From 969a4f74554271b3f9599dfb19b7277e80688a7a Mon Sep 17 00:00:00 2001 From: Paul Cobbaut Date: Wed, 5 Aug 2015 18:08:55 +0200 Subject: [PATCH] several systemd updates --- modules/systemd/030_systemd_theory.xml | 130 +++++++++++++++---------- 1 file changed, 76 insertions(+), 54 deletions(-) diff --git a/modules/systemd/030_systemd_theory.xml b/modules/systemd/030_systemd_theory.xml index fbd35463..3a268448 100644 --- a/modules/systemd/030_systemd_theory.xml +++ b/modules/systemd/030_systemd_theory.xml @@ -21,17 +21,15 @@ root@debian8:~#
systemd targets The first command to learn is systemctl list-units --type=target (or the shorter version systemctl -t target). It will show you the different targets on the system. - [root@rhel7 ~]# systemctl list-units --type=target + [root@rhel71 ~]# systemctl -t target UNIT LOAD ACTIVE SUB DESCRIPTION basic.target loaded active active Basic System cryptsetup.target loaded active active Encrypted Volumes getty.target loaded active active Login Prompts -graphical.target loaded active active Graphical Interface local-fs-pre.target loaded active active Local File Systems (Pre) local-fs.target loaded active active Local File Systems multi-user.target loaded active active Multi-User System network.target loaded active active Network -nfs.target loaded active active Network File System Server paths.target loaded active active Paths remote-fs.target loaded active active Remote File Systems slices.target loaded active active Slices @@ -44,19 +42,20 @@ LOAD = Reflects whether the unit definition was properly loaded. ACTIVE = The high-level unit activation state, i.e. generalization of SUB. SUB = The low-level unit activation state, values depend on unit type. -16 loaded units listed. Pass --all to see loaded but inactive units, too. +14 loaded units listed. Pass --all to see loaded but inactive units, too. To show all installed unit files use 'systemctl list-unit-files'. -[root@rhel7 ~]# +[root@rhel71 ~]# Targets are the replacement of runlevels and define specific points to reach when booting the system. For example the graphical.target is reached when you get a graphical interface, and the nfs.target requires a running nfs server. To switch to a target (for example multi-user.target), we now use systemctl isolate (instead of the equivalent init 3 to change the runlevel). -[root@rhel7 ~]# ps fax | wc -l + This screenshot shows a Red Hat Enterprise Linux 7 server switching from a graphical interface to command line (decreasing the number of running processes). +[root@rhel7 ~]# ps fax | wc -l 169 -[root@rhel7 ~]# systemctl isolate multi-user.target -[root@rhel7 ~]# ps fax | wc -l +[root@rhel7 ~]# systemctl isolate multi-user.target +[root@rhel7 ~]# ps fax | wc -l 129 [root@rhel7 ~]# To change the default target, we again use this systemctl command (instead of editing the /etc/inittab file). -[root@rhel7 ~]# systemctl enable multi-user.target --force +[root@rhel7 ~]# systemctl enable multi-user.target --force rm '/etc/systemd/system/default.target' ln -s '/usr/lib/systemd/system/multi-user.target' '/etc/systemd/system/default\ .target' @@ -65,80 +64,103 @@ ln -s '/usr/lib/systemd/system/multi-user.target' '/etc/systemd/system/default\
