LFCS Phase 1 Part 19: Understanding /var and /etc - Configuration and Variable Data

# List /var
ls -lh /var

# Check total size
du -sh /var

# Check subdirectories
sudo du -sh /var/* | sort -rh

# Typically largest: /var/log, /var/cache, /var/lib

# Count items
ls /var | wc -l

# Navigate to logs
cd /var/log

# View recent messages (CentOS/RHEL)
sudo tail -20 /var/log/messages

# Or on Ubuntu/Debian
sudo tail -20 /var/log/syslog

# Follow logs in real-time
sudo tail -f /var/log/messages

# Press Ctrl+C to stop

# Search for specific term
sudo grep -i error /var/log/messages | tail -10

# View authentication logs
sudo tail /var/log/secure  # CentOS/RHEL
sudo tail /var/log/auth.log  # Ubuntu/Debian

# List /etc
ls /etc | head -30

# Count files
ls /etc | wc -l

# Typically 100-200+ items

# View passwd
cat /etc/passwd | head -10

# Find your user
grep "^$USER:" /etc/passwd

# View hosts
cat /etc/hosts

# View hostname
cat /etc/hostname

# Go to logs
cd /var/log

# List by size
ls -lhS

# See total size
du -sh /var/log

# Find largest logs
sudo du -sh /var/log/* | sort -rh | head -10

# Check for rotated logs
ls -lh messages*
# Output: messages, messages-20241105, messages-20241029.gz

# Compressed old logs save space!

# Navigate to cache
cd /var/cache

# List contents
ls

# Check package cache size (CentOS/RHEL)
sudo du -sh /var/cache/dnf

# Or Ubuntu/Debian
sudo du -sh /var/cache/apt

# List cached packages
sudo ls /var/cache/dnf/*/packages/ 2>/dev/null | head -20

# Or
sudo ls /var/cache/apt/archives/ | head -20

# View passwd file
cat /etc/passwd

# Find your user
grep "^$USER:" /etc/passwd

# System users (UID < 1000)
awk -F: '$3 < 1000 {print $1 " (UID: " $3 ")"}' /etc/passwd | head -10

# Regular users (UID >= 1000)
awk -F: '$3 >= 1000 {print $1 " (UID: " $3 ")"}' /etc/passwd

# Find users with no login shell (disabled)
grep '/nologin$' /etc/passwd | head -5

# Extract just usernames
cut -d: -f1 /etc/passwd | head -10

# Extract usernames and home directories
awk -F: '{print $1 ": " $6}' /etc/passwd | head -10

# Check both directories
ls -ld /tmp /var/tmp

# Both should show sticky bit (t at the end)
# drwxrwxrwt

# Create test files
echo "test" > /tmp/tempfile
echo "test" > /var/tmp/vartempfile

# Check them
ls -l /tmp/tempfile
ls -l /var/tmp/vartempfile

# Key difference: /tmp cleared on reboot
# /var/tmp persists across reboots

# Check sizes
du -sh /tmp /var/tmp

# Clean up
rm /tmp/tempfile /var/tmp/vartempfile

# Search for errors
sudo grep -i error /var/log/messages | tail -20

# Search for user logins
sudo grep "session opened" /var/log/secure | tail -10

# Count failed login attempts
sudo grep "Failed password" /var/log/secure | wc -l

# Find logs from today
sudo grep "$(date +'%b %e')" /var/log/messages | tail -20

# Find SSH connections
sudo grep sshd /var/log/secure | tail -20

# Multiple patterns with egrep
sudo egrep "error|fail|warning" /var/log/messages -i | tail -20

# Get context around matches
sudo grep -C 3 "error" /var/log/messages | tail -30

# View fstab
cat /etc/fstab

# Remove comments and empty lines
cat /etc/fstab | grep -v '^#' | grep -v '^$'

# Identify fields:
# 1: Device (UUID or path)
# 2: Mount point
# 3: Filesystem type
# 4: Options
# 5: Dump (0 or 1)
# 6: Pass (fsck order)

# Find root filesystem
grep " / " /etc/fstab

# Find UUID of current root
findmnt -n -o UUID /

# List all mounts
findmnt

# Verify fstab syntax (doesn't mount, just checks)
sudo mount -fav

# Main logrotate config
cat /etc/logrotate.conf

# Application-specific configs
ls /etc/logrotate.d/

# View specific rotation config
cat /etc/logrotate.d/syslog

# Typical settings:
# - weekly: rotate weekly
# - rotate 4: keep 4 old copies
# - compress: gzip old logs
# - delaycompress: compress on next rotation

