Users, Groups and their permissions, Debian Wheezy 7.2.

Users, Groups and their permissions, Debian Wheezy 7.2.

In this tutorial we’ll talk about users, groups and their permissions on files and directories.
We’ll guide you how to add users and make them members of groups.
At this point we’ve only one default user installed.
Let’s see wich user is active by using whoami commando.
Type whoami + enter.
We see user “anne” is logged into our system.

anne@alfa:~$ whoami
anne
anne@alfa:~$

You can use who commando to see all users on your system.
We didn’t execute that but we used users commando instead of who.
Type users + enter.

anne@alfa:~$ users
anne anne
anne@alfa:~$

Our output displays “anne” twice.
Our Debian Wheezy system handles different kinds of users and groups.
The first “anne” is the user itself (owner) and the second “anne” correspond her primary group membership.
Users can be member of primary and supplementary groups.
This will be discussed later on.
Short description of the characters u.g.o.a. used on our Debian Wheezy systeem.
u = user (owner)
g = group (group which user belongs to)
o = other (everyone who logged local or on a remote machine)
a = All users belonging to u,g and o.

Each file or directory created by the user “anne” becomes her property and she’ll have read, write and execute permission in her /home/anne directory.
The primary group “anne” and the “others” (everyone) have read and execute rights on the folders and subdirectories owned by anne.
Take in account that all users belonging to others can read the contents of the /home/anne directory.
This is in fact a security breach and it must be taken care off.
How to do that will be discussed later on.
Luckily nobody have write permission on /home/anne except “anne” and user “root”.
Let’s take a closer look at our permissions in the home directory of “anne”.
Type ls -l + enter.

anne@alfa:~$ pwd
/home/anne
anne@alfa:~$ ls -l
total 32
drwxr-xr-x 3 anne anne 4096 Nov  4 16:09 Desktop
drwxr-xr-x 3 anne anne 4096 Dec  1 14:51 Documents
drwxr-xr-x 2 anne anne 4096 Nov 16 20:18 Downloads
drwxr-xr-x 2 anne anne 4096 Oct 17 16:25 Music
drwxr-xr-x 2 anne anne 4096 Dec  7 13:05 Pictures
drwxr-xr-x 2 anne anne 4096 Oct 17 16:25 Public
drwxr-xr-x 2 anne anne 4096 Oct 17 16:25 Templates
drwxr-xr-x 2 anne anne 4096 Oct 17 16:25 Videos
anne@alfa:~$

We’ll explain our output displayed above.
d = directory
l = link (not displayed in this output)
– = file (not displayed in this output)
rwx = read, write, execute permission user anne
r-w = read, execute permission primary group anne
r-w = read, execute permission others (everyone)
3 = number of available links to directory
anne = user (owner)
anne = primary group anne which user anne belongs to
4096 = size of the direcoty in bytes
Nov = month of last modification directory
4 = date of last modification directory
16:09 = time stamp last modification directory
Desktop = name of the directory

Let’s examine our directory root /.
De root directory is the home directory owned by the user root.
The user root has full permission over the whole system even not owned folders and files.
The users which belongs to the primary group ‘root’ and ‘others’ are permitted to read and execute.
This mean everyone can read those directories but they aren’t able to write.
It’s nice to explore those directories who has learning purposes.
Our system is a free examine “place” to explore and having fun.
In a company environment can this affect the security purposes.
We’ll discus this later on.
Typ cd / + enter and than type ls -l + enter.

anne@alfa:~$ cd /
anne@alfa:/$ ls -l
total 88
drwxr-xr-x   2 root root  4096 Oct 17 16:12 bin
drwxr-xr-x   3 root root  4096 Oct 17 16:16 boot
drwxr-xr-x  14 root root  3160 Jan  9 17:59 dev
drwxr-xr-x 133 root root 12288 Jan  9 17:59 etc
drwxr-xr-x   3 root root  4096 Oct 17 16:18 home
lrwxrwxrwx   1 root root    30 Oct 17 15:47 initrd.img -> /boot/initrd.img-3.2.0-4-amd64
drwxr-xr-x  16 root root  4096 Oct 17 16:12 lib
drwxr-xr-x   2 root root  4096 Oct 17 15:46 lib64
drwx——   2 root root 16384 Oct 17 15:45 lost+found
drwxr-xr-x   4 root root  4096 Oct 25 11:57 media
drwxr-xr-x   2 root root  4096 Sep 23 00:31 mnt
drwxr-xr-x   2 root root  4096 Oct 17 15:46 opt
dr-xr-xr-x 135 root root     0 Jan  9 17:59 proc
drwx——   9 root root  4096 Dec 12 17:35 root
drwxr-xr-x  19 root root   840 Jan  9 18:03 run
drwxr-xr-x   2 root root  4096 Oct 17 16:19 sbin
drwxr-xr-x   2 root root  4096 Jun 10  2012 selinux
drwxr-xr-x   2 root root  4096 Oct 17 15:46 srv
drwxr-xr-x  13 root root     0 Jan  9 17:59 sys
drwxrwxrwt   9 root root  4096 Jan  9 19:17 tmp
drwxr-xr-x  10 root root  4096 Oct 17 15:46 usr
drwxr-xr-x  12 root root  4096 Oct 17 16:14 var
lrwxrwxrwx   1 root root    26 Oct 17 15:47 vmlinuz -> boot/vmlinuz-3.2.0-4-amd64
anne@alfa:/$

Let’s make a direcoty “TEST” into / directory.
Be aware you’re logged in as default user $.
Type mkdir TEST + enter.
Your prompt will display “mkdir: cannot create directory `TEST’: Permission denied”.
As you already know the user root has ownership of the directory root.
At default the user root is the only one that can change every file and directory into our system.
User anne has no write permission, only read and execute.

We’ll create a second user Eddy and his /home/Eddy directory.
We’ve two commando’s available, useradd and adduser.
Adduser will create the new user at a interactive manner instead useradd.
We’ve chosen the low level utility useradd using the arguments -m and -U.
Short explanation of our arguments we’ll using to create new user Eddy.
-m:
Create the user’s home directory if it does not exist.
The files and directories contained in the skeleton directory (which can be defined with the
-k option) will be copied to the home directory.

-U:
Create a group with the same name as the user, and add the user to this group.
The default behavior (if the -g, -N, and -U options are not specified)
is defined by the USERGROUPS_ENAB variable in /etc/login.defs.

-p:
–password PASSWORD
The encrypted password, as returned by crypt (3).
The default is to disable the password.
Note: This option is not recommended because the password (or encrypted password) will be visible by users
listing the processes.
You should make sure the password respects the system’s password policy.

-p:
This argument will be not used because this will be visible in our terminal history.
The password will be provided using passwd commando instead useradd -p.

Let’s create user Eddy.
First login as root by typing su + enter.
You’ll be asked to fill in your “root” password + enter.
Your prompt shows # sign being root.

anne@alfa:~$ su
Password:
root@alfa:/home/anne#

Type useradd -m -U Eddy + enter.
The new user Eddy and his home directory is added into our system.

root@alfa:/home/anne# useradd -m -U Eddy
root@alfa:/home/anne#

Check Eddy’s /home directoy by using ls command.
Our new user’s home directory has been made successfully.
Type ls -l /home + enter.

root@alfa:/home/anne# ls /home
anne  Eddy
root@alfa:/home/anne#

Restart your computer to take affect modifications.
Our user Eddy has no login password set and would be unable to login the system.
We’ll provide one at Eddy but he must change it at first login.
We’re still logged as user root so we can carry on.
Type passwd Eddy + enter.
You’ll be asked to enter Eddy’s password + enter.
Retype the same password as your first attempt +enter.
At most companies it’s a mandatory task for new user to change their login passwords.
In most cases it’s forbidden to share login passwords even by system administrators.
Users can change their own password using the same command without being root.
If users can’t remember their passwords only sysadmins are able to provide new ones.
Our user Eddy has received his password provided by our system administrator and would be able to use his freshly created account.

root@alfa:~# passwd Eddy
Enter new UNIX password: (sdf123456)
Retype new UNIX password: (sdf123456)
passwd: password updated successfully
root@alfa:~#

