Cron is the task scheduling daemon in linux. The daemon is called 'crond' and the program that manipulate cron jobs is 'crontab'. Once the daemon is started, it goes into sleep and wakes up every minute to examine all the files containing crontab entries. If a job is scheduled to run at the current minute, it will be executed and the daemon will go back to sleep.
A user can manipulate the cronjobs for his account using the command 'crontab'. Some security restrictions are imposed on use of this command with two files /etc/cron.allow & /etc/cron.deny.
If the file /etc/cron.allow exists, the user should be listed in that inorder to run crontab. If this file doesnt exist the user should not be listed in /etc/cron.deny to run crontab. If both the files does not exist, no users other than root is allowed to use crontab.
Cron jobs for individual users are stored in a seperate text file /var/spool/cron/username which is edited by corresponding user with the command 'crontab -e'
The system wide crontab configuration file is /etc/crontab. What this does is run the cronjob files under a set of directories.
/etc/crontab:
SHELL=/bin/bash
PATH=/sbin:/bin:/usr/sbin:/usr/bin
MAILTO=root
HOME=/
# run-parts
01 * * * * root run-parts /etc/cron.hourly
02 4 * * * root run-parts /etc/cron.daily
22 4 * * 0 root run-parts /etc/cron.weekly
42 4 1 * * root run-parts /etc/cron.monthly
As the name of the directories indicate, the files inside the directories are inspected by cron once every hour, day, week and month. The files insied this directories will be in the standard cronjob format as indicated below.
For per user crontab files (/var/spool/cron/username) the format is:
minute hour day month dayofweek command-to-be-scheduled
For all other crontab files the format is
minute hour day month dayofweek USER command-to-be-scheduled
Values for each field:
minute: 0-59
hour: 0-23
day: 1-31
month: 1-12 (or short names as jan,feb,jun etc can be used)
dayofweek: 0-7 ( or short names as sun, mon,fri etc; 0 & 7 represent Sunday )
For all these fields following rules apply:
Asteric (*) in any field indicate all applicable values for that field.
A hiphen (-) between two digits specify all the values in between inlcuding the two.
A comma seperated list specify all the values listed.
Eg:
10 9 * * 0 = 10:10 AM every sunday
0 10-17 * * * = Everyday at 10AM, 11AM..5PM
15,30,45 9 * * * = Everyday 9:15 AM, 9:30AM and 9:45 AM
*/5 * * * * = Every 5 minutes
USER: the user account under whose privilege the cron job should be run.
The command to execute can be a standatd linux command or a script. Whatever thing that can be executed in shell can be substituted here.
At the starting of the file, we can set the environemnt variables under which the cron job should run. Comments can be inserted with '#'. You can see both these in the /etc/crontab example above.
The script `run-parts` that you see in the crontab file is a standard script that takes a directory as its argument and run all the binaries under that directory.
Individual users can manipulate only their personal crontab file. All other files are managed by root.
In addition to the directories mentioned above, there is one more directory /etc/cron.d. If you want to run task at a custom time, ie not every hour/day/week/month the files should be put in this directory.
crontab command
For individual users to manipulate their cronjobs, use the command crontab.
To add a new job or edit an existing:
[safeer@LinuxBox1 ~]$crontab -e
This will open /var/spool/cron/safeer in the default editor. Now the user can edit this file just like any text file.
To add a job to run a script under the home directory to run at 10 minutes after 10 AM every day
10 10 * * * ~/bin/backup.sh >> backup.log 2>&1
To view safeer's current crontab entries:
[safeer@LinuxBox1 ~]$crontab -l
10 10 * * * ~/bin/backup.sh >> backup.log 2>&1
To remove all the cuurent cron jobs for safeer:
[safeer@LinuxBox1 ~]$crontab -r
The root user can edit anu users cronjob with the -u switch. With this command root can edit the croontab for user safeer:
[root@LinuxBox1 ~]#crontab -[e/l/r] -u safeer
The service name for cron is crond. Use this to start or stop the service. You will hardly need to do this ever.
