Unix Linux Administration II Class 7: Scripting conditionals. Setting up your Certificate Authority (CA). Scripting loops.

Unix Linux Administration II

Class 7: Scripting conditionals. Setting up your Certificate Authority (CA). Scripting loops.

Agenda discuss Homework. Unit 1: Scripting conditionals. Unit 2: Certificate Authority. Unit 3: Scripting loops.

Homework review

DNS configs.

Scripting – ping script.

Review:basic math syntax $((expression))

most common functions available including bitwise and logcal

White space is optional.

non-zero final expression return true.

Quoting ', ", ` and \

command subsitution user=$(grep -i $name /etc/passwd)

Review: cont.Positional parameters are provided by the shell

environment and automatically assign variables to values passed into the script. who

who | grep root

on.sh root

who | grep $1

$# = number of arguments passed to the script.

$* = reference all arguments passed to the script

$? = Stores the exit value of the script

Review:

Slave servers provide redundancy and high availability when designed appropriately form your domain.

The changes between slave and master are fairly simple.

Slave poll masters by default but master can be configured to notify slaves when updates occur.

Slaves can be configured to store zone data locally for backup.

Class 7, Unit 1

What we are going to cover: Scripting and conditionals

What you should leave this session with: How to add decision points to your scripts. How to enable debug in your scripts.

Indenting

Tabs or SpacesBe consistent! (possible vimrc setting?).

Helps with legibility Most languages ignore white space

Good or Bad?

 ”…code is read much more often than it is written”Python - http://www.python.org/dev/peps/pep-0008/#indentation

Exit statusEvery time you run a script it produces an exit

status. Zero is successful anything else indicates failure.

Failures can be caused for lots of reasons. The exit value is stored in $?

echo $?

What are some ways to create a failed exit status?

The "if" construct"if" is one of the first conditional statements you will

probably encounter.

You can think of this as "if X then do Y and finish". The if statement must start with "if" and end with "fi". We will see similar constructs in other conditionals later.

for example:if [ -f /etc/hosts ]; then echo "a host file exists"fi

How to test string values.

You can test an expression for a true or false value using the expression "test".user=$1if test “$user” == angus; then echo “$user found on system”fi

Many test operators are available such as==, !=, -z string (string is null) –n string (string is NOT null), string (is defined)

Test cont.You can also test for integer values withReturns true (0) if:

int1 -eq int2int1 -ge int2 “great than or equal to”int1 -gt int2 “greater than”int1 -le int2 “less than or equal to”int1 -lt int2 “less than”int1 -ne int2 “not equal to”

[ “$value” -eq 0 ]

File testsThe file tests expect a single argument, the filename.

-d file file is a directory

-e file file exists

-f file file is an ordinary file

-r file file is read only

-s file file has nonzero length

-w file file is writable by process

-x file file is executable

-L file file is a symbolic link

[ -f /etc/passwd ] is this an ordinary file

[ -r /etc/passwd ] Is file readable by process.

Logical operators available.! Used to negate the value

[ ! –r /etc/shadow ] is the file not readable

-a performs logical AND of two expressions.

[ -f /etc/passwd –a –r /etc/passwd ] BOTH must be true.

-o performs logical OR of two expressions.

[ -f /etc/passwd –o –r /etc/shadow ] true if EITHER are successful

Parentheses

You can use parentheses in a test to alter the order of evaluations however the parentheses must be escaped

[ \( “$value” –ge 0 \) –a \( $value –lt 10 \) ]

The else conditional

The else statement can expand the if statement. If the first condition is true the second one is skipped.

if cmd; then command1 command2else command1 command2fi

else example# value passed in from cmd line.

user=$1

if who | grep "^$user " > /dev/null; then

echo "$user is logged on"

else

echo "$user is NOT logged on"

fi

Exit command

Exit allows you to immediately terminate a script. You can pass exit a numeric value also if you want, this become the status code stored by $?

if ...else echo "$user is NOT logged on“

exit 2fi

Syntax for else/if = elifIf you find a need for nested if statements this can

resolved with elif statements.

If cmd ; then

cmd

elif cmd ; then

cmd

else

cmd

fi

The case statementCase statements let you compare a value against

multiple values and execute one when a match is found. Case statements can be very efficient.case value in pattern) cmd

cmd;;pattern) cmd

cmdcmd;;

pattern) cmdcmd;;

esac

Sample case statement# script expects a single variable.case "$1” in 0) echo zero;; 1) echo one;; 2) echo two;; 3) echo three;; *) echo "out of expected range";;esacResult, user enters 1 script echoes “one”

Talk about nothing, no operator

The shell representation for no operator is :This can be used in a script when you what to check

for a value but do nothing if it is defined but return a message if it does not exist.

If grep “userid /etc/passwd” > /dev/null; then :else echo “user is not defined to system”fi

Debug your scripts

One way to debug your scripts is to start them with the –x option like this:

/bin/sh –x number.sh /bin/sh -x number.sh 2 + case "$1" in + echo two Two

The set –x option will display command and their arguments as they are executed.