Now we’ve two users Eddy and anne installed into our system.
We’ll face a security breach and privacy issues which will affect both users.
Let’s take a look which permissions our users have in their home directories.
Type cd /home + enter.
Check the permissions available on both directories anne and Eddy.
Type sl -l + enter.
We discover that everyone who’s logged into the system can access both user’s home directories and read contents of it.
At company employees it isn’t  a good practice and insecure.

anne@alfa:/$ cd /home
anne@alfa:/home$ ls -l
total 8
drwxr-xr-x 25 anne anne 4096 Jan 10 14:38 anne
drwxr-xr-x 19 Eddy Eddy 4096 Jan  9 22:39 Eddy
anne@alfa:/home$

Let’s take a closer look in /home/anne direcoty.
Type ls -Rl anne + enter.
Her folders, subfolders and files are readable by Eddy and everyone.

anne@alfa:/home$ ls -Rl anne
anne:
total 32
drwxr-xr-x 3 anne anne 4096 Nov  4 16:09 Desktop
drwxr-xr-x 3 anne anne 4096 Dec  1 14:51 Documents
drwxr-xr-x 2 anne anne 4096 Nov 16 20:18 Downloads
drwxr-xr-x 2 anne anne 4096 Oct 17 16:25 Music
drwxr-xr-x 2 anne anne 4096 Dec  7 13:05 Pictures
drwxr-xr-x 2 anne anne 4096 Oct 17 16:25 Public
drwxr-xr-x 2 anne anne 4096 Oct 17 16:25 Templates
drwxr-xr-x 2 anne anne 4096 Oct 17 16:25 Videos

anne/Desktop:
total 4
drwxr-xr-x 3 anne anne 4096 Nov  5 18:43 Gnubizz

anne/Desktop/Gnubizz:
total 8
-rw-r–r– 1 anne anne  450 Nov  5 18:43 GnubizzSite
drwxr-xr-x 4 anne anne 4096 Nov  4 16:09 OpenSourceComputing

anne/Desktop/Gnubizz/OpenSourceComputing:
total 8
drwxr-xr-x 2 anne anne 4096 Nov  5 20:54 Gnubizz1
drwxr-xr-x 2 anne anne 4096 Nov  5 20:55 Gnubizz2

anne/Desktop/Gnubizz/OpenSourceComputing/Gnubizz1:
total 4
-rw-r–r– 1 anne anne 1423 Nov  5 22:25 GnubizzSite

anne/Desktop/Gnubizz/OpenSourceComputing/Gnubizz2:
total 4
-rw-r–r– 1 anne anne 450 Nov  5 20:55 GnubizzSite

anne/Documents:
total 4
drwxr-xr-x 3 anne anne 4096 Jan  9 22:49 GnuBizz

anne/Documents/GnuBizz:
total 68
-rw-r–r– 1 anne anne 16999 Jan  9 22:21 INFO_USERADD
-rw-r–r– 1 anne anne 16999 Jan  9 20:37 INFO_USERADD~
-rw-r–r– 1 anne anne  9460 Jan  9 22:49 Permissions
-rw-r–r– 1 anne anne  9317 Jan  9 22:21 Permissions~
drwxr-xr-x 2 anne anne  4096 Jan  9 18:09 Published

anne/Documents/GnuBizz/Published:
total 188
-rw-r–r– 1 anne anne 31853 Nov  5 23:55 A.odt
-rw-r–r– 1 anne anne 30402 Nov 17 20:29 Application_Locations.odt
-rw-r–r– 1 anne anne 29148 Nov 12 23:55 GbuBizz
-rw-r–r– 1 anne anne 24809 Oct 29 19:22 Gnubizz
-rw-r–r– 1 anne anne 12728 Dec  7 13:38 OpenApplicationInGUIandTerminal.odt
-rw-r–r– 1 anne anne 31003 Nov 16 22:45 Programma_Locaties.odt
-rw-r–r– 1 anne anne 13496 Oct 25 12:40 TerminalExplorationInHomeDirectoryDebianWheezy7.odt

anne/Downloads:
total 0

anne/Music:
total 0

anne/Pictures:
total 0

anne/Public:
total 0

anne/Templates:
total 0

anne/Videos:
total 0
anne@alfa:/home$

Take in account that each user owns his/her home directory.
The user is able to change his/her permission on their own files and directories without being root.
We can grant three permissions available: read, write and execute.
While using chmod commando we’ll use numbers instead using read, write and execute.
The number shown below correspond each permission.
4 = read
2 = write
1 = execute

Let’s say we’ve a folder named Drive which has full permission set for all users.
It’ll look like: drwxrwxrwx 1 anna anne 4096 jan 10 15:56 Drive
We’ll avoid that everyone can access this Drive by changing some permissions.
The followed command would be: chmod 750 Drive + enter.
Now the permissions on Drive would look like: drwxr-x— 1 anna anne 4096 jan 10 15:56 Drive
Thus we’ve to count this numbers to get our permission set like shown below.
read, write and execute = 7
read and execute = 5
read and write = 6
The effective permissions on Drive would be:
750
7 = read, write and execute permission for the owner (user)
5 = read, execute permission for the group which the user belongs to.
0 = No permission set for everyone.

Ok let’s change both user’s permissions as user root.
Loggin as root by typing su + enter.
You’ll be asked to fill in your password + enter.
Your prompt will display # sign.

anne@alfa:~$ su
Password:
root@alfa:/home/anne#

Check existing permissions at both users /home directories.
Type ls -l /home + enter.

root@alfa:/home/anne# ls -l /home
total 8
drwxr-xr-x 25 anne anne 4096 Jan 10 15:56 anne
drwxr-xr-x 19 Eddy Eddy 4096 Jan  9 22:39 Eddy
root@alfa:/home/anne#

As you already know both users are able to access each others files and directories.
We’ll change those permissions that will affect everyone users except root.
They’re no longer allowed anymore to read contents of other users.
Type chmod -R 750 /home/Eddy + enter.
The argument -R will force the permission on the sub-folders as well.

root@alfa:/home/anne# ls -l /home
total 8
drwxr-xr-x 25 anne anne 4096 Jan 10 15:56 anne
drwxr-xr-x 19 Eddy Eddy 4096 Jan  9 22:39 Eddy
root@alfa:/home/anne# chmod 750 /home/Eddy
root@alfa:/home/anne#

Check if the change has took place.
We notice the permission by everyone has changed.
Type ls -l /home + enter.

root@alfa:/home/anne# ls -l /home
total 8
drwxr-xr-x 25 anne anne 4096 Jan 10 15:56 anne
drwxr-xr-x 19 Eddy Eddy 4096 Jan  9 22:39 Eddy
root@alfa:/home/anne# chmod 750 /home/Eddy
root@alfa:/home/anne# ls -l /home
total 8
drwxr-xr-x 25 anne anne 4096 Jan 10 15:56 anne
drwxr-x— 19 Eddy Eddy 4096 Jan  9 22:39 Eddy
root@alfa:/home/anne#

Logout as user root by typing exit + enter.
Your prompt displays $ again.
Now we’re ready to test if our permissions works.
We’re logged in as anne.
Navigate to /home by typing cd /home + enter.
Our working directory is /home that contains the sub-folders anne and Eddy.
Type ls + enter.

anne@alfa:~$ cd /home
anne@alfa:/home$ ls
anne  Eddy
anne@alfa:/home$

Ok we would like to see anne’s subdirectories.
You’ll see all the folders owned by anne.
Type ls anne + enter.

anne@alfa:~$ cd /home
anne@alfa:/home$ ls
anne  Eddy
anne@alfa:/home$ ls anne
Desktop  Documents  Downloads  Music  Pictures  Public  Templates  Videos
anne@alfa:/home$

We’ll redo this command to see Eddy’s sub-directories.
Hm, We’ll encounter a issue displayed below.
Our output give us the reason why this task can’t be performed.
ls: cannot open directory Eddy: Permission denied
We’ve no read permission anymore because we belongs to the users “everyone”.
Type ls Eddy + enter.

anne@alfa:~$ cd /home
anne@alfa:/home$ ls
anne  Eddy
anne@alfa:/home$ ls anne
Desktop  Documents  Downloads  Music  Pictures  Public  Templates  Videos
anne@alfa:/home$ ls Eddy
ls: cannot open directory Eddy: Permission denied
anne@alfa:/home$