[root@LinuxBox1 ~]#service crond restart
Wednesday, May 23, 2007
Tuesday, May 22, 2007
VSFTPD Configuration
VSFTPD- Very Secure FTP Daemon is the default ftp server for RedHat flavours of linux. The version discussed here is 2.0.4.
The configuration directory for vsftpd is /etc/vsftpd.
Here is a short description of most common configuration options in the main configuration file: /etc/vsftpd/vsftpd.conf
Listen Port & Address
To change the listening port from default 21
listen_port=10021
By default vsftpd listen on all configured ip addresses. To configure vsftpd to listen on a single ip address
listen_address=65.17.45.85
User Management
Enable local system users of the ftp server to connect with their credentials
local_enable=YES
To restrict local users to their home directory (chroot)
chroot_local_user=YES
This will restrict all local users from accessing folders other than their home directory. If you want
to excempt some users from this restriction, you can specify a list of such user as follows.
chroot_list_enable=YES
chroot_list_file=/etc/vsftpd/chroot_list
/etc/vsftpd/chroot_list should contain the list of users who do not have the chroot restriction
If you set chroot_list_enable=NO or comment this line the file chroot_list will not be read by vsftpd
Anonymous Access
Enable anonymous user access. The home directory for anonymous user is /var/ftp
anonymous_enable=YES
If you want to allow anonymous users to upload files. This is disabled by default
anon_upload_enable=YES
Enable anonymous users to create directories. Disabled by default
anon_mkdir_write_enable=YES
To allow anonymous users to login without being prompted for a password:
no_anon_password=YES
Greeting/Message
FTP Welcome Banner
ftpd_banner=Welcome to XYZ Co Ltd FTP service.
Directory Message Enabling. Enabled by default
dirmessage_enable=YES
If this is enabled you can put a text file name .dirmessage in any directory that ftp user can access.
The contents of the file will be displayed to the ftp user when he changes to that directory.
Security
All users listed in the file /etc/vsftpd/ftpusers will be denied access to the ftp service
IF the entry userlist_enable is set to YES in vsftpd.conf, another file /etc/vsftpd/user_list is read for the users list.
But whether the users listed in this file are denied or allowed access depends on another directive in vsftpd.conf: If,
userlist_deny=NO
only users in this file will be allowed access. But if
userlist_deny=YES
the users in this file will also be denied ftp access.
The file ftpusers take precedence over user_list if the same user is listed in both files.
The file name user_list can be changed with
userlist_file=another_user_list_filename
The configuration directory for vsftpd is /etc/vsftpd.
Here is a short description of most common configuration options in the main configuration file: /etc/vsftpd/vsftpd.conf
Listen Port & Address
To change the listening port from default 21
listen_port=10021
By default vsftpd listen on all configured ip addresses. To configure vsftpd to listen on a single ip address
listen_address=65.17.45.85
User Management
Enable local system users of the ftp server to connect with their credentials
local_enable=YES
To restrict local users to their home directory (chroot)
chroot_local_user=YES
This will restrict all local users from accessing folders other than their home directory. If you want
to excempt some users from this restriction, you can specify a list of such user as follows.
chroot_list_enable=YES
chroot_list_file=/etc/vsftpd/chroot_list
/etc/vsftpd/chroot_list should contain the list of users who do not have the chroot restriction
If you set chroot_list_enable=NO or comment this line the file chroot_list will not be read by vsftpd
Anonymous Access
Enable anonymous user access. The home directory for anonymous user is /var/ftp
anonymous_enable=YES
If you want to allow anonymous users to upload files. This is disabled by default
anon_upload_enable=YES
Enable anonymous users to create directories. Disabled by default
anon_mkdir_write_enable=YES
To allow anonymous users to login without being prompted for a password:
no_anon_password=YES
Greeting/Message
FTP Welcome Banner
ftpd_banner=Welcome to XYZ Co Ltd FTP service.
Directory Message Enabling. Enabled by default
dirmessage_enable=YES
If this is enabled you can put a text file name .dirmessage in any directory that ftp user can access.
