Disks, partitions, and filesystems

Disks, partitions, and filesystems Physical Disks Hard disks in Linux are classified by type (IDE or SCSI). The device name of the first IDE disk is /dev/hda. The second IDE disk is /dev/hbd. The third IDE disk is /dev/hdc, and so on. SCSI disks follow a similar naming convention (i.e. /dev/sda, /dev/sdb...). If your system uses any kind of RAID configuration you should configure that first. Most RAID controllers have a built in management utility that can be accessed shortly after the computer runs the POST. Keep in mind that regardless of how many disks are actually involved, a RAID array or mirror will appear as a single disk when you want to partition it. Partition Types The Master Boot Record (MBR) of a physical disk contains the partition table and has room for four records. Each record describes one partition on a disk. The most basic type of partition is called a primary partition. A single disk can contain up to four primary partitions. If you need more than four partitions, you can make one of your primary partitions an extended partition. An extended partition appears just like a regular primary partition in the MBR but in the first sector of its allocated disk space there is an additional partition table called the Extended MBR (EMBR). This allows you to create additional partitions within the extended partition. Partitions created within an extended partition are called logical partitions. The only partition types that can hold data are primary and logical. Extended partitions simply allow us to get around the four-partition limit of the MBR. In Linux, partitions are identified by the name of the disk and a number. For example, the device /dev/hda1 represents the first primary partition on the first IDE disk. The third primary partition on the second SCSI disk would be identified as /dev/sdb3. For logical partitions, the numbering starts at five (i.e. /dev/hda5). Logical Volume Management (LVM) The concept of Logical Volume Management (LVM) is not particularly new, it has been utilized mainly in enterprise level servers, an area in which Linux only recently has begun to gain acceptance. The first step for setting up LVM is creating a Volume Group. This is a virtual storage container that consists of anywhere from a portion of a single physical disk to multiple physical disks. The volume group is given a descriptive name, such as “datavg”, and can be accessed by that name (i.e. /dev/datavg) rather than using the cumbersome naming convention of traditional IDE or SCSI devices. One of the main benefits of using a Volume Group is that physical disks can be added or removed as needed without reformatting anything. Partitions are created within a volume group and are called Logical Volumes. The second main benefit of using LVM is that logical volumes can be resized as needed without having to backup and restore data. Logical Volumes introduce a completely different way of managing disks and partitions than have traditionally been used but in most Linux environments a compromise between the two models must be met. The /boot and root partitions are typically left as standard Primary partitions because most bootloaders are unable to recognize Logical Volumes. A Volume Group is often used to manage the remaining disk space. Partitioning Tools The most commonly used tool for creating and deleting partitions is fdisk. Fdisk is a command-line, menu-driven utility. You specify which disk to manipulate when invoking fdisk (ex. fdisk /dev/sda) and are presented with an interactive menu for editing the partition table on the disk. Some of the common commands used in this menu are: d   delete a partition l     list known partition types m   print the help menu n   add a new partition p   print the partition table q   quit without saving changes v   verify the partition table w   write table to disk and exit Changes you make in fdisk do not take effect until you press ‘w’ to write the changes. If you make a mistake, simply type ‘q’ to quit and start over. When you create a partition, you will be asked to specify the type of partition. Fdisk uses ID numbers to represent the type. Typing ‘l’ at the fdisk prompt will display a complete list of the different types of partitions, of which the most common are listed below: 82   Linux swap partition 83   Linux Primary partition (or a Logical partition if created within an Extended partition) 85   Linux Extended partition 8e   Linux LVM Partition schemes in Linux should depend on the purpose of the system. The following partitions will exist on most systems and should be used as a basic template: / The root filesystem. Contains files needed for booting the system. The kernel image is stored here as well as critical system commands and configuration files. The /dev, /bin/, /lib, /mnt, and /etc directories are stored in the root filesystem swap While swap space can be contained in a file, like the Windows pagefile, it generally gets a separate partition for the sake of stability. /var , /tmp, /usr Each of these directories typically will contain dynamic data and have the greatest potential to completely fill up their allocated space. Therefore, it is generally a good idea to have each of these directories on its own partition. /usr generally contains additional software installed after the main