Debug cont.You can extend the output using –vEnabling –v will display the shell input lines

as they are read.Both can be enabled at the same time.#!/bin/sh –vxOr within the script using something like set –v on set –x onDisable using +v or +x

Shell logical OR and logical AND

Logical OR = ||

cmd1 || cmd2

cmd2 is ONLY executed if cmd1 fails.

Logical AND = &&

cmd1 && cmd2

ONLY if cmd1 succeeds will cmd2 run.

Review: conditionalsExit status, 0 = success, !0 = fail.if test "$user" == “<value>”

you can also just use [][ "$user" == “<value>” ]File tests, such as does the file exist.[ -e /etc/nsswitch.conf ]logical operators-a -o || &&You can use parentheses to alter the order of evaluations.if cmd; then do; else do; fiif [ "$HOME" ]; then echo "Found home!"; else echo "shucks we are homeless!"; fi

In class lab 7a

Lab notes for this session can be found here: http://www.ulcert.uw.edu -> Class Content -> InClass labs ->

Class 7, Unit 2

What we are going to cover: Certificate Authorities (CA)

What you should leave this session with: How public CA server work PKI structure

Public Certificate Authorities (CA)So, if we want others to trust our certificate

the creation process is very similar to a self signed certificate.

The difference is that we have a 3rd party sign the certificate signing request (CSR) which then becomes the public certificate.

At this point anyone that trusts that 3rd party (Verisign, Thwart, Entrust) now implicitly trust you.

What is a Certificate Authority (CA)

A certificate authority can be described as an entity with policies for verifying the identity of entities.

This verification is then manifest in the signing of a public key provided by the requestor that others can recognize as legitimate.

Similar in how a government issues passports that then other governments and individuals can use to confirm the identity of the passport owner.

Where to find public CA certificates

Browser installs, OS installs, Java installs all come with a keystore. The keystore contains a selection of public key certificates that the related organizations have chosen to include by default.

Applications that interact with those technologies will trust certificates signed by the private keys for which the public certificate is available.

Chain of trust.

The Chain of trust is based on the idea that trust is implied by association.

With certificates we trust them because we typically already trust the certificate that signed them.

If we visit for example: https://www.paypal.com/

We trust this site because it was signed by: VeriSign Class 3 Extended Validation SSL CA

Certificate chain.

Starts with a public CA certificates such as: VeriSign Class 3 Public Primary Certificate Authority – G5

Which in turn signed a certificate for: VeriSign class 3 Extended Validation SSL SGC CA

Which signed the certificate for: www.versign.com

Check this site to see the full chain.

Setting up a PKI instance

We will need to create a private key and public certificate pair for our Certificate Authority (CA).

From this key pair we can sign certificate which will now show the relationship to the root.

To extend this chain we can submit a CSR from the root to the class CA and have it signed. Now the chain has been extended.

openssl: cert signing request (csr).

If you are NOT going to sign the request but rather have a 3rd party CA sign it then you only need to create the request and private key.

openssl req –new –newkey rsa:1024 –nodes -keyout cert.key –out myreq.csr

This results in one csr and one private key.

Signing the “csr”sudo openssl ca -policy policy_anything -out

server.crt -infiles myreq.csr

Here we are defining the CA policy which for us is wide open but can be limited.

We define the csr input and the public cert output.

Does the private key for this request need to be local also?

openssl certificate & key verification

Comparing your private key and public certs. openssl rsa –noouot –modules –in ca-private-key.pem | openssl md5 openssl x509 –noout –modules –in ca-pub-cert.perm | openssl md5

Check your private key openssl rsa –in private.key –check

Check your pubic certificate openssl x509 –in server.crt –text –noout

Check your csr openssl req –text –noout –verify –in server.csr

Web server configurationJust as before we need to define a valid path

to our webserver certificates and keys.

Now we also need to define our new CA certificate.

If we have a root and intermediate CA like Verisign we would need to create a chain certificate. This is basically a file with multiple certificates.

review: /etc/pki/tls/certs/ca-bundle.crt

Review: PKI

Private keys, Public certificates and CSRpublic CAChain of Trust

Chain certificatesPKI setup

private key, csrsigned cert.

sign other requests (CSR).

In class lab 7b

Lab notes for this session can be found here: http://www.ulcert.uw.edu -> Class Content -> InClass labs ->

Class 7, Unit 3

What we are going to cover: Scripting and loops

What you should leave this session with: Basics to creating loops within your scripts. How to enable debug in your scripts.

Loops.Loops are blocks of code that run until

complete (they can be infinite loops)

The first example is the for loop.

for f in value1 value2 value3

do

cmd

done

For loops - body.for letter in a b c

do

echo “found: $letter”

done.

The “Body” is the content between “do” and “done”.

When the script is executed the value for “letter” is assigned to the first value provided after “in” and then the body of the loop is executed. When complete the second value is assigned to the variable $letter and the process is repeated.

? What happens if you enclose a b c in quotes?

for loops cont.

You can leverage the shells ability for filename substitution in loops. The shell provides for filename substitution in the list provided to the body of the loop.for f in [1-3].txt

do

echo $f

done.