The contents of the file will be displayed to the ftp user when he changes to that directory.
Security
All users listed in the file /etc/vsftpd/ftpusers will be denied access to the ftp service
IF the entry userlist_enable is set to YES in vsftpd.conf, another file /etc/vsftpd/user_list is read for the users list.
But whether the users listed in this file are denied or allowed access depends on another directive in vsftpd.conf: If,
userlist_deny=NO
only users in this file will be allowed access. But if
userlist_deny=YES
the users in this file will also be denied ftp access.
The file ftpusers take precedence over user_list if the same user is listed in both files.
The file name user_list can be changed with
userlist_file=another_user_list_filename
Monday, May 21, 2007
Simple File Encryption with GPG
The easiest way to encrypt a file is to use the symmetric encryption provided by GPG (GNU Privacy Guard). This helps you to encrypt a file by providing a password. The same password is later used to decrypt the file.
Encryption
[safeer@LinuxBox1 ~]$echo "This is plain text" > file1_txt
Now encrypt this file with gpg
[safeer@LinuxBox1 ~]$ gpg -c file1_txt
Enter passphrase:
You will be prompted to enter the passphrase twice. Once the password is entered the encrypted file will be saved as "file1_txt.gpg". This will be a binary file. If you open this you will see a lot of unreadable characters. Instead if you want to make this readable use the armor option (ASCII format) as follows
[safeer@LinuxBox1 ~]$ gpg -c -a file1_txt
This will create a file "file1_txt.asc"
[safeer@LinuxBox1 ~]$ cat file1_txt
-----BEGIN PGP MESSAGE-----
Version: GnuPG v1.4.5 (GNU/Linux)
jA0EAwMCvQn1YCJCMmFgyTBooxld2Zo/Vb5hYg00Pyg1OMeaZ3CXIrICjUwHqj50
RKRRZMoQmvRnZzISt01uoZs=
=3UMZ
-----END PGP MESSAGE-----
This format is particularly useful when you are sending this file to somebody, most probably through e-mail. You will also have to let the receiver know the passsphrace, may be through phone or some other secure channel. Otherwise he wont be able to decrypt the file.
You can alternatively specify an output file other than the default -filename.(gpg/asc).
[safeer@LinuxBox1 ~]$ gpg -c -a --output file1.secure file1_txt
Now the encrypted output will be stored in "file1.secure".
Decryption
[safeer@LinuxBox1 ~]$ cp file1_txt.asc /tmp
[safeer@LinuxBox1 tmp]$ gpg file1_txt.asc
gpg: CAST5 encrypted data
Enter passphrase:
gpg: encrypted with 1 passphrase
gpg: WARNING: message was not integrity protected
This will create the plain text file file1_txt. If a file of this name already exist in the current directory, yo will be prompted whether to overwrite it, or provide an alternative file name as follows:
[safeer@LinuxBox1 tmp]$ gpg file1_txt.asc
gpg: CAST5 encrypted data
Enter passphrase:
gpg: encrypted with 1 passphrase
File `file1_txt' exists. Overwrite? (y/N) N
Enter new filename: file1_plain
gpg: WARNING: message was not integrity protected
If you want the decrypted output to be printed to standard output:
[safeer@LinuxBox1 tmp]$ gpg --decrypt file1_txt.asc
gpg: CAST5 encrypted data
Enter passphrase:
gpg: encrypted with 1 passphrase
This is plain text
gpg: WARNING: message was not integrity protected
Here also you can give an alternate output file name:
[safeer@LinuxBox1 tmp]$ gpg --decrypt --output file1.plain file1_txt.asc
Decryption method is the same for asc and gpg files.
This method uses symmetric key encryption which is not considered much secure nowadays, because the passphrase should also be shared. Generally asymmetric/public key encryption is preferred. But for a starter, this is good enough.
Beware! If you forget the encryption password, you are done. You will never be able to decrypt the file.
