Securing your Linux lab with resettable user accounts
Reboot Restore
Let your lab users play, and restore the original settings for the next login.
By J. David Eisenberg
Glen Lang, 123RF
Scenario one: You're in charge of an open computer lab at a public library. The users in the lab must have the
ability to customize the computers over the course of their session, but you want to make sure any
modifications they make, whether accidental or intentional, won't become permanent. The changes they make
must disappear once the computer reboots so that the next user on the system will receive a "clean" home
directory with the default user environment.
Scenario two: You're in charge of an open computer lab at a school. When students come in, they can sign on
as either user math or english for a predefined selection of subject-related applications. As with the library
scenario, the students don't have individual login names and passwords, and you don't want the students'
choice of desktop or downloads to stay on the machine permanently. Every time a math student signs on as
user math, the user receives a "clean" default configuration.
This second scenario describes my own work environment. As part of my job at Evergreen Valley College
(San Jose, California), I administer a computer classroom with 30 dual-boot computers (Windows XP and
Linux). To make sure students using Windows have a uniform experience every time they sign on, the
computers have a product named Deep Freeze[1] that makes sure any changes to the computer's
configuration, whether accidental or purposeful, disappear when the computer is rebooted.
When I started working in the lab, Deep Freeze did not offer a Linux version. A Linux version is available
now, but it's not free (as in either speech or beer), so I decided to make a "poor man's" Deep Freeze for the
Linux side of the computer lab.
More Secure Passwords
A two-letter salt encrypts passwords using DES, the least secure form of encryption, which is accepted by all
distributions of Linux in the usermod command. Mandriva and Ubuntu will accept encryption in the MD5
format. To produce an MD5-encrypted password, use a salt that begins with $1$, followed by exactly eight
characters. Below is the output of the encryption for user math using MD5 and an arbitrary eight-letter salt:
$ perl -e 'print crypt("counting","\$1\$jwyxngms"),"\n"'
$1$jwyxngms$2vt6pMlVbZO4l9TTmaYBC0
Reboot Restore 1
How It Works
First, create a compressed file containing the image of the home directory of each Linux user you want
restored at reboot time. (In the example of the computer lab, there will be two image files, one with the clean
desktop for user math and one for user english.)
Then set up a configuration file that gives that user's name, an encrypted password, and the location of the
compressed image file. At boot time, an init script calls a Perl program to restore the user.
Creating the Student Image
On one machine, designated the "master copy," adjust the configuration (desktop, menus, applications, etc.)
for each student to the state desired. Here's the tricky part: You can't compress the student's home file while
signed on as that student. Instead, you want to be alone on the machine. Pressing Ctl+Alt+F1 drops you into a
text-only terminal. To go to single-user mode, log in as root and then type:
init 1
When in single-user mode, you are the root user, the network isn't running, and you are guaranteed that the
user whose files you are compressing isn't online.
Now create images of the user directories you want restored at boot time. If your computer lab has separate
accounts for math and english users, use tar to create a compressed image for each:
tar -cvzf math_home.tar.gz /home/math # gzip form
tar -cvjf english_home.tar.bz2 /home/english # bzip2 form
Of course, you probably want to use the same archive format for all the users you want to restore, but I
wanted to show an example of both forms. The name of the compressed image file must end with .gz or .bz2
or the restore program won't work properly. In my lab, the average size of each user image file is about 2MB.
Local or Remote
Either you place the image files on a server or you copy them to each machine. The advantage of the server is
that you need to put the files there only once; the advantage of placing them on each machine is that you do
not need to depend on a network connection that might be down or have a slow transfer rate.
In most cases, you will probably place your image files on the server. For my lab, it was more advantageous
to copy the files to each of the machines. If you are installing the images on each machine, you probably want
to upload the image to a server somewhere and download it to each machine via FTP or wget. Also, you could
copy the image files to a USB stick and then copy them to the individual machines.
The Configuration File
Each machine requires a configuration file. On my systems, I named it /etc/reboot-restore.conf, a reasonable
name and place to put the file. This file specifies the users with home directories that will be restored when
the system reboots.
Each line of the file has the following settings (separated by semicolons): the user name, the encrypted
password, and the path to the image file (Listing 1).
Listing 1: /etc/reboot-restore.conf
01 #
02 # Configuration for users math and english
03 # math's image is on each machine
04 # english's image is on a server; you'd replace my.example.com
Reboot Restore 2
05 # with the name of the server
06 math;qcnVJoZLZDRAE;/usr/local/reboot-restore/math_home.tgz
07 english;grrxaQN5BbNTM;http://my.example.com/images/english_home.tar.bz2
Part of restoring the user is restoring the password, which the user could change during a session. usermod,
which changes the password, only accepts a password encrypted by the crypt function. Rather than placing the
passwords in the configuration file in plain text and letting the restore script do the encryption, I decided to
put encrypted passwords in the configuration file for a minimum level of security. To encrypt a password, use
the Perl command:
perl -e 'print crypt("password", "salt"),"\n";'
The first argument to crypt is the plaintext password. The second argument is a "salt," which comprises
characters used as random input for the encryption algorithm. Only the first two letters of the salt are used,
and they will be the first two letters of the encrypted password. The following lines show how I encrypted the
password counting for user math and the password writing for user english with the use of arbitrary salts:
$ perl -e 'print crypt("counting","qc"), "\n"'
qcnVJoZLZDRAE
$ perl -e 'print crypt("writing", "gr"), "\n"'
grrxaQN5BbNTM
Blank lines in the configuration are ignored; anything following a # is also ignored. Listing 1 shows the
configuration file I used for testing. The directory /usr/local/reboot-restore holds the compressed image file.