systemd dependencies - Dependencies are no longer defined by alfabetical order of running scripts, but by configuration in /etc/systemd/system/. For example here are the required services for the multi-user.target on Red Hat Enterprise 7. - [root@rhel7 ~]# ls /etc/systemd/system/multi-user.target.wants/ -abrt-ccpp.service hypervkvpd.service postfix.service -abrtd.service hypervvssd.service remote-fs.target -abrt-oops.service irqbalance.service rhsmcertd.service -abrt-vmcore.service ksm.service rngd.service -abrt-xorg.service ksmtuned.service rpcbind.service -atd.service libstoragemgmt.service rsyslog.service -auditd.service libvirtd.service smartd.service -avahi-daemon.service mdmonitor.service sshd.service -chronyd.service ModemManager.service sysstat.service -crond.service NetworkManager.service tuned.service -cups.path nfs.target vmtoolsd.service -[root@rhel7 ~]# - Debian8 is not fully migrated yet. -root@debian8:~# ls /etc/systemd/system/multi-user.target.wants/ -anacron.service binfmt-support.service pppd-dns.service ssh.service -atd.service fancontrol.service remote-fs.target -avahi-daemon.service lm-sensors.service rsyslog.service + Dependencies are no longer defined by alfabetical order of running scripts, but by configuration in /etc/systemd/system/. For example here are the required services for the multi-user.target on Red Hat Enterprise 7.1. + [root@rhel71 ~]# cat /etc/redhat-release +Red Hat Enterprise Linux Server release 7.1 (Maipo) +[root@rhel71 ~]# ls /etc/systemd/system/multi-user.target.wants/ +abrt-ccpp.service auditd.service postfix.service sysstat.service +abrtd.service chronyd.service remote-fs.target tuned.service +abrt-oops.service crond.service rhsmcertd.service +abrt-vmcore.service irqbalance.service rsyslog.service +abrt-xorg.service NetworkManager.service sshd.service +[root@rhel71 ~]# + Below a screenshot from Debian (stretch/sid is Debian 9). There is already a lot of systemd in Debian 8 and 9 (less than in RHEL7). + root@debian9:~# cat /etc/debian_version +stretch/sid +root@debian9:~# ls /etc/systemd/system/multi-user.target.wants/ +anacron.service binfmt-support.service lm-sensors.service rsyslog.service +atd.service cron.service pppd-dns.service ssh.service +avahi-daemon.service fancontrol.service remote-fs.target +root@debian9:~# Typical rc scripts are replaced with services. Issue the systemctl list-units -t service --all (or systemctl -at service) to get a list of all services on your system. -[root@rhel7 ~]# systemctl -at service | head -5 | column -t | cut -c1-78 +[root@rhel7 ~]# systemctl -at service | head -5 | column -t | cut -c1-78 UNIT LOAD ACTIVE SUB DESCRIPTION abrt-ccpp.service loaded active exited Install ABRT coredump abrt-oops.service loaded active running ABRT kernel log abrt-vmcore.service loaded inactive dead Harvest vmcores for abrt-xorg.service loaded active running ABRT Xorg log [root@rhel7 ~]# - And here an example on how to see the status of the sshd service. -[root@rhel7 ~]# systemctl status sshd.service +
+ +
service status + Below is a (truncated) screenshot showing how to see the status of the sshd service. (This RHEL server was attacked using brute force ssh on 2 August 2015.) +[root@rhel71 ~]# systemctl status sshd.service + sshd.service - OpenSSH server daemon - Loaded: loaded (/usr/lib/systemd/system/sshd.service; enabled) - Active: active (running) since Wed 2014-09-10 13:42:21 CEST; 55min ago - Main PID: 1400 (sshd) - CGroup: /system.slice/sshd.service - --1400 /usr/sbin/sshd -D + Loaded: loaded (/usr/lib/systemd/system/sshd.service; enabled) + Active: active (running) since Wed 2015-07-29 12:00:10 CEST; 1 weeks 0 days ago +Main PID: 1123 (sshd) + CGroup: /system.slice/sshd.service + └─1123 /usr/sbin/sshd -D -Sep 10 13:42:21 rhel7 systemd[1]: Started OpenSSH server daemon. -Sep 10 13:42:21 rhel7 sshd[1400]: Server listening on 0.0.0.0 port 22. -Sep 10 13:42:21 rhel7 sshd[1400]: Server listening on :: port 22. -[root@rhel7 ~]# +Aug 02 16:45:24 rhel71 sshd[12704]: Failed password for root from 43.229.53.79 +Aug 02 18:15:28 rhel71 sshd[12872]: pam_unix(sshd:auth): authentication failur +Aug 02 18:15:28 rhel71 sshd[12872]: pam_succeed_if(sshd:auth): requirement "ui +Aug 02 18:15:30 rhel71 sshd[12872]: Failed password for root from 