Encryption
[safeer@LinuxBox1 ~]$echo "This is plain text" > file1_txt
Now encrypt this file with gpg
[safeer@LinuxBox1 ~]$ gpg -c file1_txt
Enter passphrase:
You will be prompted to enter the passphrase twice. Once the password is entered the encrypted file will be saved as "file1_txt.gpg". This will be a binary file. If you open this you will see a lot of unreadable characters. Instead if you want to make this readable use the armor option (ASCII format) as follows
[safeer@LinuxBox1 ~]$ gpg -c -a file1_txt
This will create a file "file1_txt.asc"
[safeer@LinuxBox1 ~]$ cat file1_txt
-----BEGIN PGP MESSAGE-----
Version: GnuPG v1.4.5 (GNU/Linux)
jA0EAwMCvQn1YCJCMmFgyTBooxld2Zo/Vb5hYg00Pyg1OMeaZ3CXIrICjUwHqj50
RKRRZMoQmvRnZzISt01uoZs=
=3UMZ
-----END PGP MESSAGE-----
This format is particularly useful when you are sending this file to somebody, most probably through e-mail. You will also have to let the receiver know the passsphrace, may be through phone or some other secure channel. Otherwise he wont be able to decrypt the file.
You can alternatively specify an output file other than the default -filename.(gpg/asc).
[safeer@LinuxBox1 ~]$ gpg -c -a --output file1.secure file1_txt
Now the encrypted output will be stored in "file1.secure".
Decryption
[safeer@LinuxBox1 ~]$ cp file1_txt.asc /tmp
[safeer@LinuxBox1 tmp]$ gpg file1_txt.asc
gpg: CAST5 encrypted data
Enter passphrase:
gpg: encrypted with 1 passphrase
gpg: WARNING: message was not integrity protected
This will create the plain text file file1_txt. If a file of this name already exist in the current directory, yo will be prompted whether to overwrite it, or provide an alternative file name as follows:
[safeer@LinuxBox1 tmp]$ gpg file1_txt.asc
gpg: CAST5 encrypted data
Enter passphrase:
gpg: encrypted with 1 passphrase
File `file1_txt' exists. Overwrite? (y/N) N
Enter new filename: file1_plain
gpg: WARNING: message was not integrity protected
If you want the decrypted output to be printed to standard output:
[safeer@LinuxBox1 tmp]$ gpg --decrypt file1_txt.asc
gpg: CAST5 encrypted data
Enter passphrase:
gpg: encrypted with 1 passphrase
This is plain text
gpg: WARNING: message was not integrity protected
Here also you can give an alternate output file name:
[safeer@LinuxBox1 tmp]$ gpg --decrypt --output file1.plain file1_txt.asc
Decryption method is the same for asc and gpg files.
This method uses symmetric key encryption which is not considered much secure nowadays, because the passphrase should also be shared. Generally asymmetric/public key encryption is preferred. But for a starter, this is good enough.
Beware! If you forget the encryption password, you are done. You will never be able to decrypt the file.
Thursday, May 17, 2007
Cisco HTTP Server
The conventional way to access a router is to use router lines console,auxiliary or telnet. But there is another method which is more flexible. Cisco comes with a built in web server which once enabled can be accessed from anywhere in the network through the web browser. The configuration steps are as follows:
Enable http server
RouterA(config)#ip http server
Tell the server the base path where the web server files are located. Flash memory in this case:
RouterA(config)#ip http path flash:
If you want to change the port on which the web server listens (default 80),
RouterA(config)#ip http port 8080
Authentication
To access the router through web interface you should have a level 15 authentication. The default is to use enable password/secret. To change this beahaviour, we can use:
RouterA(config)#ip http authentication local
This instructs the router to use local user databases for user authentication. After this you can login through the web interface with a username and password configured for level 15 access.
To switch back to the default authentication with enable passwords:
RouterA(config)#ip http authentication enable
Enable http server
RouterA(config)#ip http server
Tell the server the base path where the web server files are located. Flash memory in this case:
RouterA(config)#ip http path flash:
If you want to change the port on which the web server listens (default 80),
RouterA(config)#ip http port 8080
Authentication
To access the router through web interface you should have a level 15 authentication. The default is to use enable password/secret. To change this beahaviour, we can use:
RouterA(config)#ip http authentication local
This instructs the router to use local user databases for user authentication. After this you can login through the web interface with a username and password configured for level 15 access.