operating system installation. /var is used for variable data files. It is commonly used to store log files and spooled print jobs. /tmp is of course for temporary files. /home The /home directory is used to contain each user’s personal files. If disk quotas are not being used, the home directory should also reside on a separate partition to prevent user data from filling up the system. There are several other tools available for creating or modifying partitions. Some examples are sfdisk, parted, and Disk Druid. You do not need to know them in depth but you should be aware that they exist. Filesystems A filesystem is an organizational structure that determines how files and directories are stored and accessed on the physical disk. The main filesystems used by Windows are FAT and NTFS. The main filesystems used in Linux are ext2, ext3 and ReiserFS although others are available. Ext2 is probably still the most commonly used although it is being phased out. Ext2 supports partitions up to 4 terabytes, files up to 2 gigabytes, 255 character filenames, multiple timestamps and standard UNIX permissions and ownership. Another nice feature is that ext2 reserves 5% of the available disk space for use by the root user. This allows the superuser access the filesystem to clean up or recover in the event the filesystem completely fills up. Ext3 is essentially the same as ext2 with the addition of journaling. The ext3 filesystem keeps a log of all writes to disk and only updates the log after a write has been completed. What this means is that if the system crashes or is shut down improperly, ext3 requires far less time to check the disk for corruption. ReiserFS is also a journaling filesystem and boasts better performance than ext2 or ext3. ReiserFS organizes files using a balanced tree algorithm resulting in faster access times. It also eliminates the concept of fixed block sizes meaning that disk space is used more efficiently. Filesystem Tools The mkfs command is used to create a filesystem on a partition. The general syntax is: mkfs –t type device For example: mkfs –t ext3 /dev/hda1 There are actually several commands for creating filesystems that are all linked to each other and have similar sets of options: Filesystem Command ext2 mkfs –t ext2 mke2fs mkfs.ext2 ext3 mkfs –t ext3 mke2fs –j mkfs.ext3 ReiserFS mkfs –t reiserfs mkfs.reiserfs swap mkswap   Remember that an ext3 filesystem is simply an ext2 filesystem with journaling, hence the mke2fs –j command. Other tools that are used for managing filesystems are: fsck – Used to check a filesystem for errors or inconsistencies. Fsck will run automatically on bootup when a system has not been shut down cleanly. It can also be run manually from the command line. Fsck should never be run on a mounted filesystem. debugfs – Used for advanced debugging of ext2/3 filesystems. Most commonly used for recovering deleted files. Accessing Filesystems Once you have created a filesystem you need to mount it before you can write files to it. The mount command is used to mount a filesystem and has the following syntax: mount device mount_point For example: mount /dev/sda2 /home The mount point must be an existing directory on the system. The filesystem type can be manually specified using the –t switch but is detected automatically in most cases. In order to mount a filesystem automatically when the system boots up, you need to add an entry in the /etc/fstab file. The following shows an example of the contents of the /etc/fstab file: /dev/hda1 / ext3 defaults 1 1 /dev/hda2 /boot ext3 defaults 1 2 /dev/hda3 /home ext3 defaults 1 2 none /proc proc defaults 0 0 /dev/hda5 /tmp ext3 defaults 1 2 /dev/hda6 /var ext3 defaults 1 2 The first column states the name of the device containing the filesystem. The second column defines the mount point for the filesystem. The third column shows the filesystem type. The fourth column is used to define filesystem options. This is where you would flag a filesystem as read-only or enable disk quotas. The fifth column is used to flag whether the filesystem should be dumped in the event of a system crash. The last field determines the order in which the filesystems should be checked by fsck. A value of 1 is the highest priority. A value of 0 indicates that the filesystem will not be checked. The umount command is similarly used to unmount a mounted filesystem (ex. umount /home). A list of filesystems that are currently mounted is maintained in the /etc/mtab file. This file is updated by the kernel and should never be directly edited.

Current related exam topics for the Linux+ exam: DOMAIN 2.0 Management 2.6 Modify file and directory permissions and ownership (e.g., chmod, chown, sticky bit, octal permissions, chgrp) using CLI commands 2.7 Identify and modify default permissions for files and directories (for example: umask) using CLI commands 2.20 Create, modify, and delete user and group accounts (e.g., useradd, groupadd, /etc/passwd, chgrp, quota, chown, chmod, grpmod) using CLI utilities DOMAIN 4.0 Security 4.2 Delete accounts while maintaining data stored in that user's home directory 4.6 Set process and special permissions (e.g., SUID, GUID) 4.11 Given a set of security requirements, set password policies to match (complexity / aging / shadowed passwords) (for example: identify systems not shadow passwords)