How Do You Fix “Cannot find any quota file…” or “Cannot guess” after Running a Quota-Related Command?

Problem scenario
You run a command like edquota, but you get an error about not finding a quota file to work on or no file systems with a quota have been detected. Or maybe you ran a quotacheck command and got an error about not being able to guess a format from a filename.

What should you do?

Solution

  1. Can you move the aquota.group or aquota.user file at the root of the file system to a backed up version (e.g., in your home directory)? Move it to a backed up name that you won't forget. (This way if you make a mistake, you still have the quota file.)
  2. Run this command (but use "vfsv0" if you are using a 32 bit OS):
    sudo quotacheck -F vfsv1 -avum
  3. Run a command like this: quotacheck -cug /path/to/filesystem

(but replace "/path/to/filesystem" with the path to the file system)

Another solution for this problem that was written in 2012 is here: https://talk.plesk.com/threads/hard-diskquota-install-error.258095/

(The above plesk.com link helped explain what to do for these directions too.)

How Do You Troubleshoot a VirtualBox VM saying “failed unmounting /cdrom”?

Problem scenario
In VirtualBox you are trying to boot a VM, but you get "failed unmounting /cdrom". You see no option to unmount or remove the CD ROM. What should you do?

Possible Solution #1
Restart VirtualBox. Close it. Reopen it.

Possible Solution #2
Reboot the computer hosting/running VirtualBox.

How Do You Make Changes to an /etc/fstab File when It Is Read Only?

Problem scenario
You cannot make changes to an /etc/fstab file. It is read only. What should you do?

Possible Solution #1
If your /etc/fstab file is messed up (through manual changes to it), and your system boots it as read only, can you run a command like this?

sudo mount -o remount,rw /dev/mapper/foobar /directory/to/be/mounted

If you run "sudo cat /etc/fstab" you will see lines like this:

/dev/mapper/foobar / ext4 defaults 1 1

(If you saw the above, and that was the line that was corrupt, replace "/directory/to/be/mounted" with "/".)

If it doesn't work, with modern Linux OSes and modern hardware, you can boot to rescue mode without installation media (e.g., a CD, DVD or USB stick).

Possible Solution #2
Use "sudo". Sometimes when you are frantic, you forget that normal users cannot make changes to sensitive files. Can you assume the root user?

Possible Solution #3

See one of these three links:
https://www.unix.com/linux/54874-how-edit-etc-fstab-when-root-mounted-read-only.html
https://linuxtect.com/read-only-file-system-error-and-solutions/
https://forums.fedoraforum.org/archive/index.php/t-144176.html

There was a good stackexchange.com (e.g., unix.stackexchange.com) posting and answer for something similar that involved booting up, then moving the file system temporarily to RAM and/or /tmp/. If you know which one this was, please post it in the comments below.

Is It a Best/Recommended Practice to Not Allow Desktop Clipboard Pastes for Password Fields on a Website?

Problem scenario
You think a website field for a password should allow a password to be pasted in. This could make the users not copy the password. Some hackers exploit memory/RAM. Should you avoid allowing a password to be pasted in?

Solution
Traditionally confirmation password fields did not allow pasting (with control-v) from the clipboard. Now NIST is saying you can do this: https://pages.nist.gov/800-63-FAQ/

Some people think it is not ideal to have sensitive information in RAM. It is not clear. If you make the field impossible to paste, and declare it, the user may not copy the password. But this would violate modern NIST standards.

You may want to read this too: https://www.auditboard.com/blog/nist-password-guidelines/

How Are Backoff Strategies (with Client Retries) Helpful?

Question
Sometimes a client attempts to connect to or use an application. Sometimes a Kubernetes Pod is being created and tries to pull down an image. Sometimes a network device tries to establish a connection to an endpoint. These attempts can initially fail. Retries can be attempted in rapid succession. To mitigate excessive attempts in a short amount of time (to not waste resources or cause a denial-of-service attack), a backoff strategy will be implemented.

A backoff strategy is one where a program or algorithm may try to pause after initial failed attempts, to eventually try again. Ultimately the goal is to connect to another service or use a file (or something similar). But if the other service was in use and constrained (e.g., via concurrency control), the client attempts may fail.