To switch back to the default authentication with enable passwords:
RouterA(config)#ip http authentication enable
Monday, April 9, 2007
Linux Quota
Quota is used to limit the disk space used by a user or group on a particular file system, thus giving system administrators better control over their disk usage policies. The quota package helps implementing quota for Linux.
The first step in setting up quota is to enable quota for a file system partition. To do this, either remount the file system with appropriate mount options, or edit /etc/fstab to make the changes permanent.
Suppose your home partition is mounted on the file system /dev/hda5 and you want to enforce quota for users. Mount the file system with quota options,
/etc/fstab
/dev/hda5 /home ext3 defaults,usrquota,grpquota 0 0
usrquota : Enables per user quota
grpquota : Enables per group quota
Remount home partition
[root@LinuxBox1 ~]#mount -o remount /home
[root@LinuxBox1 ~]#mount|grep /home
/dev/hda5 on /home type ext3 (rw,usrquota,grpquota)
Quota information for a file system is stored in files aquota.user and aquota.group files under the root of the file system, in this case /home. This files will be owned and accessible only by root. You have to initialise these files first using quotacheck command.
[root@LinuxBox1 ~]#quotacheck -vgum /home
quotacheck: Scanning /dev/hda5 [/home] done
quotacheck: Checked 1708 directories and 8935 files
If you are using this command for the first time, you may see some errors about file not in correct format/missing. Its ok.
[root@LinuxBox1 ~]#ls -la /home/aquota*
-rw------- 1 root root 9216 Apr 10 04:44 /home/aquota.group
-rw------- 1 root root 8192 Apr 10 04:44 /home/aquota.user
Enable quota on /home partition with quotaon command
[root@LinuxBox1 ~]#quotaon /home
/dev/hda5 [/home]: group quotas turned on
/dev/hda5 [/home]: user quotas turned on
Now everything is set up correctly, we can set quota for user 'safeer' using edquota command. This will open a file in your default editor (most probably 'vi '). You have to change its values appropriately.
[root@LinuxBox1 ~]#edquota -f /home -u safeer
Disk quotas for user safeer (uid 507):
Filesystem blocks soft hard inodes soft hard
/dev/hda5 1020 0 0 14 0 0
blocks : Space in 1k blocks used by the user (Current usage is 1MB)
inodes : Number of files/folders created by user (14 files/folders in total)
soft : Warning limit of space used/number of files created by the user. User gets a warning when this limit is reached, but he can still create/modify files.
hard : Maximum of space used/number of files created by the user. User can't cross this limit.
Let us enforce a soft limit of 4 MB and hard limit of 5 MB on space usage.
[root@LinuxBox1 ~]#edquota -f /home -u safeer
Disk quotas for user safeer (uid 507):
Filesystem blocks soft hard inodes soft hard
/dev/hda5 1020 4096 5120 14 0 0
Note that we are not restricting the number of inodes
Let us check this by creating files as safeer
[root@LinuxBox1 ~]#su - safeer
[safeer@LinuxBox1 ~]$quota
Disk quotas for user safeer (uid 507):
Filesystem blocks quota limit grace files quota limit grace
/dev/hda5 1020 4096 5120 2 0 0
Users can use quota command to view his current quota usage and quota limits as above.
'safeer' is already using 1MB of disk space. Let us create a file of 2MB:
[safeer@LinuxBox1 ~]$dd if=/dev/zero of=./temp1 bs=1024 count=2048
2048+0 records in
2048+0 records out
2097152 bytes (2.1 MB) copied, 0.024208 seconds, 86.6 MB/s
This will work fine since user has not exceeded the quota limit.
Now create another file of 1.5MB, making the total disk usage 4.5 MB (exceeds softlimit of 4MB)
[safeer@LinuxBox1 ~]$dd if=/dev/zero of=./temp2 bs=1024 count=2560
hda5: warning, user block quota exceeded.