43.229.53.79 +Aug 02 18:15:30 rhel71 sshd[12872]: pam_succeed_if(sshd:auth): requirement "ui +Aug 02 18:15:32 rhel71 sshd[12872]: Failed password for root from 43.229.53.79 +Aug 02 18:15:32 rhel71 sshd[12872]: pam_succeed_if(sshd:auth): requirement "ui +Aug 02 18:15:34 rhel71 sshd[12872]: Failed password for root from 43.229.53.79 +Aug 02 18:15:34 rhel71 sshd[12872]: Received disconnect from 43.229.53.79: 11: +Aug 03 10:21:11 rhel71 sshd[14616]: pam_unix(sshd:auth): authentication failur +Aug 03 10:21:11 rhel71 sshd[14616]: pam_succeed_if(sshd:auth): requirement "ui +Aug 03 10:21:13 rhel71 sshd[14616]: Failed password for root from 119.188.7.14 +Aug 03 10:21:13 rhel71 sshd[14616]: Received disconnect from 119.188.7.143: 11 +Aug 03 14:20:03 rhel71 sshd[15083]: Accepted password for root from 192.168.1. +Hint: Some lines were ellipsized, use -l to show in full. +[root@rhel71 ~]# + This systemd feature does not work by default on Debian 8/9 because init has pid 1. It only works when the system is booted with systemd as pid 1. + root@debian8:~# systemctl status sshd +Failed to get D-Bus connection: Operation not permitted +root@debian8:~# systemctl status ssh +Failed to get D-Bus connection: Operation not permitted +root@debian8:~# service ssh status +sshd is running. +root@debian8:~#
-
systemd services +
systemd services configuration The chkconfig and service commands are considered 'legacy'. They are replaced with systemctl. This screenshot shows the new way to start and stop a service. -[root@rhel7 ~]# systemctl start crond.service -[root@rhel7 ~]# systemctl show crond.service | grep State +[root@rhel7 ~]# systemctl start crond.service +[root@rhel7 ~]# systemctl show crond.service | grep State LoadState=loaded ActiveState=active SubState=running UnitFileState=enabled -[root@rhel7 ~]# systemctl stop crond.service -[root@rhel7 ~]# systemctl show crond.service | grep State +[root@rhel7 ~]# systemctl stop crond.service +[root@rhel7 ~]# systemctl show crond.service | grep State LoadState=loaded ActiveState=inactive SubState=dead UnitFileState=enabled [root@rhel7 ~]# And here is the new way to stop and disable a service. - [root@rhel7 ~]# systemctl stop crond.service -[root@rhel7 ~]# systemctl disable crond.service + [root@rhel7 ~]# systemctl stop crond.service +[root@rhel7 ~]# systemctl disable crond.service rm '/etc/systemd/system/multi-user.target.wants/crond.service' -[root@rhel7 ~]# systemctl show crond.service | grep State +[root@rhel7 ~]# systemctl show crond.service | grep State LoadState=loaded ActiveState=inactive SubState=dead UnitFileState=disabled [root@rhel7 ~]# This screenshot shows how to enable and start the service again. - [root@rhel7 ~]# systemctl enable crond.service + [root@rhel7 ~]# systemctl enable crond.service ln -s '/usr/lib/systemd/system/crond.service' '/etc/systemd/system/multi-user.\ target.wants/crond.service' -[root@rhel7 ~]# systemctl start crond.service -[root@rhel7 ~]# systemctl show crond.service | grep State +[root@rhel7 ~]# systemctl start crond.service +[root@rhel7 ~]# systemctl show crond.service | grep State LoadState=loaded ActiveState=active SubState=running @@ -148,13 +170,13 @@ UnitFileState=enabled
systemd signalling You can also use systemd to kill problematic services. -[root@rhel7 ~]# systemctl show crond.service | grep State +[root@rhel7 ~]# systemctl show crond.service | grep State LoadState=loaded ActiveState=active SubState=running UnitFileState=enabled -[root@rhel7 ~]# systemctl kill -s SIGKILL crond.service -[root@rhel7 ~]# systemctl show crond.service | grep State +[root@rhel7 ~]# systemctl kill -s SIGKILL crond.service +[root@rhel7 ~]# systemctl show crond.service | grep State LoadState=loaded ActiveState=failed SubState=failed