10 KiB
Task 1
To accommodate the backup agent tool's specifications, the system admin team at xFusionCorp Industries requires the creation of a user with a non-interactive shell. Here's your task:
Create a user named siva with a non-interactive shell on App Server 2.
sudo useradd -s /sbin/nologin siva
# Verify
grep siva /etc/passwd
Task 2
As part of the temporary assignment to the Nautilus project, a developer named siva requires access for a limited duration. To ensure smooth access management, a temporary user account with an expiry date is needed. Here's what you need to do:
Create a user named siva on App Server 1 in Stratos Datacenter. Set the expiry date to 2027-04-15, ensuring the user is created in lowercase as per standard protocol.
sudo useradd -e 2027-04-15 siva
# Verify
sudo chage -l siva | grep -i expire
Task 3
Your task is to disable direct SSH root login on all app servers within the Stratos Datacenter.
App servers are these: Server Name IP Hostname User Password Purpose Application Server 1 Dynamic stapp01 tony Ir0nM@n Hosts Nautilus Application 1 Application Server 2 Dynamic stapp02 steve Am3ric@ Hosts Nautilus Application 2 Application Server 3 Dynamic stapp03 banner BigGr33n Hosts Nautilus Application 3
cat > harden_ssh.sh <<'SCRIPT'
#!/usr/bin/env bash
set -euo pipefail
CREDS="${1:-creds.txt}"
REMOTE_CMD='
echo "$SUDO_PASS" | sudo -S -p "" sed -i "s/^#*\s*PermitRootLogin.*/PermitRootLogin no/" /etc/ssh/sshd_config &&
echo "$SUDO_PASS" | sudo -S -p "" sshd -t &&
echo "$SUDO_PASS" | sudo -S -p "" systemctl restart sshd &&
echo "--- $(hostname) effective config ---" &&
echo "$SUDO_PASS" | sudo -S -p "" sshd -T | grep -i permitrootlogin
'
while read -r host user pass <&3; do
[[ -z "$host" || "$host" == \#* ]] && continue
echo "==> Hardening $host"
SSHPASS="$pass" sshpass -e ssh -n \
-o StrictHostKeyChecking=no \
-o UserKnownHostsFile=/dev/null \
-o LogLevel=ERROR \
"$user@$host" \
"SUDO_PASS='$pass' bash -c '$REMOTE_CMD'"
echo
done 3< "$CREDS"
SCRIPT
chmod +x harden_ssh.sh
# --- deps ---
sudo yum install -y sshpass 2>/dev/null || sudo apt install -y sshpass
./harden_ssh.sh
Task 4
Your task is to grant executable permissions to the /tmp/xfusioncorp.sh script on App Server 1. Additionally, ensure that all users have the capability to execute it.
chmod a+rx /tmp/xfusioncorp.sh
Task 5
Following a security audit, the xFusionCorp Industries security team has opted to enhance application and server security with SELinux. To initiate testing, the following requirements have been established for App server 2 in the Stratos Datacenter:
Install the required SELinux packages.
Permanently disable SELinux for the time being; it will be re-enabled after necessary configuration changes.
No need to reboot the server, as a scheduled maintenance reboot is already planned for tonight.
Disregard the current status of SELinux via the command line; the final status after the reboot should be disabled.
sudo yum install -y selinux-policy selinux-policy-targeted policycoreutils policycoreutils-python-utils libselinux-utils setools-console mcstrans
sudo sed -i 's/^SELINUX=.*/SELINUX=disabled/' /etc/selinux/config
# verify
grep '^SELINUX=' /etc/selinux/config
Task 6
The Nautilus system admins team has prepared scripts to automate several day-to-day tasks. They want them to be deployed on all app servers in Stratos DC on a set schedule. Before that they need to test similar functionality with a sample cron job. Therefore, perform the steps below:
a. Install cronie package on all Nautilus app servers and start crond service. b. Add a cron */5 * * * * echo hello > /tmp/cron_text for root user
# --- creds ---
cat > creds.txt <<'EOF'
stapp01 tony Ir0nM@n
stapp02 steve Am3ric@
stapp03 banner BigGr33n
EOF
chmod 600 creds.txt
# --- deploy script ---
cat > deploy_cron.sh <<'SCRIPT'
#!/usr/bin/env bash
set -euo pipefail
CREDS="${1:-creds.txt}"
# Everything runs inside one root shell: authenticate sudo ONCE via -S,
# then stdin is free for the crontab pipe inside.
REMOTE_CMD='
yum install -y cronie
systemctl enable --now crond
echo "*/5 * * * * echo hello > /tmp/cron_text" | crontab -u root -
echo "--- $(hostname) ---"
systemctl is-active crond
crontab -u root -l
'
while read -r host user pass <&3; do
[[ -z "$host" || "$host" == \#* ]] && continue
echo "==> Deploying cron on $host"
SSHPASS="$pass" sshpass -e ssh -n \
-o StrictHostKeyChecking=no \
-o UserKnownHostsFile=/dev/null \
-o LogLevel=ERROR \
"$user@$host" \
"echo '$pass' | sudo -S -p '' bash -c '$REMOTE_CMD'" \
2> >(grep -v '^\[sudo\]' >&2)
echo
done 3< "$CREDS"
SCRIPT
chmod +x deploy_cron.sh
# --- run ---
./deploy_cron.sh
Task 7
The system admins team of xFusionCorp Industries has set up some scripts on jump host that run on regular intervals and perform operations on all app servers in Stratos Datacenter. To make these scripts work properly we need to make sure the thor user on jump host has password-less SSH access to all app servers through their respective sudo users (i.e tony for app server 1). Based on the requirements, perform the following:
Set up a password-less authentication from user thor on jump host to all app servers through their respective sudo users.