2048+0 records in
2048+0 records out
2097152 bytes (2.6 MB) copied, 0.024208 seconds, 86.6 MB/s
Again create another file of size 1MB, thus exceeding the hard limit:
[safeer@LinuxBox1 ~]$dd if=/dev/zero of=./temp3 bs=1024 count=1024
hda5: write failed, user block limit reached.
dd: writing `./temp3': Disk quota exceeded
497+0 records in
496+0 records out
507904 bytes (508 kB) copied, 0.007349 seconds, 69.1 MB/s
If you want to set quota based on inode or both inode & space in the same way.
You can also set quota for group using the command
[root@LinuxBox1 ~]#edquota -f /home -g developers
This will edit the quota for group 'developer'. One thing people often misunderstand is that group quota means total space/inodes used by all members of a group. But actually it is the size/inodes used by users who have this group as primary group.
Administrators will frequently need to check the status of user quotas.
To find out the quota usage of a particular user:
[root@LinuxBox1 ~]#quota -u safeer
Disk quotas for user safeer (uid 507):
Filesystem blocks quota limit grace files quota limit grace
/dev/hda5 5008* 4096 5010 6days 5 0 0
Similarly use -g option instead of -u to find the quota of a group
Instead of individual quota reports, you can get the quota report for the entire filesystem:
[root@LinuxBox1 ~]#repquota /home
*** Report for user quotas on device /dev/hda5
Block grace time: 7days; Inode grace time: 7days
Block limits File limits
User used soft hard grace used soft hard grace
----------------------------------------------------------------------
root -- 1172676 0 0 6109 0 0
vinu -- 239188 0 0 4347 0 0
safeer +- 5008 4096 5010 6days 5 0 0
nebu +- 5120 4096 5120 6days 4 0 0
This will list each users current usage as well as the limit for usage. Using repquota with -g option will give the group quota report. Use '-a' option to list quota of all patitions.
You can use the command warnquota to sent mail to all users who have exceeded quota. The message sent can be customeised by editing the file /etc/warnquota.conf. You should set an administrator for each group so that this administrators will be emailed when their groups exceed the quota (use command: warnquota -g). You can do this by editting /etc/quotagrpadmins, syntax of the file is group:admin_user.
The first step in setting up quota is to enable quota for a file system partition. To do this, either remount the file system with appropriate mount options, or edit /etc/fstab to make the changes permanent.
Suppose your home partition is mounted on the file system /dev/hda5 and you want to enforce quota for users. Mount the file system with quota options,
/etc/fstab
/dev/hda5 /home ext3 defaults,usrquota,grpquota 0 0
usrquota : Enables per user quota
grpquota : Enables per group quota
Remount home partition
[root@LinuxBox1 ~]#mount -o remount /home
[root@LinuxBox1 ~]#mount|grep /home
/dev/hda5 on /home type ext3 (rw,usrquota,grpquota)
Quota information for a file system is stored in files aquota.user and aquota.group files under the root of the file system, in this case /home. This files will be owned and accessible only by root. You have to initialise these files first using quotacheck command.
[root@LinuxBox1 ~]#quotacheck -vgum /home
quotacheck: Scanning /dev/hda5 [/home] done
quotacheck: Checked 1708 directories and 8935 files
If you are using this command for the first time, you may see some errors about file not in correct format/missing. Its ok.
[root@LinuxBox1 ~]#ls -la /home/aquota*
-rw------- 1 root root 9216 Apr 10 04:44 /home/aquota.group
-rw------- 1 root root 8192 Apr 10 04:44 /home/aquota.user
Enable quota on /home partition with quotaon command
[root@LinuxBox1 ~]#quotaon /home
/dev/hda5 [/home]: group quotas turned on
/dev/hda5 [/home]: user quotas turned on
Now everything is set up correctly, we can set quota for user 'safeer' using edquota command. This will open a file in your default editor (most probably 'vi '). You have to change its values appropriately.
