System Administrator’s Guide

Accurate time keeping is important for a number of reasons. In Red Hat Enterprise Linux 7, time keeping is ensured by the NTP protocol, which is implemented by a daemon running in user space. The user space daemon updates the system clock running in the kernel. The system clock can keep time by using various clock sources.

Red Hat Enterprise Linux 7 uses the following daemons to implement NTP:

If you want to use ntpd instead of default chronyd, you need to disable chronyd, install, enable and configure ntpd as shown in Chapter 19, Configuring NTP Using ntpd.

Displaying the Current Date and Time

To display the current date and time, use one of the following commands:

date

~]$ date

timedatectl

~]$ timedatectl

Note that the timedatectl command provides more verbose output, including universal time, currently used time zone, the status of the Network Time Protocol (NTP) configuration, and some additional information.

For more information on configuring the date and time, see Chapter 3, Configuring the Date and Time.

System-wide locale settings are stored in the /etc/locale.conf file, which is read at early boot by the systemd daemon. The locale settings configured in /etc/locale.conf are inherited by every service or user, unless individual programs or individual users override them.

Basic tasks to handle the system locales:

For more information on configuring the system locale, see Chapter 2, System Locale and Keyboard Configuration.

The keyboard layout settings control the layout used on the text console and graphical user interfaces.

Basic tasks to handle the keyboard layout include:

For more information on configuring the keyboard layout, see Chapter 2, System Locale and Keyboard Configuration.

Ways to configure network access during the installation proces:

When the system boots for the first time after the installation has finished, any network interfaces which you configured during the installation are automatically activated.

For detailed information on configuration of network access during installation process, see Red Hat Enterprise Linux 7 Installation Guide.

Run the following commands as the root user to manage network connections using the nmcli utility.

To create a new connection:

nmcli con add type type of the connection "con-name" connection name ifname ifname interface-name the name of the interface ipv4 address ipv4 address gw4 address gateway address

~]# nmcli con add type type of the connection "con-name" connection name ifname ifname interface-name the name of the interface ipv4 address ipv4 address gw4 address gateway address

To modify the existing connection:

nmcli con mod "con-name"

~]# nmcli con mod "con-name"

To display all connections:

nmcli con show

~]# nmcli con show

To display the active connection:

nmcli con show --active

~]# nmcli con show --active

To display all configuration settings of a particular connection:

nmcli con show "con-name"

~]# nmcli con show "con-name"

For more information on the nmcli command-line utility, see Red Hat Enterprise Linux 7 Networking Guide.

The NetworkManager text user interface (TUI) utility, nmtui, provides a text interface to configure networking by controlling NetworkManager.

For more information about installing and using the nmtui text interface tool, see Red Hat Enterprise Linux 7 Networking Guide.

In web console, the Networking menu enables you:

Figure 1.1. Managing Networking in web console

View larger image

The products installed on Red Hat Enterprise Linux 7, including the operating system itself, are covered by subscriptions.

A subscription to Red Hat Content Delivery Network is used to track:

This section provides a brief summary of registering Red Hat Enterprise Linux 7 during the installation process. If your operating system is not registered after the installation, you can find what might have been missed during the installation by reading through this section. For detailed information, consult Red Hat Enterprise Linux 7 Installation Guide.

Basically, there are two ways to register the system during the installation:

If you have not registered your system during installation process, you can do it afterwards by applying the following procedure. Note that all commands in this procedure need to be performed as the root user.

For more information on registration of your system and attachment of the Red Hat Content Delivery Network subscriptions, see Chapter 7, Registering the System and Managing Subscriptions.

To access the Extended Update Support (EUS) content, register your system as follows:

For currently supported EUS releases, see Extended Update Support Add-on.

The following procedure describes how to register a system and utilize the E4S content.

The Red Hat Content Delivery Network subscription service provides a mechanism to handle Red Hat software inventory and enables you to install additional software or update already installed packages. You can start installing software once you have registered your system and attached a subscription, as described in Section 1.3, “The Basics of Registering the System and Managing Subscriptions”.

All software on a Red Hat Enterprise Linux system is divided into RPM packages, which are stored in particular repositories. When a system is subscribed to the Red Hat Content Delivery Network, a repository file is created in the /etc/yum.repos.d/ directory.

Use the yum utility to manage package operations:

For information on basic tasks related to the installation of software, see Section 1.4.3, “Managing Basic Software Installation Tasks with Subscription Manager and Yum”. For further information on managing software repositories, see Section 7.2, “Managing Software Repositories”. For detailed information on using the yum utility, see Chapter 9, Yum.

The most basic software-installation tasks that you might need after the operating system has been installed include:

You can determine services that are enabled or disabled at boot time already during the installation process, or you can enable or disable a service on an installed operating system.