Can we access his home directoy? I don’t think so.
Let’s test it and type cd Eddy + enter.
No success  to access it which protects Eddy’s privacy.
Our output displays the reason why: cd: Eddy: Permission denied

anne@alfa:~$ cd /home
anne@alfa:/home$ ls
anne  Eddy
anne@alfa:/home$ ls anne
Desktop  Documents  Downloads  Music  Pictures  Public  Templates  Videos
anne@alfa:/home$ ls Eddy
ls: cannot open directory Eddy: Permission denied
anne@alfa:/home$ cd Eddy
bash: cd: Eddy: Permission denied
anne@alfa:/home$

We’ve shown how to set permissions at user level but this can become complicated when having much users.
In our example we’ve only two users which are easy manageable.
Our users are divided into two different primary groups anne and Eddy.
Type ls -l + enter.

root@alfa:/home# ls -l
total 8
drwxr-x— 25 anne anne 4096 Jan 11 12:03 anne
drwxr-x— 19 Eddy Eddy 4096 Jan  9 22:39 Eddy
root@alfa:/home#

The best practice is to set permissions at group level instead of users.
We’ll create two users Bert and Vivianne by executing useradd.
We will create a new supplementary group _gnubizzers using groupadd.
A directory GNUBIZZ-DRIVE will be created in our / home directory.
Create both users Bert, Vivianne and their /home directories.
Type useradd -m -U Bert + enter.

anne@alfa:~$ su
Password:
root@alfa:/home/anne# useradd -m -U Bert
root@alfa:/home/anne#

Repeat this command creating user Vivianne.
Type useradd -m -U Vivianne + enter.

anne@alfa:~$ su
Password:
root@alfa:/home/anne# useradd -m -U Bert
root@alfa:/home/anne# useradd -m -U Vivianne
root@alfa:/home/anne#

Restart your computer so the system can write down the modifications you’ve just made.
Check if both users exist by ls commando.
Now we see four users anne, Bert, Eddy and Vivianne.
Type ls /home + enter.

root@alfa:/home/anne# ls /home
anne  Bert  Eddy  Vivianne
root@alfa:/home/anne#

Asign users Bert and Vivianne a login password.
Type passwd Bert + enter.
You’ll be asked to fill in Bert’s new password + enter.
Retype this password + enter.
Do the same task by the user Vivianne.

root@alfa:/home/anne# passwd Bert
Enter new UNIX password:
Retype new UNIX password:
passwd: password updated successfully
root@alfa:/home/anne# passwd Vivianne
Enter new UNIX password:
Retype new UNIX password:
passwd: password updated successfully
root@alfa:/home/anne#

Check the newly user’s permissions by typing ls -l + enter.
Other users are able to read contents of both users Bert and Vivianne.
When you don’t like it to happen you’ve to change it.
Type chmod 750 Bert Vivianne + enter.

root@alfa:/home# ls -l
total 16
drwxr-x— 25 anne     anne     4096 Jan 11 21:48 anne
drwxr-xr-x 19 Bert     Bert     4096 Jan 11 21:45 Bert
drwxr-x— 19 Eddy     Eddy     4096 Jan 11 21:30 Eddy
drwxr-xr-x 19 Vivianne Vivianne 4096 Jan 11 21:47 Vivianne
root@alfa:/home# chmod 750 Bert Vivianne
root@alfa:/home# ls -l
total 16
drwxr-x— 25 anne     anne     4096 Jan 11 21:48 anne
drwxr-x— 19 Bert     Bert     4096 Jan 11 21:45 Bert
drwxr-x— 19 Eddy     Eddy     4096 Jan 11 21:30 Eddy
drwxr-x— 19 Vivianne Vivianne 4096 Jan 11 21:47 Vivianne
root@alfa:/home#

Our next task is creating our directory GNUBIZZ-DRIVE using mkdir commando in the /home directory.
Navigate to /home using cd.
Type mkdir GNUBIZZ-DRIVE + enter.
We’ll face a permission issue by “Permission denied” because we were executing our command as default user.
The directory /home is owned by root.
Login as root by typing su + enter.
Typ your password + enter and retype it again + enter.
Now we’ll be able to perform this task.
Type mkdir GNUBIZZ-DRIVE + enter.
Check by ls -l and you’ll see our newly directoy GNUBIZZ-DRIVE and it’s permissions.
As you can see everyone has read and execute permissions at GNUBIZZ-DRIVE owned by root.

anne@alfa:/home$ mkdir GNUBIZZ-DRIVE
mkdir: cannot create directory `GNUBIZZ-DRIVE’: Permission denied
anne@alfa:/home$ su
Password:
root@alfa:/home# mkdir GNUBIZZ-DRIVE
root@alfa:/home# ls -l
total 20
drwxr-x— 26 anne     anne     4096 Jan 11 22:19 anne
drwxr-x— 19 Bert     Bert     4096 Jan 11 21:45 Bert
drwxr-x— 19 Eddy     Eddy     4096 Jan 11 21:30 Eddy
drwxr-xr-x  2 root     root     4096 Jan 11 22:28 GNUBIZZ-DRIVE
drwxr-x— 19 Vivianne Vivianne 4096 Jan 11 21:47 Vivianne
root@alfa:/home#

Change permission at GNUBIZZ-DRIVE so others aren’t able to gain access to it.
Type chmod 750 GNUBIZZ-DRIVE + enter.
At this stage user root and group root has still permissions set.
Check this by ls -l + enter.

root@alfa:/home# chmod 750 GNUBIZZ-DRIVE
root@alfa:/home# ls -l
total 20
drwxr-x— 26 anne     anne     4096 Jan 11 22:19 anne
drwxr-x— 19 Bert     Bert     4096 Jan 11 21:45 Bert
drwxr-x— 19 Eddy     Eddy     4096 Jan 11 21:30 Eddy
drwxr-x—  2 root     root     4096 Jan 11 22:28 GNUBIZZ-DRIVE
drwxr-x— 19 Vivianne Vivianne 4096 Jan 11 21:47 Vivianne
root@alfa:/home#

Now we’re ready to go further using groups instead of users.
Our purpose is to make users members of specific groups.
Our system handles two kinds of groups, primary and supplementary.
Each user becomes a member of a primary group when we created them.
Let’s look which group our users belongs to using id commando.
Type id username + enter.
Here we can see our primary groups of our users:
anne’s primary group is “anne”
Eddy’s primary group is “Eddy”
Bert’s primary group is “Bert”
Viviannes’s primary group is “Vivianne”

anne@alfa:~$ id anne
uid=1000(anne) gid=1000(anne) groups=1000(anne),24(cdrom),25(floppy),29(audio),30(dip),44(video),46(plugdev),106(scanner),111(bluetooth),113(netdev)
anne@alfa:~$ id Eddy
uid=1001(Eddy) gid=1001(Eddy) groups=1001(Eddy)
anne@alfa:~$ id Bert
uid=1002(Bert) gid=1002(Bert) groups=1002(Bert)
anne@alfa:~$ id Vivianne
uid=1003(Vivianne) gid=1003(Vivianne) groups=1003(Vivianne)
anne@alfa:~$

First we’ll create a new group named _gnubizzers.
To perform this you’ll need high privileges being root.
Login as user root by typing su + enter.
Fill in password of root user + enter.
Retype password + enter.
Your prompt will displays # again.
Create the group _gnubizzers using groupadd commando.
Type groupadd _gnubizzers + enter.

anne@alfa:~$ su
Password:
root@alfa:/home/anne# groupadd _gnubizzers
root@alfa:/home/anne#

Our group _gnubizzers is abandon containing no members yet.
We’ll add users Eddy, Bert and Vivianne to _gnubizzers using usermod commando.
Take in account that our users and group already exist so we’ll use some arguments.
A short arguments -a and -G  explanation:
-a = Append existing user to the group
-G = Specify supplementary group which the user will join.
Be aware and use your root user.
We’re still logged in as root so we’ll continue to make our users members of _gnubizzers.
Type usermod -a -G _gnubizzers Eddy + enter.
Check Eddy’s groups membership using id commando.
Type id Eddy + enter.
Eddy’s primary group is “Eddy” and his supplementary group is “_gnubizzers”

root@alfa:/home# usermod -a -G _gnubizzers Eddy
root@alfa:/home# id Eddy
uid=1001(Eddy) gid=1001(Eddy) groups=1001(Eddy),1004(_gnubizzers)
root@alfa:/home#