[root@LinuxBox1 ~]#edquota -f /home -u safeer
Disk quotas for user safeer (uid 507):
Filesystem blocks soft hard inodes soft hard
/dev/hda5 1020 0 0 14 0 0
blocks : Space in 1k blocks used by the user (Current usage is 1MB)
inodes : Number of files/folders created by user (14 files/folders in total)
soft : Warning limit of space used/number of files created by the user. User gets a warning when this limit is reached, but he can still create/modify files.
hard : Maximum of space used/number of files created by the user. User can't cross this limit.
Let us enforce a soft limit of 4 MB and hard limit of 5 MB on space usage.
[root@LinuxBox1 ~]#edquota -f /home -u safeer
Disk quotas for user safeer (uid 507):
Filesystem blocks soft hard inodes soft hard
/dev/hda5 1020 4096 5120 14 0 0
Note that we are not restricting the number of inodes
Let us check this by creating files as safeer
[root@LinuxBox1 ~]#su - safeer
[safeer@LinuxBox1 ~]$quota
Disk quotas for user safeer (uid 507):
Filesystem blocks quota limit grace files quota limit grace
/dev/hda5 1020 4096 5120 2 0 0
Users can use quota command to view his current quota usage and quota limits as above.
'safeer' is already using 1MB of disk space. Let us create a file of 2MB:
[safeer@LinuxBox1 ~]$dd if=/dev/zero of=./temp1 bs=1024 count=2048
2048+0 records in
2048+0 records out
2097152 bytes (2.1 MB) copied, 0.024208 seconds, 86.6 MB/s
This will work fine since user has not exceeded the quota limit.
Now create another file of 1.5MB, making the total disk usage 4.5 MB (exceeds softlimit of 4MB)
[safeer@LinuxBox1 ~]$dd if=/dev/zero of=./temp2 bs=1024 count=2560
hda5: warning, user block quota exceeded.
2048+0 records in
2048+0 records out
2097152 bytes (2.6 MB) copied, 0.024208 seconds, 86.6 MB/s
Again create another file of size 1MB, thus exceeding the hard limit:
[safeer@LinuxBox1 ~]$dd if=/dev/zero of=./temp3 bs=1024 count=1024
hda5: write failed, user block limit reached.
dd: writing `./temp3': Disk quota exceeded
497+0 records in
496+0 records out
507904 bytes (508 kB) copied, 0.007349 seconds, 69.1 MB/s
If you want to set quota based on inode or both inode & space in the same way.
You can also set quota for group using the command
[root@LinuxBox1 ~]#edquota -f /home -g developers
This will edit the quota for group 'developer'. One thing people often misunderstand is that group quota means total space/inodes used by all members of a group. But actually it is the size/inodes used by users who have this group as primary group.
Administrators will frequently need to check the status of user quotas.
To find out the quota usage of a particular user:
[root@LinuxBox1 ~]#quota -u safeer
Disk quotas for user safeer (uid 507):
Filesystem blocks quota limit grace files quota limit grace
/dev/hda5 5008* 4096 5010 6days 5 0 0
Similarly use -g option instead of -u to find the quota of a group
Instead of individual quota reports, you can get the quota report for the entire filesystem:
[root@LinuxBox1 ~]#repquota /home
*** Report for user quotas on device /dev/hda5
Block grace time: 7days; Inode grace time: 7days
Block limits File limits
User used soft hard grace used soft hard grace
----------------------------------------------------------------------
root -- 1172676 0 0 6109 0 0
vinu -- 239188 0 0 4347 0 0
safeer +- 5008 4096 5010 6days 5 0 0
nebu +- 5120 4096 5120 6days 4 0 0
This will list each users current usage as well as the limit for usage. Using repquota with -g option will give the group quota report. Use '-a' option to list quota of all patitions.
You can use the command warnquota to sent mail to all users who have exceeded quota. The message sent can be customeised by editing the file /etc/warnquota.conf. You should set an administrator for each group so that this administrators will be emailed when their groups exceed the quota (use command: warnquota -g). You can do this by editting /etc/quotagrpadmins, syntax of the file is group:admin_user.
Subscribe to:
Posts (Atom)