To create the list of services enabled or disabled at boot time during the installation process, use the services option in the Kickstart file:

services [--disabled=list] [--enabled=list]

services [--disabled=list] [--enabled=list]

To enable or disable a service on an already installed operating system:

systemctl enableservice_name

~]# systemctl enableservice_name

systemctl disableservice_name

~]# systemctl disableservice_name

For further details, see Section 10.2, “Managing System Services”.

In web console, select Services to manage systemd targets, services, sockets, timers and paths. There you can check their status, start or stop them, enable or disable them.

Figure 1.2. Managing Services in web console

View larger image

For more information on systemd, see Chapter 10, Managing Services with systemd.

The most basic tasks to manage user accounts and groups, and the appropriate command-line tools, include:

For detailed information on managing users and groups, see Chapter 4, Managing Users and Groups.

If you want to use graphical user interface to manage users and groups, see Section 4.2, “Managing Users in a Graphical Environment”.

To manage accounts in web console, select the Accounts menu.

Figure 1.4. Managing User Accounts in web console

View larger image

In case of a system crash, you can use the Kernel crash dump mechanism called kdump that enables you to save the content of the system’s memory for later analysis. The kdump mechanism relies on the kexec system call, which can be used to boot a Linux kernel from the context of another kernel, bypass BIOS, and preserve the contents of the first kernel’s memory that would otherwise be lost.

When kernel crash occurs, kdump uses kexec to boot into a second kernel (a capture kernel), which resides in a reserved part of the system memory that is inaccessible to the first kernel. The second kernel captures the contents of the crashed kernel’s memory (a crash dump) and saves it.

During the installation, enablement and activation of kdump can be done either in the Anaconda installer or using the %addon com_redhat_kdump command in the Kickstart file.

For more information, see the appropriate source according to the installation method:

To ensure that kdump is installed and to configure it:

In web console, select Kernel dump to verify:

Figure 1.5. Configuring kdump in web console

View larger image

For more information on kdump, see Red Hat Enterprise Linux 7 Kernel Crash Dump Guide.

ReaR is a disaster recovery and system migration utility which enables you to create the complete rescue system. By default, this rescue system restores only the storage layout and the boot loader, but not the actual user and system files.

Additionally, certain backup software enables you to integrate ReaR for disaster recovery.

ReaR enables to perform the following tasks:

To install ReaR, enter as the root user:

yum install rear

~]# yum install rear

Use the settings in the /etc/rear/local.conf file to configure ReaR.

For further information see, Section 27.1, “Basic ReaR Usage”.

rear mkrescue

~]# rear mkrescue

For further information on creating the rescue system with ReaR, see Section 27.1.3, “Creating a Rescue System”.

ReaR contains a fully-integrated built-in, or internal, backup method called NETFS.

To make ReaR use its internal backup method, add these lines to the /etc/rear/local.conf file:

BACKUP=NETFS
BACKUP_URL=backup location

BACKUP=NETFS
BACKUP_URL=backup location

You can also configure ReaR to keep the previous backup archives when the new ones are created by adding the following line to /etc/rear/local.conf:

NETFS_KEEP_OLD_BACKUP_COPY=y

NETFS_KEEP_OLD_BACKUP_COPY=y

To make the backups incremental, meaning that only the changed files are backed up on each run, add this line to /etc/rear/local.conf:

BACKUP_TYPE=incremental

BACKUP_TYPE=incremental

For detailed information about using the ReaR NETFS internal backup method, see Section 27.2.1, “The Built-in Backup Method”.

For information on supported external backup methods and unsupported backup methods, see Section 27.2.2, “Supported Backup Methods” and Section 27.2.3, “Unsupported Backup Methods”.

The syslog messages are handled by two services:

The syslog messages are stored in various subdirectories under the /var/log directory according to what kind of messages and logs they contain:

By using the Red Hat Customer Portal you can:

To access the Red Hat Customer Portal, go to https://access.redhat.com..

To work with Red Hat Customer Portal services related to Red Hat support, you can use:

redhat-support-tool

~]$ redhat-support-tool
Welcome to the Red Hat Support Tool.
Command (? for help):

Command (? for help): ?

Command (? for help): ?

The SOS report collects configuration details, system information and diagnostic information from a Red Hat Enterprise Linux system. Attach the report when you open a support case.

Note that the SOS report is provided in the sos package, which is not installed with the default minimal installation of Red Hat Enterprise Linux 7.

To install the sos package:

yum install sos

~]# yum install sos

To generate an SOS report:

sosreport

~]# sosreport

To attach the sos report to your support case, see the Red Hat Knowledgebase article How can I attach a file to a Red Hat support case?. Note that you will be prompted to enter the number of the support case, when attaching the sos report.

For more information on SOS report, see the Red Hat Knowledgebase article What is a sosreport and how to create one in Red Hat Enterprise Linux 4.6 and later?.