Repeat this task by the users Bert and Vivianne.
Type usermod -a -G _gnubizzers Bert + enter.
Than type usermod -a -G _gnubizzers Vivianne + enter.
The group _gnubizzers contains three members Eddy, Bert and Vivanne.
Check their membership using id command followed by their username.
Type id Bert + enter.
Redo this command at the user Vivianne.
You we’ll see  _gnubizzers is added as a supplementary group.

root@alfa:/home# usermod -a -G _gnubizzers Bert
root@alfa:/home# usermod -a -G _gnubizzers Vivianne
root@alfa:/home# id Bert
uid=1002(Bert) gid=1002(Bert) groups=1002(Bert),1004(_gnubizzers)
root@alfa:/home# id Vivianne
uid=1003(Vivianne) gid=1003(Vivianne) groups=1003(Vivianne),1004(_gnubizzers)
root@alfa:/home#

At this moment our members of the group _gnubizzers has no permissions on GNUBIZZ-DRIVE.
Let’s check this using ls -l /home + enter.
We see GNUBIZZ-DRIVE is owned by root and group root.
Our purpose is to change the group ownership from root to _gnubizzers.
At this stage displayed below our user root has full permission and the group root has read and execute permissions.

anne@alfa:~$ ls -l /home
total 20
drwxr-x— 25 anne     anne     4096 Jan 14 11:23 anne
drwxr-x— 19 Bert     Bert     4096 Jan 11 21:45 Bert
drwxr-x— 19 Eddy     Eddy     4096 Jan 11 21:30 Eddy
drwxr-x—  2 root     root     4096 Jan 11 22:28 GNUBIZZ-DRIVE
drwxr-x— 19 Vivianne Vivianne 4096 Jan 11 21:47 Vivianne
anne@alfa:~$

Let’s change the group ownership by using chgrp commando.
We’ll insert some arguments like -v and -R.
-v Is used to see the diagnostics what happened .
-R Is used to operate on files and directories recursively.
Type chgrp -v -R _gnubizzers /home/GNUBIZZ-DRIVE + enter.
Our output displays that the group has changed from root to _gnubizzers.

anne@alfa:~$ su
Password:
root@alfa:/home/anne# chgrp -v -R _gnubizzers /home/GNUBIZZ-DRIVE
changed group of `/home/GNUBIZZ-DRIVE’ from root to _gnubizzers
root@alfa:/home/anne#

Check using ls -l verifying the changes.
The directory GNUBIZZ-DRIVE is still owned by user root but the group ownership has changed to _gnubizzers.
The group _gnubizzers are able to read and execute in the directory GNUBIZZ-DRIVE.

root@alfa:/home/anne# ls -l /home
total 20
drwxr-x— 25 anne     anne        4096 Jan 14 11:23 anne
drwxr-x— 19 Bert     Bert        4096 Jan 11 21:45 Bert
drwxr-x— 19 Eddy     Eddy        4096 Jan 11 21:30 Eddy
drwxr-x—  2 root     _gnubizzers 4096 Jan 11 22:28 GNUBIZZ-DRIVE
drwxr-x— 19 Vivianne Vivianne    4096 Jan 11 21:47 Vivianne
root@alfa:/home/anne#

We’ll change the permissions on GNUBIZZ-DRIVE so our members of the  group _gnubizzers will be able to read, write and execute.
Login as root using su.
Type chmod 770 /home/GNUBIZZ-DRIVE + enter.
Verify your changes using ls -l /home + enter.
The user root (owner) and the group _gnubizzers (group owner) has the same permissions on GNUBIZZ-DRIVE.
Be aware that this situation is far from ideal and insecure using such configurations at companies.
Each member is able to write, change, move, store and even delete other member’s directories and files by accident.
How to avoid this will be discussed later on.

root@alfa:/home/anne# ls -l /home
total 20
drwxr-x— 25 anne     anne        4096 Jan 14 11:23 anne
drwxr-x— 19 Bert     Bert        4096 Jan 11 21:45 Bert
drwxr-x— 19 Eddy     Eddy        4096 Jan 11 21:30 Eddy
drwxr-x—  2 root     _gnubizzers 4096 Jan 11 22:28 GNUBIZZ-DRIVE
drwxr-x— 19 Vivianne Vivianne    4096 Jan 11 21:47 Vivianne
root@alfa:/home/anne# chmod 770 /home/GNUBIZZ-DRIVE
root@alfa:/home/anne# ls -l /home
total 20
drwxr-x— 25 anne     anne        4096 Jan 14 11:23 anne
drwxr-x— 19 Bert     Bert        4096 Jan 11 21:45 Bert
drwxr-x— 19 Eddy     Eddy        4096 Jan 11 21:30 Eddy
drwxrwx—  2 root     _gnubizzers 4096 Jan 11 22:28 GNUBIZZ-DRIVE
drwxr-x— 19 Vivianne Vivianne    4096 Jan 11 21:47 Vivianne
root@alfa:/home/anne#

We’ll show you a security breach on GNUBIZZ-DRIVE.
Login as user Eddy in the same terminal you working on.
First become user root before using login commando.
Type login Eddy + enter.
You’ll be asked to fill in Eddy’s password + enter.
You’re now logged in as “Eddy”.
Verify who is logged by using whoami command.
Type whoami + enter.
Eddy will be displayed.
Check Eddy’s working directory by pwd commando.
Type pwd + enter.
Eddy’s working directory would be /home/Eddy.
Navigate to GNUBIZZ-DRIVE by typing cd /home/GNUBIZZ-DRIVE + enter.
Eddy will create a sub-directory “Eddy-gnu”.
Type mkdir Eddy-gnu + enter.
Verify with ls and Eddy will see his new directory Eddy-gnu stored at GNUBIZZ-DRIVE.
Logout by typing exit + enter and you’ll become root user.
Your prompt shows # sign again being root user.

root@alfa:/home/anne# login Eddy
Password:
Last login: Tue Jan 14 12:43:58 CET 2014 on pts/0
Linux alfa 3.2.0-4-amd64 #1 SMP Debian 3.2.51-1 x86_64

The programs included with the Debian GNU/Linux system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.

Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.
$ whoami
Eddy
$ pwd
/home/Eddy
$ cd /home/GNUBIZZ-DRIVE
$ pwd
/home/GNUBIZZ-DRIVE
$ mkdir Eddy-gnu
$ ls
Eddy-gnu
$ exit
root@alfa:/home/anne#

So far nothing happened yet to proof our configuration issue.
Login as user Vivianne.
Verify Vivianne’s working directory by pwd.
Navigate to GNUBIZZ-DRIVE.
Check which directories are stored at GNUBIZZ-DRIVE by ls -l.
Vivianne will see Eddy’s directory Eddy-gnu.
Take in account the whole group _gnubizzers has full rights on GNUBIZZ-DRIVE.
Let’s test our security risk by removing Eddy’s folder.
Type rmdir Eddy-gnu + enter.
Use ls and you’ll see Eddy’s directory Eddy-gnu is gone.
This is not a good practice being able to delete each others folders and files.
Logout by typing exit + enter.
We’re root again and ready to modify it at a better way.

root@alfa:/home/anne# login Vivianne
Password:
Linux alfa 3.2.0-4-amd64 #1 SMP Debian 3.2.51-1 x86_64

The programs included with the Debian GNU/Linux system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.

Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.
$ pwd
/home/Vivianne
$ cd /home/GNUBIZZ-DRIVE
$ ls -l
total 4
drwxr-xr-x 2 Eddy Eddy 4096 Jan 14 12:52 Eddy-gnu
$ rmdir Eddy-gnu
$ ls
$ exit
root@alfa:/home/anne#

Our goal is working more secure for everyone who’s member of the group _gnubizzers.
Let’s change our permission using a sticky bit.
The user root will not be affected by sticky bit and the permission will remain unchanged.
This will prevent the user being able by deleting files and directories accidently by other users which belongs to the same group _gnubizzers.
Set your permission on GNUBIZZ-DRIVE using chmod commando.
Type chmod -v 1770 /home/GNUBIZZ-DRIVE + enter.
Check this by ls -l /home + enter.

root@alfa:/home/anne# chmod -v 1770 /home/GNUBIZZ-DRIVE
mode of `/home/GNUBIZZ-DRIVE’ changed from 0770 (rwxrwx—) to 1770 (rwxrwx–T)
root@alfa:/home/anne# ls -l /home
total 20
drwxr-x— 25 anne     anne        4096 Jan 14 11:23 anne
drwxr-x— 19 Bert     Bert        4096 Jan 11 21:45 Bert
drwxr-x— 19 Eddy     Eddy        4096 Jan 11 21:30 Eddy
drwxrwx–T  2 root     _gnubizzers 4096 Jan 14 12:59 GNUBIZZ-DRIVE
drwxr-x— 19 Vivianne Vivianne    4096 Jan 11 21:47 Vivianne
root@alfa:/home/anne#

Our security breach must be solved so we’ll test it again.
Type the bold text displayed in our example below.
The red text represents our terminal output.
Just follow this small content and explore and discuss your thoughts.
Don’t forget to be root when logging as another user in the same terminal.
Login as user Eddy and create a directory Eddy-gnu at GNUBIZZ-DRIVE.

root@alfa:/home/anne# login Eddy
Password:
Last login: Tue Jan 14 12:44:45 CET 2014 on pts/0
Linux alfa 3.2.0-4-amd64 #1 SMP Debian 3.2.51-1 x86_64

The programs included with the Debian GNU/Linux system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.

Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.
$ pwd
/home/Eddy
$ cd /home/GNUBIZZ-DRIVE
$ pwd
/home/GNUBIZZ-DRIVE
$ mkdir Eddy-gnu
$ ls -l
total 4
drwxr-xr-x 2 Eddy Eddy 4096 Jan 14 13:27 Eddy-gnu
$ exit
root@alfa:/home/anne#

Login as user Bert and Vivianne and create sub-directory correspond by username:
Vivianne will create directory Vivianne-gnu.
Bert will create directory Bert-gnu.
Type the bold text displayed below.
Login as user Bert and perform the task described above.

root@alfa:/home/anne# login Bert
Password:
Last login: Tue Jan 14 13:30:39 CET 2014 on pts/0
Linux alfa 3.2.0-4-amd64 #1 SMP Debian 3.2.51-1 x86_64

The programs included with the Debian GNU/Linux system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.

Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.
$ pwd
/home/Bert
$ cd /home/GNUBIZZ-DRIVE
$ ls
Eddy-gnu
$ mkdir Bert-gnu
$ ls -l
total 8
drwxr-xr-x 2 Bert Bert 4096 Jan 14 13:31 Bert-gnu
drwxr-xr-x 2 Eddy Eddy 4096 Jan 14 13:27 Eddy-gnu
$$ exit
root@alfa:/home/anne#

Login as user Vivianne and create a sub-directory Vivianne-gnu at GNUBIZZ-DRIVE.
Type the bold text and follow our example below.

root@alfa:/home/anne# login Vivianne
Password:
Last login: Tue Jan 14 12:58:36 CET 2014 on pts/0
Linux alfa 3.2.0-4-amd64 #1 SMP Debian 3.2.51-1 x86_64

The programs included with the Debian GNU/Linux system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.

Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.
$ pwd
/home/Vivianne
$ cd /home/GNUBIZZ-DRIVE
$ mkdir Vivianne-gnu
$ ls -l
total 12
drwxr-xr-x 2 Bert     Bert     4096 Jan 14 13:31 Bert-gnu
drwxr-xr-x 2 Eddy     Eddy     4096 Jan 14 13:27 Eddy-gnu
drwxr-xr-x 2 Vivianne Vivianne 4096 Jan 14 13:42 Vivianne-gnu
$ exit
root@alfa:/home/anne#

Let’s see if users can delete files and directories by accident of othter members.
Login as user Eddy again.
Eddy will remove other members their directories stored at GNUBIZZ-DRIVE.
The bold text must be typed. Explore what will happen and enjoy it.
Nobody of the group _gnubizzers will be able to delete each others files and direcoties.
Notice they’re still be able to read each others contents but they can’t create or remove contents at other members.

If you don’t like that group members are able to read your contents you can change it at your own folders and files stored at GNUBIZZ_DRIVE.
A example what a group member can do.
Supposing Eddy don’t like that others are able to read his contents.
At this stage permissions read and execute rights on Eddy’s-gnu owned by Eddy are granted  for everyone.
drwxr-xr-x 2 Eddy     Eddy     4096 Jan 14 13:27 Eddy-gnu
Eddy can change this by executing chmod 750 Eddy-gnu to avoid reading permissions by others.
Now his folder permission would like this:
drwxr-x— Eddy     Eddy     4096 Jan 14 13:27 Eddy-gnu
The members of the group _gnubizzers aren’t able anymore to read Eddy’s folders and files contents.
Setting permissions can become very complicated and must be well documented by system administrators.

root@alfa:/home/anne# login Eddy
Password:
Last login: Tue Jan 14 13:27:13 CET 2014 on pts/0
Linux alfa 3.2.0-4-amd64 #1 SMP Debian 3.2.51-1 x86_64

The programs included with the Debian GNU/Linux system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.

Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.
$ pwd
/home/Eddy
$ cd /home/GNUBIZZ-DRIVE
$ ls -l
total 12
drwxr-xr-x 2 Bert     Bert     4096 Jan 14 13:31 Bert-gnu
drwxr-xr-x 2 Eddy     Eddy     4096 Jan 14 13:27 Eddy-gnu
drwxr-xr-x 2 Vivianne Vivianne 4096 Jan 14 13:42 Vivianne-gnu
$ rmdir Bert-gnu
rmdir: failed to remove `Bert-gnu’: Operation not permitted
$ rmdir Vivianne-gnu
rmdir: failed to remove `Vivianne-gnu’: Operation not permitted
$ exit
root@alfa:/home/anne# 

A permission overview configured in our example.
Our system has four users anne, Eddy, Bert and Vivianne.
Membership _gnubizzers:
Eddy, Bert and Vivianne
Non membership of _gnubizzers:
anne and root
The permissions set at users home direcories:
Read, write and execute by the owner (user itself).
Read and execute permission granted at primary group which user belongs to.
No rights granted for everyone.
Permission set at GNUBIZZ-DRIVE shared by the group _gnubizzers:
Read, write and execute rights granted user root.
Read, write and execute rights granted to _gnubizzers members.
Sticky bit set preventing by removing contents of other members.
No rights granted for everyone

So that’s it and we hope you’ve enjoyed it.
Feel free to share your thoughts so we can get things going better.
Don’t hesitate to leave a comment.
We’ll back soon to giude you through this nice system Debian Wheezy 7.2. 😉

Written by Anne-Marie.

Advertisements

Applications and commando’s locations Debian Wheezy 7

Applications and commando’s locations Debian Wheezy 7.

When we search for applications and files available in our system you don’t see such directory like Programs Files.
Our programs, files and services are divided over many directories instead of other systems.
In a Windows system you’ll find your applications in the default folder C:\Programs.Files and C:\ProgramsFiles (x86).
Our applications, services and users are stored in the root directory.The root is the start of everything in our system.
Let’s see how this looks like.
Start your terminal and navigate into the / (directory root).
The bold text in this tutorial are commando’s and its last outputs are red.
We’re in our home directory when we open our terminal.
Type cd / + enter.
Verify with pwd and you’ll see your working directory is root /.
Execute ls that reveals the subdirectories of root.

anne0001@beta:~$ pwd
/home/anne0001
anne0001@beta:~$ cd /
anne0001@beta:/$ pwd
/
anne0001@beta:/$ ls
bin   etc         lib         mnt   root  selinux  tmp  vmlinuz
boot  home        lost+found  opt   run   srv      usr
dev   initrd.img  media       proc  sbin  sys      var
anne0001@beta:/$

We can see who’s the owner of the root directory as followed.
Type ls -l + enter.
Notice the whole directory is owned by the root user.