Just as in the other examples, echo is executed 3 times in this example

for loops cont.you can also read in file values and feed those to

the for loop.cat filelist.txt

1.txt

2.txt

3.Txt

for files in $(cat filelist.txt) ; do echo $files; done

or

for files in $(cat filelist.txt) ; do cat $files; done

*example of command substitutions.

Using $* in loops

$* = all arguments

echo “Number of arguments passed in $#“

for variables in $*

do

echo "$variables"

done

Replacing $* with $@You know that $* returns all the values provided at

the command line. However if you use $@ this is actually a comma

separated list of values

for f in “$@”do

echo $fdone

*Best practice to place double quotes around $@

while loopsAnother looping function is "while".

while cmd

do

cmd

done

“cmd” is executed and its exit status is tested. if the exit status is zero the commands between do and done are competed otherwise the script exits with a non zero status code

while script

Similar to saying “while true do”sample “while” script counting to 10

num=1

while [ "$num" -le 10 ]

do

echo $num

num=$(( num+1 ))

done

until

until - the inverse of while, meaning it will run so long as the return code is not 0, or not successful.

Similar to the while blocks, commands between the do and done functions may never be executed if the initial command returns a successful response (zero).

Useful when checking for a status change

until cont.# if NOT successful enter the body

until ps -ef | grep -i "named“ | grep –v grep > /dev/null

do

echo "bind is not running"

sleep 5

done

echo "bind is running“

Break out!Sometimes in a logic loop you want to break

out based on user input such as the user asking to quit. Enter “break”

while truedoread cmdif [ "$cmd" = "quit" ] then break else echo "$cmd"fidone

Continue on…The opposite of break is to continue. Sometimes you

want the loop to simply leave the current loop and continue working through the script. This is where you might use continuefor filedo

if [ ! –e “$file” ]then echo “file not found”continuefi

process rest of file/datadone

Sending the process to background

You can background a process using the & after the done statement. Just as we have done at the command line.

for file in data[1-4]

do

run $file

done &

redirection

I/O redirection on a loop can be obtained using the < or > based on your need.

Write to file:

for i in 1 2 3 4

do

echo $i

done > data.out

Sleep and background

sleep n - where n is a numeric value. Sleep will pause the system for the time specified on the command line.

You can run programs in the background using ampersand "&"

script &

output from this command will tell you the process associated with your process.

Use fg to foreground a background process.

optionsYou can define options in your scripts using syntax

similar to this:if [ "$1" = "-a" ]then option=TRUE

shiftelse option=FALSEfiecho "value for option is: $option"

getoptsThe previous example is fine for simple

options but if you want more flexibility it can become tedious to script. However getopts is available for this purpose.

getopts works within a loop and examines each argument to determine if it is an option based on the existence or absence – before the value.

getopts

The syntax of the getopts command is:  getopts optstring option

opstring – is the list of options expected from the command line. option - value used to iterate over the command line options provided.

getopts cont.You can stack your options or pass them

individually. Meaning –abc or –a –b -c

If your option needs an argument add “:”

getopts a:bc name

Now a valid command line looks like:

script.sh –a braeburn –b –c

script.sh –a braeburn

script.sh –b –c

getopts cont.OPTARG used when an option requires an

argument, e.g. –a braeburn

OPTIND is a special variable used by getops which is set to 1 by default and is updated each time getopts complete a loop.

If you reset $OPTIND to 1 at the end of the loop it is possible to use getops again in the same script.

Impact of “:”When an option character not contained in optstring is found, or an option found does not have the required option-argument:

If optstring does NOT begin with a : (colon)

1.Option will be set to a ?

2.OPTARG. will be unset

3.A diagnostic message WILL be written to standard error.

Impact of “:”Alternatively if optstring DOES begin with a : (colon)

1.option will be set to a ? character for an unknown option or to a : (colon) character for a missing required option.

2.OPTARG. will be set to the option character found.

3.no output will be written to standard error.

getopts samplewhile getopts ":ab:c" option; do case $option in a) echo received -a ;; b) echo received -b with $OPTARG ;; c) echo received -c ;; :) echo "option -$OPTARG needs and an ARG" ;; *) echo "invalid option -$OPTARG" ;; esac done

Review: loops and breaksFor loops:for f in a b c; do echo "found: $f"; donefor f in $(cat filelist.txt); do echo $f; donefor f in $(cat filelist.txt); do cat $f; done

$* vs $@, $@ provides a comma separated listUntil and While:while loops, if the exit status is zero the loop is entered.until, if the exit status is NOT zero the loop is entered.Break and continue are used to manipulate the loop behavior.

Review: Options and GETOPTS

Passing options to your script manually.if [ "$1" = "-a" ]then option=TRUE

shift

GETOPTS is a built-in shell function. GETOPTS loops through arguments looking for a “-” before any arguments and determines if it is a valid option.

If arguments are required with the options then you simple add a “:” after the option in your script the GETOPTS will require one.

In class lab 7c

Lab notes for this session can be found here: http://www.ulcert.uw.edu -> Class Content -> InClass labs ->

Homework

homework for this week posted later tonight.