# Manually force rotation (test only!)
sudo logrotate -f /etc/logrotate.conf

# Check rotated logs
ls -lh /var/log/messages*

# Navigate to spool
cd /var/spool

# List spool directories
ls -l

# Check mail spool
ls -lh /var/spool/mail/

# Check your mailbox
ls -lh /var/spool/mail/$USER 2>/dev/null

# View mail (if any)
cat /var/spool/mail/$USER 2>/dev/null

# Check cron spool
sudo ls /var/spool/cron/

# User crontabs stored here
sudo cat /var/spool/cron/$USER 2>/dev/null

# Check at jobs
ls /var/spool/at/ 2>/dev/null

# Find files modified in last 7 days
find /etc -type f -mtime -7

# Sort by modification time (newest first)
find /etc -type f -mtime -7 -exec ls -lt {} \; | head -20

# Or simpler with ls
ls -lt /etc | head -20

# Find files modified today
find /etc -type f -mtime 0

# Check specific file modification time
stat /etc/passwd

# See what changed in a file (if using git)
cd /etc
sudo git diff HEAD passwd

# Create backup directory
sudo mkdir -p /root/etc-backups

# Backup critical files with timestamp
DATE=$(date +%Y%m%d)

sudo cp /etc/passwd /root/etc-backups/passwd.$DATE
sudo cp /etc/group /root/etc-backups/group.$DATE
sudo cp /etc/shadow /root/etc-backups/shadow.$DATE
sudo cp /etc/fstab /root/etc-backups/fstab.$DATE
sudo cp /etc/hosts /root/etc-backups/hosts.$DATE
sudo cp /etc/hostname /root/etc-backups/hostname.$DATE

# Or backup entire /etc
sudo tar czf /root/etc-backup-$DATE.tar.gz /etc

# Verify backup
sudo tar tzf /root/etc-backup-$DATE.tar.gz | head -20

# List backups
sudo ls -lh /root/etc-backups/

# Create log analysis script
cat > ~/analyze-logs.sh << 'EOF'
#!/bin/bash

echo "=== Log Analysis Report ==="
echo "Generated: $(date)"
echo

# Failed login attempts
echo "Failed Login Attempts:"
sudo grep "Failed password" /var/log/secure 2>/dev/null | wc -l

# Successful logins
echo "Successful Logins:"
sudo grep "session opened" /var/log/secure 2>/dev/null | wc -l

# Top 5 error messages
echo -e "\nTop 5 Error Types:"
sudo grep -i error /var/log/messages 2>/dev/null | \
    awk '{for(i=5;i<=NF;i++) printf "%s ", $i; print ""}' | \
    sort | uniq -c | sort -rn | head -5

# Most active users
echo -e "\nMost Active Users:"
sudo grep "session opened" /var/log/secure 2>/dev/null | \
    awk '{print $(NF-5)}' | sort | uniq -c | sort -rn | head -5

# System start times
echo -e "\nRecent System Boots:"
sudo grep "systemd\[1\]: Startup finished" /var/log/messages 2>/dev/null | tail -5
EOF

chmod +x ~/analyze-logs.sh

# Run it
~/analyze-logs.sh

# Create monitoring script
cat > ~/var-monitor.sh << 'EOF'
#!/bin/bash

LOGFILE=~/var-usage-$(date +%Y%m%d).log

echo "=== /var Usage Report ===" | tee $LOGFILE
echo "Date: $(date)" | tee -a $LOGFILE
echo | tee -a $LOGFILE

# Total /var size
echo "Total /var Usage:" | tee -a $LOGFILE
du -sh /var | tee -a $LOGFILE
echo | tee -a $LOGFILE

# Subdirectory sizes
echo "Subdirectory Breakdown:" | tee -a $LOGFILE
sudo du -sh /var/* | sort -rh | head -10 | tee -a $LOGFILE
echo | tee -a $LOGFILE

# Largest log files
echo "Largest Log Files:" | tee -a $LOGFILE
sudo find /var/log -type f -size +10M -exec ls -lh {} \; 2>/dev/null | tee -a $LOGFILE
echo | tee -a $LOGFILE

# Cache sizes
echo "Cache Sizes:" | tee -a $LOGFILE
sudo du -sh /var/cache/* 2>/dev/null | sort -rh | head -5 | tee -a $LOGFILE

echo "Report saved to: $LOGFILE"
EOF

chmod +x ~/var-monitor.sh

# Run it
~/var-monitor.sh

# Run daily with cron
(crontab -l 2>/dev/null; echo "0 2 * * * ~/var-monitor.sh") | crontab -

# Create backup script
cat > ~/backup-etc.sh << 'EOF'
#!/bin/bash

BACKUP_DIR=~/etc-snapshots
DATE=$(date +%Y%m%d-%H%M%S)
BACKUP_FILE="etc-snapshot-$DATE.tar.gz"

mkdir -p $BACKUP_DIR

echo "Creating /etc snapshot..."