ssh-keygen -t rsa -b 4096 -N '' -f ~/.ssh/id_rsa
# --- creds ---
cat > creds.txt <<'EOF'
stapp01 tony Ir0nM@n
stapp02 steve Am3ric@
stapp03 banner BigGr33n
EOF
chmod 600 creds.txt
# --- copy keys ---
cat > setup_keys.sh <<'SCRIPT'
#!/usr/bin/env bash
set -euo pipefail
CREDS="${1:-creds.txt}"
while read -r host user pass <&3; do
[[ -z "$host" || "$host" == \#* ]] && continue
echo "==> Copying key to $host"
SSHPASS="$pass" sshpass -e ssh-copy-id \
-o StrictHostKeyChecking=no \
-o UserKnownHostsFile=/dev/null \
"$user@$host"
done 3< "$CREDS"
SCRIPT
chmod +x setup_keys.sh
./setup_keys.sh
Task 8
During the weekly meeting, the Nautilus DevOps team discussed about the automation and configuration management solutions that they want to implement. While considering several options, the team has decided to go with Ansible for now due to its simple setup and minimal pre-requisites. The team wanted to start testing using Ansible, so they have decided to use jump host as an Ansible controller to test different kind of tasks on rest of the servers.
Install ansible version 4.10.0 on Jump host using pip3 only. Make sure Ansible binary is available globally on this system, i.e all users on this system are able to run Ansible commands.
sudo pip3 install ansible==4.10.0
# verify
ansible --version
which ansible # want /usr/local/bin/ansible
Task 9
There is a critical issue going on with the Nautilus application in Stratos DC. The production support team identified that the application is unable to connect to the database. After digging into the issue, the team found that mariadb service is down on the database server.
systemctl enable mariadb
sudo chown mysql:mysql /run/mariadb
sudo chmod 755 /run/mariadb
sudo systemctl start mariadb
sudo systemctl status mariadb --no-pager
systemctl start mariadb
Task 10
The production support team of xFusionCorp Industries is working on developing some bash scripts to automate different day to day tasks. One is to create a bash script for archiving website content files. They have a static website running on App Server 1 in Stratos Datacenter, and they need to create a bash script named beta_archive.sh which should accomplish the following tasks. (Also remember to place the script under the /scripts directory on App Server 1).
a. Create a zip archive named xfusioncorp_beta.zip of /var/www/html/beta directory.
b. Save the archive in the /archives/ directory on the App Server 1. This is a temporary storage, as archives from this location will be cleaned on a weekly basis. Therefore, the archive should also be copied to the Nautilus Storage Server so it can be retrieved later for validation purposes.
c. Copy the created archive to the Nautilus Storage Server server in the /archives/ location.
d. Please make sure script won't ask for password while copying the archive file. Additionally, the respective server user (for example, tony in case of App Server 1) must be able to run it.
e. Do not use sudo inside the script.
Note: The zip package must be installed on given App Server before executing the script. This package is essential for creating the zip archive of the website files. Install it manually outside the script.
# install zip (task explicitly says do this manually)
sudo yum install -y zip
# make dirs, owned by tony so script needs no sudo
sudo mkdir -p /scripts /archives
sudo chown tony:tony /scripts /archives
# --- on stapp01, as tony ---
# generate tony's key if he doesn't have one
[ -f ~/.ssh/id_rsa ] || ssh-keygen -t rsa -b 4096 -N '' -f ~/.ssh/id_rsa
# creds for the storage server (the only target for this task)
cat > /tmp/creds.txt <<'EOF'
ststor01 natasha Bl@kW
EOF
chmod 600 /tmp/creds.txt
# distribute tony's pubkey to storage server
cat > /tmp/setup_keys.sh <<'SCRIPT'
#!/usr/bin/env bash
set -euo pipefail
CREDS="${1:-/tmp/creds.txt}"
while read -r host user pass <&3; do
[[ -z "$host" || "$host" == \#* ]] && continue
echo "==> Copying tony's key to $host"
SSHPASS="$pass" sshpass -e ssh-copy-id \
-o StrictHostKeyChecking=no \
-o UserKnownHostsFile=/dev/null \
"$user@$host"
done 3< "$CREDS"
SCRIPT
chmod +x /tmp/setup_keys.sh
/tmp/setup_keys.sh
# verify passwordless works
ssh -o BatchMode=yes -o StrictHostKeyChecking=no natasha@ststor01 hostname
# archive copying script
cat > /scripts/beta_archive.sh <<'EOF'
#!/usr/bin/env bash
set -euo pipefail
SRC="/var/www/html/beta"
ARCHIVE_NAME="xfusioncorp_beta.zip"
LOCAL_DIR="/archives"
REMOTE_USER="natasha"
REMOTE_HOST="ststor01"
REMOTE_DIR="/archives"
# a + b: create zip in local /archives
zip -r "${LOCAL_DIR}/${ARCHIVE_NAME}" "$SRC"
# c: copy to storage server (passwordless via key)
scp "${LOCAL_DIR}/${ARCHIVE_NAME}" "${REMOTE_USER}@${REMOTE_HOST}:${REMOTE_DIR}/"
echo "Archive created and copied: ${ARCHIVE_NAME}"
EOF
chmod +x /scripts/beta_archive.sh