Lecture 11: Sys Admin-B

1. Lecture 11: Sys Admin-B • Windows Registry • File Integrity • fsck (both Windows and Linux)

2. Windows Registry • Used for system and program configuration • Not forced, just available • E.g., .NET Framework doesn’t use it • Implemented as a database • Allows atomic operations • Why would we need these?

3. Windows Registry • Used for system and program configuration • Not forced, just available • E.g., .NET Framework doesn’t use it • Implemented as a database • Allows atomic operations • Why would we need these? • Multiple processes modifying database

4. Windows Registry • Contains key/value pairs • Some keys contain sub-keys, sub-etc • How do we access it?

5. Windows Registry • Contains key/value pairs • Some keys contain sub-keys, sub-etc • How do we access it? • regedit.exe

6. Windows Registry • Contains key/value pairs • Some keys contain sub-keys, sub-etc • How do we access it? • regedit.exe • It naturally gets cluttered over time • Some tools will clean it to some degree

7. Windows Registry • So what’s in it? • System config settings • Program settings • Device driver stuff • Usernames/passwords • Encrypted via OWF • We need to be very careful editing the registry • One mistake can nuke the OS

8. Linux Registry? • No Windows-registry equivalent • Files are: • Plain text • Scattered • Most files are within /etc folder

9. File Integrity • I have a file on my computer • Files are quite large • There’s more than one of two of them • How do I know none of them have been modified • That’s hard, so let’s focus on a single file

10. File Integrity • How can files become corrupted? • Initially wrong • Usually during transmission • Bad storage device • Maintenance errors • Moving/copying files • Software modifying files misbehaves

11. File Integrity • So how do we detect this? • Crytographic hash function • For our purposes, it is… • …trivial to compute • …unlikely to have two messages give the same hash • …unlikely to change data without changing hash • …unlikely to create data that creates a particular hash

12. File Integrity • I’ve now created a hash for a file • Let’s assume we know the file is good • At a later time, I can re-compute a new hash and compare them

13. File Integrity • If they match, is the file okay? • If they don’t match, if the file bad?

14. File Integrity • If they match, is the file okay? • Probably • Rare collisions do happen • If they don’t match, if the file bad?

15. File Integrity • If they match, is the file okay? • Probably • Rare collisions do happen • If they don’t match, if the file bad? • Probably • False positives do happen. How?

16. File Integrity • If they match, is the file okay? • Probably • Rare collisions do happen • If they don’t match, if the file bad? • Probably • False positives do happen. How? • What if original key got corrupted?

17. File Integrity • Okay, so how do I know my pre-computed hashes are good?

18. File Integrity • Okay, so how do I know my pre-computed hashes are good? • Let’s make a hash! • Is this a bad idea?

19. File Integrity • Okay, so how do I know my pre-computed hashes are good? • Let’s make a hash! • Is this a bad idea? • It’s a hash of a hash • How do I know my hash of a hash is good?

20. File Integrity • Okay, so how do I know my pre-computed hashes are good? • Let’s make a hash! • Is this a bad idea? • It’s a hash of a hash • How do I know my hash of a hash is good? • Let’s make a hash! • Wait for it….

21. File Integrity • We can’t verify everything • We must be selective about what we are trying to verify

22. fsck • When I use my computer, I make changes to the filesystem • Add/edit/delete • Is my file saved when I save it?

23. fsck • When I use my computer, I make changes to the filesystem • Add/edit/delete • Is my file saved when I save it? • It’s written to an internal kernel buffer • Actual write to HDD only when the buffer is flushed (when buffer is full or at 30-second intervals)

24. fsck • Kernel buffer and that material on the hard drive may differ • Shut down too soon • Unmounted improperly • Additionally, hard drives go bad • Blocks can become damaged • Addressing system damaged

25. fsck • fsck will scan for some errors • It’ll fix them if it can • What types of errors does it look for?

26. fsck • Superblock contains information about file system • Size • Number of inodes • Free-block count • Free-inode count

27. fsck • Inodes • File format and type • Inode size • Duplicate blocks between inodes • Bad block numbers

28. fsck • Data blocks • Files with unallocated block number • Files with inode greater than allowed number • Free-ranging directories • Directories that aren’t attached to filesystem • Bad . and .. directories