The Restoration Program
The configuration file in Listing 1 is read by the program in Listing 2, which does the actual restoration.
Listing 2: reboot-restore.pl
001 #!/usr/bin/perl
002
003 use strict;
004
005 my $conf = $ARGV[0];
006 my $return_value;
007 my $processed = 0;
008 my $processed_ok = 0;
009 my $data;
010 my $result;
011 my $etc_passwd;
012 my $devnull = "> /dev/null 2>&1";
013
014 if ($conf && -r $conf)
015 {
016 open INFILE, "/etc/passwd";
017 while ($data = )
018 {
019 $etc_passwd .= $data;
020 }
021 close INFILE;
022
023 $result = open INFILE, $conf;
024 if ($result)
025 {
026 while ($data = )
027 {
028 chomp $data;
029 $data =~ s/#.*$//;
030 if ($data !~ m/^\s*$/)
031 {
032 process_user($data);
033 $processed++;
Reboot Restore 3
034 }
035 }
036 close INFILE;
037 }
038 $return_value = ($processed == $processed_ok) ? 0 : 1;
039 }
040
041 exit $return_value;
042
043 sub process_user
044 {
045 my $data = shift;
046 my $user;
047 my $password;
048 my $compressed_file;
049 my $user_info;
050 my $basename;
051 my $result;
052 my $has_temp_file = 0;
053
054 ($user, $password, $compressed_file) = split(/\s*;\s*/, $data);
055
056 if ($user && $password && $compressed_file)
057 {
058 # restore only users that exist
059 if ($etc_passwd =~ m/^$user:[^:]+:(.*?)$/m)
060 {
061 $user_info = $1;
062 if ($compressed_file =~ m!^(http|ftp)://!)
063 {
064 $basename = $compressed_file;
065 # greedy matching gets
066 # the last match
067 $basename =~ s!^.*/!!;
068 $result =
069 system("wget --output-document /tmp/$basename " .
070 "$compressed_file $devnull");
071 $compressed_file = "/tmp/$basename";
072 $has_temp_file = ($result == 0) ? 1 : 0;
073 }
074 else
075 {
076 $result = (-e $compressed_file &&
077 (! (-z $compressed_file))) ? 0 : 1;
078 }
079 if ($result == 0)
080 {
081 restore_user($user_info, $user, $password, $compressed_file
082 }
083 if ($has_temp_file)
084 {
085 unlink $compressed_file;
086 }
087 }
088 }
089 }
090
091 sub restore_user
092 {
093 my $user_info = shift;
094 my $user = shift;
095 my $password = shift;
096 my $compressed_file = shift;
097 my $uid;
098 my $gid;
099 my $gecos;
100 my $homedir;
101 my $shell;
Reboot Restore 4
102 my $zip_type;
103
104 ($uid, $gid, $gecos,
105 $homedir, $shell) =
106 split( /:/, $user_info);
107 $zip_type = "";
108 if ($compressed_file =~ m/gz$/)
109 {
110 $zip_type = "z";
111 }
112 elsif ($compressed_file =~ m/bz2$/)
113 {
114 $zip_type = "j";
115 }
116 if ($zip_type ne "")
117 {
118 do_commands(
119 "rm -rf $homedir $devnull",
120 "(cd / $devnull; tar x${zip_type}f $compressed_file $devnull)",
121 "chown -R $user: $homedir $devnull",
122 "usermod -p '$password' $user $devnull"
123 );
124 $processed_ok++;
125 }
126 }
127
128 sub do_commands
129 {
130 my $command;
131 foreach $command (@_)
132 {
133 # uncomment next to debug
134 # print $command, "\n";
135 system($command);
136 }
137 }
The program gets the name of the configuration file from its first command-line argument (line 5) then reads
the contents of the /etc/passwd file (lines 16-21). Then it reads the configuration file. For each line that is in
the proper format (line 54-56), the program checks to see whether it is for a valid user (lines 59). The program
then downloads the image file if it's not local (lines 64-72) and stores it in a temporary file. After that, the
script calls the restore_user subroutine, passing along the user's /etc/passwd information as a parameter.
That subroutine separates the user information (lines 104-106), figures out the image file's compression type
(lines 107-115) then calls commands in lines 118-123 to
" remove the user's home directory,
" decompress the image file (thus re-creating the home directory),
" change the ownership of the directory and its files, and
" restore the user's password.
The change of ownership is necessary in case the machines are not all exactly identical; if machine A has user
math as user number 501 and machine B has user math as user number 502, the image's ownership flags must
change to suit the machine.
If the image file was downloaded, the restore subroutine gets rid of the temporary file (lines 83-86). After all
the lines in the configuration are processed, the script ends, returning 0 (no errors), if every line processed was
OK, returning 1 otherwise.
Reboot Restore 5
This script should be placed in a reasonable system-level location on each machine that needs the restore
capability. In this example, I created the directory /usr/local/reboot-restore and put the reboot-restore.pl script
in that directory on each machine. At this point, make sure the script permissions are set to executable.
Invoking the Script
Finally, you need to make sure the script is executed whenever the machine is rebooted. The easiest way to do
this is to invoke it from the /etc/rc.d/rc.local file. This script is executed as the last step in the startup process.
For this example, I added these lines to the file:
/usr/local/reboot-restore/reboot-restore.pl \
/etc/reboot-restore.conf
When the system starts, rc.local will invoke the script and restore the original user environment.
INFO
[1] Deep Freeze: http://www.faronics.com/html/deepfreeze.asp
THE AUTHOR
J. David Eisenberg teaches Computer and Information Technology classes at Evergreen Valley College in
San Jose, CA. He also does feral cat trapping on campus. He lives with his two cats, Marco Polo and Big
Tony.
Reboot Restore 6