45 minutes; in class 8am Thursday in Week 6 (February 12)
2. Second Midterm test: 45 minutes; in class 8am Thursday in Week 9 (March 12)

Tests take place in your 8am lecture hour, not in your lab period.

3.1 Disabled SFTP writing on CLSIndex

To improve CLS security, I’ve disabled the writing or changing of files on the CLS by the SFTP service, as used by file transfer programs such as WinSCP and FileZilla. You can copy files out of the CLS (e.g. your assignments) using WinSCP and friends, but you can’t copy files into the CLS unless you use the secure scp program.

3.2 Fifteen minute ruleIndex

Your time as a student is valuable. If you come up against a tough problem and make no progress in fifteen minutes despite best efforts:

1. get help from a professor or lab instructor
2. get help from classmates
3. take a break
4. put it on hold and work on something else

This happens to all of us, and we need to watch out for it when it happens.

But what about when it’s midnight before the assignment is due?

Remember the “Don’t Leave Things to the Last Minute” rule!

3.3 Locked out of CLSIndex

When you use a file transfer program, remember that the program must use your userid to log in and not a blank userid. Someone got their IP address locked out of the CLS yesterday for using a blank userid:

Jan 21 20:36:31 Accepted password for XXXXXXXX from 99.246.105.31
Jan 22 01:42:38 Invalid user  from 99.246.105.31
Jan 22 01:43:05 Failed password for invalid user  from 99.246.105.31
Jan 22 01:43:15 Failed password for invalid user  from 99.246.105.31
Jan 22 01:44:07 Invalid user  from 99.246.105.31
Jan 22 01:44:37 Failed password for invalid user  from 99.246.105.31
Jan 22 01:44:52 Failed password for invalid user  from 99.246.105.31
Jan 22 01:46:40 refused connect from cpe0c473dc25fe1-cm0c473dc25fe0.cpe.net.cable.rogers.com (99.246.105.31)

Remember your password, and use the correct userid:

Jan 10 15:46:52 Failed password for XXXXXXXX from 99.224.126.41
Jan 17 21:31:54 Invalid user steam from 99.224.126.41   
Jan 17 21:54:21 Invalid user desktop from 99.224.126.41
Jan 17 22:14:39 refused connect from cpe001ec92c1d15-cm84948c4813b0.cpe.net.cable.rogers.com (99.224.126.41)

3.4 CommandsIndex

Commands are usually VERB and OBJECT:

$ wc /etc/passwd
$ cat /etc/passwd
$ less /etc/passwd

Commands in worksheets 2 and 3:

• PS1, cd, find, less, ls, man, mkdir, passwd, pwd, rmdir
• cat, clear, cp, find, grep, history, less, man, mv, rm, sleep, touch

Read All The Words:

From: a CST8207 student
Hey, was just playing around with "mv" command as per weekly notes
"9 Relative Pathname Exercise"  kept getting error "-bash: $:
command not found" after trying to rename a .txt file.  example:

    -bash-4.2$ $ mv caltest.txt catltest2.txt
    bash: $: command not found

Just wondering if I'm doing something wrong and if so where would
the information pertaining to this be?

In the Week 2 Notes, under heading “2-1 Readings, Assignments, Labs, Tests, and ToDo”, (the list of things you needed to read last week) is this web page: “3. The Unix/Linux Shell – using the shell command line in Linux” and in that web page is the heading “2 Typing Command Lines”, which is the information you need to Read All The Words, especially the sentence that starts with “You do not”.

4.1 Using parent directory chains to attack my serverIndex

Using chains of parent directories such as ../.., people attack web servers, trying to get access to sensitive files.

Someone in Kitchener tries to find a list of VMware hosts on my home machine:

$ zfgrep ../.. /var/log/apache2/*gz 
/var/log/apache2/access.log.8.gz:2014-11-27_03:52:57 162.244.31.150 162.244.31.150 - 192.168.2.250 idallen-oak.home.idallen.ca 69-165-154-175.dsl.teksavvy.com "GET /sdk/../../../../../..//etc/vmware/hostd/vmInventory.xml HTTP/1.1" 404 327 "-" "Mozilla/5.0 (compatible; Nmap Scripting Engine; http://nmap.org/book/nse.html)" 223 530 "/var/www/html/etc" 0 3672 FMT=idallen2
/var/log/apache2/other_vhosts_access.log.8.gz:idallen-oak.home.idallen.ca:80 162.244.31.150 - - [27/Nov/2014:03:52:57 -0500] "GET /sdk/../../../../../..//etc/vmware/hostd/vmInventory.xml HTTP/1.1" 404 530 "-" "Mozilla/5.0 (compatible; Nmap Scripting Engine; http://nmap.org/book/nse.html)"

See hundreds of attacks on the CLS web server in March 2014

---

• Remember this for later

Author: 
| Ian! D. Allen  -  idallen@idallen.ca  -  Ottawa, Ontario, Canada
| Home Page: http://idallen.com/   Contact Improv: http://contactimprov.ca/
| College professor (Free/Libre GNU+Linux) at: http://teaching.idallen.com/
| Defend digital freedom:  http://eff.org/  and have fun:  http://fools.ca/