It seems like aggressively and persistently retrying to use the resource (e.g., a file) would be the best option after an initial failure. Why would backoff strategies be used rather than repeated simple, fixed-time intervals?

Answer
For files: Round robin distribution for multiple clients, processes or applications is achievable over time provided that simultaneous attempts at accessing a file with strict locking are avoided. Slowing the rate after a certain number of failures is beneficial to both the overall success of multiple processes and the security of the entire software system.

Concurrency control with files, variables in messaging systems, or atomic values in data stores often involve decentralized components. Race conditions involve two or more clients trying to use a resource at the same time. To backoff attempting excessive utilization of a file (e.g., two or more processes trying to modify a file) or variable that is not available, a random amount of time may be used to pause the subsequent attempt. Successive backoffs, as part of a strategy to successfully modify or write data, may involve durations that successively become increasing. Excessive failed attempts can create bandwidth congestion or unnecessary CPU or RAM utilization. Random durations of retries can prevent problems with inadvertently simultaneous attempts.

Backoff algorithms (with variable time factors that increase each successive attempt) can prevent denial of service attacks as compromised systems cannot make too many requests in a short duration. A client's thread (or process) that attempts to access data may need to invoke a sleep function (a common feature of many programming languages) to ensure time lapses between attempts.

Network traffic routing also involves a decentralized pair of devices (a source and destination). If there are collisions with packets in a network, many routing algorithms will have a variable amount of time before a packet is transmitted across the network again. Collision avoidance along paths can be better achieved with a backoff strategy. See [1] for more information.

Upstream throttling or load shedding are deliberate actions designed to prevent a denial-of-service. The benefit of having some service at the price of reduced rate/capacity can be a design tradeoff that systems architects are willing to accept. Synchronization of resource utilization could be an alternative to backoff strategies (by avoiding the scenarios where they are necessary). Usually this scheduling strategy for performance tuning would apply to routine processing of batch jobs or nightly backups. By using different schedules for processes that try to connect to a server or use the same file, you can avoid the race conditions or getting close to maximum bandwidth utilization at single time of the day.

[1] https://en.wikipedia.org/wiki/Exponential_backoff#Collision_avoidance

To read about backoffs with Kubernetes using different images, see these four links:

https://www.tutorialworks.com/kubernetes-imagepullbackoff/
https://stackoverflow.com/questions/34848422/how-can-i-debug-imagepullbackoff

https://blog.ediri.io/kubernetes-imagepullbackoff

https://foxutech.medium.com/kubernetes-imagepullbackoff-troubleshooting-with-examples-6c278c3bbb43

How Do You Install the Putty Utility on a Linux Server?

Problem scenario
You want to run the puttygen command on a Linux server. (You tried yum and dnf commands to install putty, but they failed.) What do you do?

Solution
Prerequisites

i. These directions assume you have installed the C compiler. If you need assistance, see How Do You Install a C Compiler on Linux?
ii. These directions also assume you have the GTK library installed. For a CentOS/RHEL/Fedora server, run this: sudo yum -y install gtk2-devel.
iii. This assumes that make is installed. If you need assistance see How Do You Install the make Utility on Any Type of Linux?

Procedures
Run this script:

version=0.74
curl -L https://the.earth.li/~sgtatham/putty/latest/putty-$version.tar.gz > /tmp/putty-$version.tar.gz
cp /tmp/putty-$version.tar.gz /bin/
cd /bin
tar -zxvf putty-$version.tar.gz
cd putty-$version
./configure
make
make install
echo ""
echo "Script is complete. Below will check the version for default CentOS/RHEL/Fedora installations…"
echo ""
/usr/local/bin/puttygen --version

Is It a Best/Recommended Practice to Enforce Complex Passwords?

Problem scenario
You are modifying /etc/security/pwquality.conf. Is it a recommended practice to have no or few repeating characters with different classes of characters including lowercase, uppercase, numbers and special characters?

Solution
It can be counter productive to have very strong password requirements according to the NIST (https://pages.nist.gov/800-63-FAQ/).

If you are using Linux or Unix, NIST does suggest you use a crack library dictionary (per A-B10 from https://pages.nist.gov/800-63-FAQ/). Often these are used by default.