anne0001@beta:/$ pwd
/
anne0001@beta:/$ ls -l
total 84
drwxr-xr-x   2 root root  4096 Nov 13 21:39 bin
drwxr-xr-x   3 root root  4096 Nov 13 21:51 boot
drwxr-xr-x  14 root root  3160 Nov 14 11:14 dev
drwxr-xr-x 132 root root 12288 Nov 14 11:14 etc
drwxr-xr-x   3 root root  4096 Nov 13 21:54 home
lrwxrwxrwx   1 root root    32 Nov 13 20:52 initrd.img -> /boot/initrd.img-3.2.0-4-686-pae
drwxr-xr-x  16 root root  4096 Nov 13 21:38 lib
drwx——   2 root root 16384 Nov 13 20:47 lost+found
drwxr-xr-x   3 root root  4096 Nov 13 20:47 media
drwxr-xr-x   2 root root  4096 Oct  7 17:25 mnt
drwxr-xr-x   2 root root  4096 Nov 13 20:48 opt
dr-xr-xr-x 135 root root     0 Nov 14 11:12 proc
drwx——   4 root root  4096 Nov 13 21:48 root
drwxr-xr-x  19 root root   840 Nov 14 11:15 run
drwxr-xr-x   2 root root  4096 Nov 13 21:57 sbin
drwxr-xr-x   2 root root  4096 Jun 10  2012 selinux
drwxr-xr-x   2 root root  4096 Nov 13 20:48 srv
drwxr-xr-x  13 root root     0 Nov 14 11:12 sys
drwxrwxrwt  11 root root  4096 Nov 14 15:34 tmp
drwxr-xr-x  10 root root  4096 Nov 13 20:48 usr
drwxr-xr-x  12 root root  4096 Nov 13 21:45 var
lrwxrwxrwx   1 root root    28 Nov 13 20:52 vmlinuz -> boot/vmlinuz-3.2.0-4-686-pae
anne0001@beta:/$

As we said our applications are divided over different directories and files.
A incomplete list of folders that contains application files and directories displayed below.
/bin
/sbin
/usr
/usr/bin
/usr/sbin
/usr/share
/usr/local
/usr/local/games
/usr/lib
etc……

Let’s take a small guide through some of them.
In the directory /sbin you’ll find subdirectories and files that contains many commando’s used by system configuration purposes.
Important commando’s like fdisk, iptables, ifconfig, iwconfig, shutdown, etc…
Let’s see what we get here.
Type ls sbin + enter.

anne0001@beta:/$ pwd
/
anne0001@beta:/$ ls sbin
acpi_available       ip                 ntfsresize
agetty               ip6tables          ntfsundelete
apm_available        ip6tables-restore  on_ac_power
badblocks            ip6tables-save     osd_login
blkid                ipmaddr            pam_tally
blockdev             iptables           pam_tally2
capsh                iptables-restore   pccardctl
cfdisk               iptables-save      pivot_root
crda                 iptunnel           plipconfig
cryptsetup           isosize            poweroff
ctrlaltdel           iw                 rarp
debugfs              iwconfig           raw
depmod               iwevent            reboot
dhclient             iwgetid            regdbdump
dhclient-script      iwlist             resize2fs
discover             iwpriv             rmmod
discover-modprobe    iwspy              route
discover-pkginstall  kbdrate            rpcbind
dmsetup              killall5           rpc.statd
dosfsck              ldconfig           rtacct
dosfslabel           logsave            rtmon
dumpe2fs             losetup            runlevel
e2fsck               lsmod              setcap
e2image              lspcmcia           sfdisk
e2label              mii-tool           shadowconfig
e2undo               mkdosfs            showmount
fdisk                mke2fs             shutdown
findfs               mkfs               slattach
fsck                 mkfs.bfs           sm-notify
fsck.cramfs          mkfs.cramfs        startpar
fsck.ext2            mkfs.ext2          startpar-upstart-inject
fsck.ext3            mkfs.ext3          start-stop-daemon
fsck.ext4            mkfs.ext4          sulogin
fsck.ext4dev         mkfs.ext4dev       swaplabel
fsck.minix           mkfs.minix         swapoff
fsck.msdos           mkfs.msdos         swapon
fsck.nfs             mkfs.ntfs          switch_root
fsck.vfat            mkfs.vfat          sysctl
fsfreeze             mkhomedir_helper   tc
fstab-decode         mkntfs             telinit
fstrim               mkswap             tune2fs
getcap               modinfo            udevadm
getpcaps             modprobe           udevd
getty                mount.fuse         umount.nfs
halt                 mount.lowntfs-3g   umount.nfs4
hdparm               mount.nfs          umount.udisks
hwclock              mount.nfs4         unix_chkpwd
ifconfig             mount.ntfs         unix_update
ifdown               mount.ntfs-3g      wipefs
ifquery              mount.vboxsf       wpa_action
ifup                 nameif             wpa_cli
init                 nfnl_osf           wpa_supplicant
insmod               ntfsclone          xtables-multi
insserv              ntfscp
installkernel        ntfslabel
anne0001@beta:/$

This long list can be overwhelming and difficult to overview.
We can avoid this by using a argument.
Our command will look like, command + path directory you prefer + /argument + wild card.
We’re interested in subdirectories and files available started by the characters if.
Let’s see what list we get.
Type ls sbin/if* + enter.
Now we see our small list filtered by if

anne0001@beta:/$ pwd
/
anne0001@beta:/$ ls sbin/if*
sbin/ifconfig  sbin/ifdown  sbin/ifquery  sbin/ifup
anne0001@beta:/$

How many directories and files are available started by f?
Our argument must focus on f followed by *.
We’re only interested in those directories started by the characters f.
Type ls sbin/f* + enter.

anne0001@beta:/$ pwd
/
anne0001@beta:/$ ls sbin/f*
sbin/fdisk        sbin/fsck.ext2     sbin/fsck.minix  sbin/fsfreeze
sbin/findfs       sbin/fsck.ext3     sbin/fsck.msdos  sbin/fstab-decode
sbin/fsck         sbin/fsck.ext4     sbin/fsck.nfs    sbin/fstrim
sbin/fsck.cramfs  sbin/fsck.ext4dev  sbin/fsck.vfat
anne0001@beta:/$

Hmm to much directories and files displayed here?
Well we’ll ad one more argument to reduce our list to a minimum displayed items.
Our command will look like, command + path directory you prefer + /first argument + * + second argument.
Let’s filter our directories started by f and ended by s.
You see a short list here.
Type ls sbin/f*s + enter.

anne0001@beta:/$ pwd
/
anne0001@beta:/$ ls sbin/f*s
sbin/findfs  sbin/fsck.cramfs  sbin/fsck.msdos  sbin/fsck.nfs
anne0001@beta:/$

The directory bin contains user commando’s like, cp, chmod, less, open, dir, etc…
Command ls in this directory will produce a very long list of applications en files.
Just execute ls /bin + enter if you like.
We prefer the reduced list by using another manner.
In our command we’ll use a pipe followed by a second command followed by a argument.
Our command will look like command + path directory you prefer + pipe + second command + argument.
We’re interested in command en files that contains the characters nt.
Type ls bin | grep nt + enter.
This’ll display only those items containing nt.

anne0001@beta:/$ pwd
/
anne0001@beta:/$ ls bin | grep nt
findmnt
fusermount
lowntfs-3g
mount
mountpoint
ntfs-3g
ntfs-3g.probe
ntfs-3g.secaudit
ntfs-3g.usermap
ntfscat
ntfsck
ntfscluster
ntfscmp
ntfsdump_logfile
ntfsfix
ntfsinfo
ntfsls
ntfsmftalloc
ntfsmove
ntfstruncate
ntfswipe
setfont
umount
anne0001@beta:/$

We have another directory that contains a very long list of subdirectories and files.
Directory usr/share contains applications like iceweasel, java, brasero, Libreoffice, nautilus, etc…
We’ll filter our list by using our command as above.
Display the items containing lib.
Type ls usr/share | grep lib + enter.

anne0001@beta:/$ pwd
/
anne0001@beta:/$ ls usr/share | grep lib
glib-2.0
libaudio2
libc-bin
libexttextcat
libgksu
libgnomekbd
libgnome-media-profiles
libgphoto2
libgweather
liblouis
libnm-gtk
libquvi-scripts
librarian
libreoffice
libsensors4
libsocialweb
libthai
libvisual-plugins-0.4
libwacom
anne0001@beta:/$

Feel free and explore more.
A few examples we’ve executed showed below.
We’ve typed ls usr/share | grep gnome + enter.

anne0001@beta:/$ pwd
/
anne0001@beta:/$ ls usr/share | grep gnome
gnome
gnome-2.0
gnome-applets
gnome-background-properties
gnome-bluetooth
gnome-color-manager
gnome-control-center
gnome-dictionary
gnome-documents
gnome-games
gnome-js
gnome-mag
gnome-nettool
gnome-packagekit
gnome-panel
gnome-power-manager
gnome-screenshot
gnome-session
gnome-settings-daemon
gnome-shell
gnome-sound-recorder
gnome-sudoku
gnome-system-log
gnome-system-monitor
gnome-terminal
gnome-tweak-tool
gnome-user-share
gnome-video-effects
libgnomekbd
libgnome-media-profiles
anne0001@beta:/$