# Create compressed backup
sudo tar czf $BACKUP_DIR/$BACKUP_FILE /etc

# Create file list
sudo tar tzf $BACKUP_DIR/$BACKUP_FILE > $BACKUP_DIR/filelist-$DATE.txt

# Create checksums
cd $BACKUP_DIR
sha256sum $BACKUP_FILE > $BACKUP_FILE.sha256

echo "Backup created: $BACKUP_DIR/$BACKUP_FILE"
echo "Size: $(ls -lh $BACKUP_DIR/$BACKUP_FILE | awk '{print $5}')"
echo "Files: $(wc -l < $BACKUP_DIR/filelist-$DATE.txt)"

# Keep only last 10 backups
ls -t $BACKUP_DIR/etc-snapshot-*.tar.gz | tail -n +11 | xargs rm -f 2>/dev/null

echo "Old backups cleaned. Keeping 10 most recent."
EOF

chmod +x ~/backup-etc.sh

# Run it
~/backup-etc.sh

# Verify backup
cd ~/etc-snapshots
sha256sum -c etc-snapshot-*.sha256 | tail -1

# View your entry in shadow (safe - no password revealed)
sudo grep "^$USER:" /etc/shadow | cut -d: -f1,3-9

# Shadow fields (after username and password):
# 3: Last password change (days since epoch)
# 4: Minimum password age
# 5: Maximum password age
# 6: Warning period
# 7: Inactivity period
# 8: Account expiration date
# 9: Reserved

# Check password aging for all users
sudo awk -F: '{print $1 ": Max age=" $5 " days, Warning=" $6 " days"}' /etc/shadow | head -10

# Find accounts that never expire
sudo awk -F: '$5 == "" || $5 == "99999" {print $1}' /etc/shadow

# Find locked accounts (password starts with !)
sudo awk -F: '$2 ~ /^!/ {print $1 " (locked)"}' /etc/shadow

# Find accounts with no password (dangerous!)
sudo awk -F: '$2 == "" {print $1 " (NO PASSWORD!)"}' /etc/shadow

# Check current /var usage
df -h /var

# Clean package cache (safe)
# CentOS/RHEL
sudo dnf clean all

# Ubuntu/Debian
sudo apt clean
sudo apt autoclean

# Remove old journal logs (keep last 7 days)
sudo journalctl --vacuum-time=7d

# Find large log files
sudo find /var/log -type f -size +100M

# Rotate logs manually (if needed)
sudo logrotate -f /etc/logrotate.conf

# Remove old rotated logs (older than 60 days)
sudo find /var/log -name "*.gz" -mtime +60 -delete

# Check space freed
df -h /var

# Verify system still works
systemctl status
journalctl -n 20

# Install etckeeper
# CentOS/RHEL
sudo dnf install etckeeper git

# Ubuntu/Debian
sudo apt install etckeeper git

# Initialize (creates git repo in /etc)
sudo etckeeper init
sudo etckeeper commit "Initial commit"

# Make a test change
echo "# Test comment" | sudo tee -a /etc/hosts

# Commit the change
sudo etckeeper commit "Added test comment to hosts"

# View history
cd /etc
sudo git log --oneline

# See what changed
sudo git diff HEAD~1 HEAD

# See uncommitted changes
sudo git status

# View all changes to a specific file
sudo git log --follow --all -- hosts

# Revert a file to previous version
sudo git checkout HEAD~1 -- hosts

cat > ~/system-config-report.sh << 'EOF'
#!/bin/bash

REPORT=~/system-report-$(date +%Y%m%d).txt

cat > $REPORT << 'REPORT'
====================================================
SYSTEM CONFIGURATION REPORT
====================================================

Generated: $(date)
Hostname: $(hostname)
Kernel: $(uname -r)

=== /var ANALYSIS ===

Total /var Usage:
$(du -sh /var)

Top 10 Largest Directories in /var:
$(sudo du -sh /var/* | sort -rh | head -10)

Recent Log Activity:
$(sudo tail -5 /var/log/messages 2>/dev/null || sudo tail -5 /var/log/syslog)

=== /etc ANALYSIS ===

Total /etc Size:
$(sudo du -sh /etc)

Recent /etc Changes (last 7 days):
$(sudo find /etc -type f -mtime -7 | wc -l) files modified

Critical File Status:
/etc/passwd: $(wc -l < /etc/passwd) users
/etc/group: $(wc -l < /etc/group) groups
/etc/hosts: $(grep -v '^#' /etc/hosts | grep -v '^$' | wc -l) entries
/etc/fstab: $(grep -v '^#' /etc/fstab | grep -v '^$' | wc -l) filesystems

Hostname Configuration:
$(cat /etc/hostname)

=== DISK USAGE SUMMARY ===
$(df -h)

====================================================
REPORT

cat $REPORT
echo "Report saved to: $REPORT"
EOF

chmod +x ~/system-config-report.sh

# Run it
~/system-config-report.sh