You may want to read this: https://www.sans.org/blog/nist-has-spoken-death-to-complexity-long-live-the-passphrase/

The FBI says "Make sure your password is as long as the system will allow." (This was taken from https://www.fbi.gov/contact-us/field-offices/phoenix/news/press-releases/fbi-tech-tuesday-strong-passphrases-and-account-protection.)

Some sources recommend you have complex passwords: https://www.sseinc.com/blog/cmmc-password-requirements/

Is It a Best/Recommended Practice to Not Use “Make Visible” the Password when Entering It?

Problem scenario
You think that the users should not click the "make visible" option when entering a password. As an I.T. professional, you are not sure if this should be used or not. You read and think that it should not be used. Is it recommended that you have a practice of not letting the users make the password visible?

Solution
It is not clear. The National Institute for Standards and Technology now recommend you use it (according to
https://auth0.com/blog/dont-pass-on-the-new-nist-password-guidelines/ ). Why? Users are given incentive to create shorter more guessable passwords when they cannot type it in. Traditionally it was said that passwords should not be written down or saved elsewhere. Password managers are now common. Visibility enables complex passwords. Canonically the policy was that if someone was shoulder surfing, an invisible password (with "*" or dots) would be more secure.

Is It a Recommended/Best Practice to Use Email as a Component in Two Factor Authentication?

Problem scenario
You want to implement a secure protocol for authentication. You want there to be a password and a second factor of authentication. Can an email (being in possession of an inbox) be a factor in MFA?

Answer
Maybe.

No, according to NIST: https://pages.nist.gov/800-63-FAQ/
But many companies do use email as a factor in multi-factor authentication.

How Do You Troubleshoot a quotacheck Command Failure with “Cannot guess format from filename…Please specify format on commandline”?

One of the following apply to your situation:

Problem scenario #1
You are running a quotacheck command. You get this error:

quotacheck: Cannot guess format from filename on /dev/mapper/ubuntu--vg-ubuntu--lv. Please specify format on commandline.
quotacheck: Cannot find filesystem to check or filesystem not mounted with quota option.

What should you do?

or
Problem scenario #2
You try to run an edquota command, but you get "Cannot find any quota file to work on. No file systems with quota detected." What should you do?

or

Problem scenario #3
You get an error like this:

quotacheck: Cannot guess format from filename on foobar. Please specify format on commandline.
quotacheck: Cannot find filesystem to check or filesystem not mounted with quota option.

What should you do?

Possible Solution #1 (for a Red Hat distribution of Linux)

  1. Remove the aquota.group and aquota.user files
  2. Run this (but change "vfsv1" to "vfsv0" if you are using a 32 bit OS):
sudo quotacheck -F vfsv1 -avum

This solution was adapted from https://talk.plesk.com/threads/hard-diskquota-install-error.258095/

Possible Solution #2 (for a non Red Hat distribution of Linux)
According to Red Hat documentation, this probably would not help a Red Hat derivative Linux system. Below could help a non-Red Hat Linux system.

Backup the /etc/fstab file to (.bak in some accessible directory). Keep the original backup in case there is a problem.

Update the /etc/fstab file.

Is the word "quota" near the "grpquota" word on the line for the file system you want to have a quota enforced?

Here is a version of an incorrect /etc/fstab file that will cause the problem:

/dev/disk/by-id/dm-uuid-LVM-abcd1234 / ext4 defaults,grpquota 0 0
# /boot was on /dev/sda2 during curtin installation
/dev/disk/by-uuid/987654321 /boot ext4 defaults 0 0

Here is a correct version of /etc/fstab:

/dev/disk/by-id/dm-uuid-LVM-abcd1234 / ext4 defaults,quota,grpquota 0 0
# /boot was on /dev/sda2 during curtin installation
/dev/disk/by-uuid/987654321 /boot ext4 defaults 0 0

Remount the relevant mount point (with a sudo mount -o remount /relevant/mount/point) or reboot after your /etc/fstab has been corrected.

Possible Solution #3
See these postings:

https://www.howtoforge.com/community/threads/quotacheck-cannot-find-filesystem-to-check.25954/
https://blog.naver.com/syseoz/220458453446