And here we have executed ls usr/share/sy* + enter.
Notice path descriptions and its contents in this output.

anne0001@beta:/$ pwd
/
anne0001@beta:/$ ls usr/share/sy*
usr/share/synaptic:
gtkbuilder  html  pixmaps

usr/share/sysvinit:
inittab  update-rc.d

usr/share/sysv-rc:
saveconfig
anne0001@beta:/$

There are much more directories and files available we have not discussed yet like the applications libraries.
Feel free to explore them and you can review the examples above.
If you don’t know what a command or application does you can execute the whatis + naam command or application name.
We’ll see how we can get the location of applications.
There are many tools we can use like whereis, locate, find and which.
Let’s see what whereis, locate, find, and which stands for.
Start in your home directory.
Type whatis whereis + enter.
The whereis is used to find the executables, location and man pages.

anne0001@beta:~$ pwd
/home/anne0001
anne0001@beta:~$ whatis whereis
whereis (1)          – locate the binary, source, and manual page files for a…
anne0001@beta:~$

Repeat this command with the argument locate, find and which.
We have just discovered that locate searches in files by names.
Find w’ll search files in our folder structure and which locates user commando’s.
That’s good to know while we’re searching the locations we prefer.

anne0001@beta:~$ pwd
/home/anne0001
anne0001@beta:~$ whatis whereis
whereis (1)          – locate the binary, source, and manual page files for a…
anne0001@beta:~$ whatis locate
locate (1)           – find files by name
anne0001@beta:~$ whatis find
find (1)             – search for files in a directory hierarchy
anne0001@beta:~$ whatis which
which (1)            – locate a command
anne0001@beta:~$

Let’s start our application tour and get the location of it.
Where’s whereis located?
Which command will we use to know the location of commands?
We’ve seen the meaning of which showed above.
Type which whereis + enter.
Whereis location is /usr/bin/whereis.

anne0001@beta:~$ pwd
/home/anne0001
anne0001@beta:~$ which whereis
/usr/bin/whereis
anne0001@beta:~$

We know there’s a nice program called gimp.
Gimp is used to pimp your pictures and other materials.
Where’s gimp located?
Now we’ll use whereis + name of our application we prefer.
Type whereis gimp + enter.
This application uses a lot of directories displayed below.
Notice the directory that contains the man1 page of gimp.
We think the executable of gimp is located in/usr/bin/gimp but we’ll discuss thisitem later on.

anne0001@beta:~$ pwd
/home/anne0001
anne0001@beta:~$ whereis gimp
gimp: /usr/bin/gimp /etc/gimp /usr/lib/gimp /usr/bin/X11/gimp /usr/share/gimp /usr/share/man/man1/gimp.1.gz
anne0001@beta:~$

We were interested in the applications displayed below.
Type whereis followed by the name you prefer.
We used the applications tomboy, vim, synaptic and iceweasel.

anne0001@beta:~$ pwd
/home/anne0001
anne0001@beta:~$ whereis tomboy
tomboy: /usr/bin/tomboy /usr/lib/tomboy /usr/bin/X11/tomboy /usr/share/tomboy /usr/share/man/man1/tomboy.1.gz
anne0001@beta:~$ whereis vim
vim: /usr/bin/vim.tiny /etc/vim /usr/bin/X11/vim.tiny /usr/share/vim /usr/share/man/man1/vim.1.gz
anne0001@beta:~$ whereis synaptic
synaptic: /usr/sbin/synaptic /usr/share/synaptic /usr/share/man/man8/synaptic.8.gz
anne0001@beta:~$ whereis iceweasel
iceweasel: /usr/bin/iceweasel /etc/iceweasel /usr/lib/iceweasel /usr/bin/X11/iceweasel /usr/share/iceweasel /usr/share/man/man1/iceweasel.1.gz
anne0001@beta:~$

We can discover which files applications use and we can see what kind of extensions they’ve.
This is useful for system administrators and advanced users who like to change the behavior of applications.
Let’s see which files is used by synaptic located in /usr/share/synaptic.
We know it’s location so we’ll use the find command followed by it’s path to see our files.
Type find synaptic + /usr/share/synaptic + enter.
Be aware, this can be a very very long list.
In our example you see 2 full paths displayed containing many files.
/usr/share/synaptic/gtkbuilder and /usr/share/synaptic/pixmaps.
( incomplete list displayed below ).

anne0001@beta:~$ pwd
/home/anne0001
anne0001@beta:~$ find /usr/share/synaptic
/usr/share/synaptic
/usr/share/synaptic/gtkbuilder
/usr/share/synaptic/gtkbuilder/stock_menu_about.png
/usr/share/synaptic/gtkbuilder/dialog_update_outdated.ui
/usr/share/synaptic/gtkbuilder/dialog_proposed_new_repositories.ui
/usr/share/synaptic/gtkbuilder/window_find.ui
/usr/share/synaptic/gtkbuilder/proceed_small.png
/usr/share/synaptic/gtkbuilder/druid_repository.ui
/usr/share/synaptic/gtkbuilder/dialog_quit.ui
/usr/share/synaptic/gtkbuilder/update_small.png
/usr/share/synaptic/gtkbuilder/window_main.ui
/usr/share/synaptic/gtkbuilder/dialog_disc_label.ui
/usr/share/synaptic/gtkbuilder/window_changes.ui
/usr/share/synaptic/gtkbuilder/window_filters.ui
/usr/share/synaptic/gtkbuilder/dialog_columns.ui
/usr/share/synaptic/gtkbuilder/stock_help-book.png
/usr/share/synaptic/gtkbuilder/window_tasks.ui
/usr/share/synaptic/gtkbuilder/dialog_new_repositroy.ui
/usr/share/synaptic/gtkbuilder/window_preferences.ui
/usr/share/synaptic/gtkbuilder/dialog_task_descr.ui
/usr/share/synaptic/gtkbuilder/window_logview.ui
/usr/share/synaptic/gtkbuilder/dialog_example.ui
/usr/share/synaptic/gtkbuilder/window_about.ui
/usr/share/synaptic/gtkbuilder/window_disc_name.ui
/usr/share/synaptic/gtkbuilder/dialog_changelog.ui
/usr/share/synaptic/gtkbuilder/logo.png
/usr/share/synaptic/gtkbuilder/pref_vpaned.xpm
/usr/share/synaptic/gtkbuilder/dialog_unmet.ui
/usr/share/synaptic/gtkbuilder/window_rginstall_progress.ui
/usr/share/synaptic/gtkbuilder/dialog_download_error.ui
/usr/share/synaptic/gtkbuilder/dialog_authentication.ui
/usr/share/synaptic/gtkbuilder/dialog_update_failed.ui
/usr/share/synaptic/gtkbuilder/dialog_change_version.ui
/usr/share/synaptic/gtkbuilder/stock_filter-data-by-criteria.png
/usr/share/synaptic/gtkbuilder/distupgrade_small.png
/usr/share/synaptic/gtkbuilder/stock_filter-navigator.png
/usr/share/synaptic/gtkbuilder/window_iconlegend.ui
/usr/share/synaptic/gtkbuilder/window_setopt.ui
/usr/share/synaptic/gtkbuilder/window_details.ui
/usr/share/synaptic/gtkbuilder/window_zvtinstallprogress.ui
/usr/share/synaptic/gtkbuilder/window_summary.ui
/usr/share/synaptic/gtkbuilder/window_install_progress.ui
/usr/share/synaptic/gtkbuilder/window_rgdebinstall_progress.ui
/usr/share/synaptic/gtkbuilder/window_repositories.ui
/usr/share/synaptic/gtkbuilder/dialog_upgrade.ui
/usr/share/synaptic/gtkbuilder/upgrade_small.png
/usr/share/synaptic/gtkbuilder/cnc.png
/usr/share/synaptic/gtkbuilder/dialog_conffile.ui
/usr/share/synaptic/gtkbuilder/deb.png
/usr/share/synaptic/gtkbuilder/window_procceed.ui
/usr/share/synaptic/gtkbuilder/synaptic.xpm
/usr/share/synaptic/gtkbuilder/synaptic_mini.xpm
/usr/share/synaptic/gtkbuilder/pref_hpaned.xpm
/usr/share/synaptic/gtkbuilder/dialog_welcome.ui
/usr/share/synaptic/gtkbuilder/window_fetch.ui
/usr/share/synaptic/gtkbuilder/window_rginstall_progress_msgs.ui
/usr/share/synaptic/pixmaps
/usr/share/synaptic/pixmaps/green.png
/usr/share/synaptic/pixmaps/synaptic_32x32.xpm
/usr/share/synaptic/pixmaps/yellow.png
/usr/share/synaptic/pixmaps/red.png

We can search files by name using locate.
This will reveal full paths that contains files used by applications and services.
Our home directory is also divided over many places.
Let’s see how it look like. It’s amazing how many files are in use by Dekstop.
Type locate Desktop + enter.

anne0001@beta:~$ pwd
/home/anne0001
anne0001@beta:~$ ls
Desktop  Documents  Downloads  Music  Pictures  Public  Templates  Videos
anne0001@beta:~$ locate Desktop
/home/anne0001/Desktop
/usr/lib/girepository-1.0/GDesktopEnums-3.0.typelib
/usr/lib/libreoffice/program/wizards/common/Desktop.py
/usr/lib/pymodules/python2.6/xdg/DesktopEntry.py
/usr/lib/pymodules/python2.6/xdg/DesktopEntry.pyc
/usr/lib/pymodules/python2.7/xdg/DesktopEntry.py
/usr/lib/pymodules/python2.7/xdg/DesktopEntry.pyc
/usr/share/man/man3/File::DesktopEntry.3pm.gz
/usr/share/perl5/File/DesktopEntry.pm
/usr/share/pyshared/xdg/DesktopEntry.py
anne0001@beta:~$

We can make a journey through our system that never ends.
Play en enjoy the possibilities you get.
We have done more examples showed below.
Notice the contents that has been saved by the user like pictures and documents.

anne0001@beta:~$ pwd
/home/anne0001
anne0001@beta:~$ ls
Desktop  Documents  Downloads  Music  Pictures  Public  Templates  Videos
anne0001@beta:~$ locate Documents
/home/anne0001/Documents
/usr/share/dbus-1/services/org.gnome.Documents.GDataMiner.service
/usr/share/dbus-1/services/org.gnome.Documents.SearchProvider.service
/usr/share/glib-2.0/schemas/org.gnome.Documents.enums.xml
anne0001@beta:~$ locate Downloads
/home/anne0001/Downloads
/home/anne0001/Downloads/.~lock.Application_Locations.odt#
/home/anne0001/Downloads/Application_Locations.odt
/home/anne0001/Downloads/Default_Programs_Debian_Wheezy_7.odt
/home/anne0001/Downloads/new article.zip
/usr/lib/iceweasel/components/DownloadsStartup.js
/usr/lib/iceweasel/components/DownloadsUI.js
/usr/share/iceweasel/modules/DownloadsCommon.jsm
anne0001@beta:~$ locate Music
/home/anne0001/Music
/usr/share/perl/5.14.2/unicore/lib/Blk/MusicalS.pl
anne0001@beta:~$ locate Pictures
/home/anne0001/Pictures
/home/anne0001/Pictures/1.png
anne0001@beta:~$

How to find our application executables?
We can use the file command that will reveal more specific file information.
At all it can by difficult to find them but don’t give up, you’ll find your way out.
Let’s look to some of them like gimp, synaptic, libreOffice, etc….
First of all we have to know where the application is located.
Use the whereis command followed by the name application you prefer.
Type file + path + enter.
In this example you’ll see the path /usr/bin/gimp is linked to gimp-2.8.
Now you have to find out where gimp-2.8 is located by the whereis command.
Than execute file + the given path of gimp-2.8 and you’ll see this is a executable file.

anne0001@beta:~$ pwd
/home/anne0001
anne0001@beta:~$ whereis gimp
gimp: /usr/bin/gimp /etc/gimp /usr/lib/gimp /usr/bin/X11/gimp /usr/share/gimp /usr/share/man/man1/gimp.1.gz
anne0001@beta:~$ file /usr/bin/gimp
/usr/bin/gimp: symbolic link to `gimp-2.8′
anne0001@beta:~$ whereis gimp-2.8
gimp-2: /usr/bin/gimp-2.8 /usr/bin/X11/gimp-2.8
anne0001@beta:~$ file /usr/bin/gimp-2.8
/usr/bin/gimp-2.8: ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), dynamically linked (uses shared libs), for GNU/Linux 2.6.26, BuildID[sha1]=0x4be6b5c0c3f262db1fdb5a9eca1ebc38b62934b9, stripped
anne0001@beta:~$

Let’s see some more executables files of our selected applications.
We have chosen for Synaptic, vim, tomboy. You’re free in your choices of applications.
By Synaptic we’re in lucky, the first path contains our executable file.
Type the bold text displayed here.

anne0001@beta:~$ whereis synaptic
synaptic: /usr/sbin/synaptic /usr/share/synaptic /usr/share/man/man8/synaptic.8.gz
anne0001@beta:~$ file /usr/sbin/synaptic
/usr/sbin/synaptic: ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), dynamically linked (uses shared libs), for GNU/Linux 2.6.26, BuildID[sha1]=0x1dbc721d9863f48b1e7f762848f289664abb946d, stripped
anne0001@beta:~$

Let’s look which location tomboy have.

anne0001@beta:~$ whereis tomboy
tomboy: /usr/bin/tomboy /usr/lib/tomboy /usr/bin/X11/tomboy /usr/share/tomboy /usr/share/man/man1/tomboy.1.gz
anne0001@beta:~$ file /usr/bin/tomboy
/usr/bin/tomboy: a /usr/bin/env bash script, ASCII text executable
anne0001@beta:~$ file /usr/lib/tomboy
/usr/lib/tomboy: directory
anne0001@beta:~$ file /usr/bin/X11/tomboy
/usr/bin/X11/tomboy: a /usr/bin/env bash script, ASCII text executable
anne0001@beta:~$ file /usr/share/tomboy
/usr/share/tomboy: directory
anne0001@beta:~$ file  /usr/share/man/man1/tomboy.1.gz
/usr/share/man/man1/tomboy.1.gz: gzip compressed data, from Unix, max compression
anne0001@beta:~$

Sometimes it’s handy to find locations of different applications at once.
In this example we’ll use synaptic and vim.
Our output shows two executable files of synaptic and vim.

anne0001@beta:~$ whereis synaptic
synaptic: /usr/sbin/synaptic /usr/share/synaptic /usr/share/man/man8/synaptic.8.gz
anne0001@beta:~$ whereis vim
vim: /usr/bin/vim.tiny /etc/vim /usr/bin/X11/vim.tiny /usr/share/vim /usr/share/man/man1/vim.1.gz
anne0001@beta:~$ file /usr/sbin/synaptic /usr/bin/vim.tiny
/usr/sbin/synaptic: ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), dynamically linked (uses shared libs), for GNU/Linux 2.6.26, BuildID[sha1]=0x1dbc721d9863f48b1e7f762848f289664abb946d, stripped
/usr/bin/vim.tiny:  ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), dynamically linked (uses shared libs), for GNU/Linux 2.6.26, BuildID[sha1]=0x18ec027c27af8f3fdc812003fc46aaeaf4c28814, stripped
anne0001@beta:~$

Now we’ve a good idea about applications and it’s files locations.
Keep in mind that this tutorial showed a small amount of possibilities.
Next time we’ll show you how we can open applications using our terminal.

Some handy tips you can use while you’re on a journey through this fancy system.
For very long command use the copy and past feature available in your terminal.
You can review the previous tutorial “Directory and File Management using Terminal Debian.
(
https://gnubizz2.wordpress.com/2013/11/06/directory-and-file-management-using-terminal-debian/ ).

Need some more help about commands and how to use applications?
You can advise –help, man and info pages.
Visit our tutorial “Important built-in information in Debian Wheezy 7 system.”
(
https://gnubizz2.wordpress.com/2013/10/30/important-built-in-information-in-debian-wheezy-7-system/).

We hope you have enjoyed it.
If you have any doubts or questions you can leave a comment.
See you next time. 😉