The localectl command can be used to query and change the system locale and keyboard layout settings. To show the current settings, use the status option:

localectl status

localectl status

localectl status

~]$ localectl status
  System Locale: LANG=en_US.UTF-8
    VC Keymap: us
   X11 Layout: n/a

To list all locales available for your system, type:

localectl list-locales

localectl list-locales

localectl list-locales | grep en_

~]$ localectl list-locales | grep en_
en_AG
en_AG.utf8
en_AU
en_AU.iso88591
en_AU.utf8
en_BW
en_BW.iso88591
en_BW.utf8

output truncated

To set the default system locale, use the following command as root:

localectl set-locale LANG=locale

localectl set-locale LANG=locale

Replace locale with the locale name, found with the localectl list-locales command. The above syntax can also be used to configure parameters from Table 2.1, “Options configurable in /etc/locale.conf”.

localectl set-locale LANG=en_GB.utf8

~]# localectl set-locale LANG=en_GB.utf8

When Red Hat Enterprise Linux is installed with the Red Hat Kickstart installation method, setting of the system locales might not be persistent after an upgrade of the operating system.

When the %packages section of the Kickstart file includes the --instLang option, the _install_langs RPM macro is set to the particular value for this installation, and the set of installed locales is adjusted accordingly. However, this adjustment affects only this installation, not subsequent upgrades. If an upgrade reinstalls the glibc package, the entire set of locales is upgraded instead of only the locales you requested during the installation.

To avoid this, make the choice of locales permanent. You have these options:

As mentioned before, you can check your current keyboard layout configuration with the following command:

localectl status

localectl status

localectl status

~]$ localectl status
  System Locale: LANG=en_US.utf8
    VC Keymap: us
   X11 Layout: us

To list all available keyboard layouts that can be configured on your system, type:

localectl list-keymaps

localectl list-keymaps

localectl list-keymaps | grep cz

~]$ localectl list-keymaps | grep cz
cz
cz-cp1250
cz-lat2
cz-lat2-prog
cz-qwerty
cz-us-qwertz
sunt5-cz-us
sunt5-us-cz

To set the default keyboard layout for your system, use the following command as root:

localectl set-keymap map

localectl set-keymap map

Replace map with the name of the keymap taken from the output of the localectl list-keymaps command. Unless the --no-convert option is passed, the selected setting is also applied to the default keyboard mapping of the X11 window system, after converting it to the closest matching X11 keyboard mapping. This also applies in reverse, you can specify both keymaps with the following command as root:

localectl set-x11-keymap map

localectl set-x11-keymap map

If you want your X11 layout to differ from the console layout, use the --no-convert option.

localectl --no-convert set-x11-keymap map

localectl --no-convert set-x11-keymap map

With this option, the X11 keymap is specified without changing the previous console layout setting.

localectl --no-convert set-x11-keymap de

~]# localectl --no-convert set-x11-keymap de

localectl status

~]$ localectl status
  System Locale: LANG=de_DE.UTF-8
    VC Keymap: us
   X11 Layout: de

Apart from keyboard layout (map), three other options can be specified:

localectl set-x11-keymap map model variant options

localectl set-x11-keymap map model variant options

Replace model with the keyboard model name, variant and options with keyboard variant and option components, which can be used to enhance the keyboard behavior. These options are not set by default. For more information on X11 Model, X11 Variant, and X11 Options see the kbd(4) man page.

To display the current date and time along with detailed information about the configuration of the system and hardware clock, run the timedatectl command with no additional command line options:

timedatectl

timedatectl

This displays the local and universal time, the currently used time zone, the status of the Network Time Protocol (NTP) configuration, and additional information related to DST.

timedatectl

~]$ timedatectl
   Local time: Mon 2016-09-16 19:30:24 CEST
 Universal time: Mon 2016-09-16 17:30:24 UTC
    Timezone: Europe/Prague (CEST, +0200)
   NTP enabled: no
NTP synchronized: no
 RTC in local TZ: no
   DST active: yes
 Last DST change: DST began at
         Sun 2016-03-31 01:59:59 CET
         Sun 2016-03-31 03:00:00 CEST
 Next DST change: DST ends (the clock jumps one hour backwards) at
         Sun 2016-10-27 02:59:59 CEST
         Sun 2016-10-27 02:00:00 CET

systemctl restart systemd-timedated.service

~]# systemctl restart systemd-timedated.service

To change the current time, type the following at a shell prompt as root:

timedatectl set-time HH:MM:SS

timedatectl set-time HH:MM:SS

Replace HH with an hour, MM with a minute, and SS with a second, all typed in two-digit form.

This command updates both the system time and the hardware clock. The result it is similar to using both the date --set and hwclock --systohc commands.

The command will fail if an NTP service is enabled. See Section 3.1.5, “Synchronizing the System Clock with a Remote Server” to temporally disable the service.

timedatectl set-time 23:26:00

~]# timedatectl set-time 23:26:00

By default, the system is configured to use UTC. To configure your system to maintain the clock in the local time, run the timedatectl command with the set-local-rtc option as root:

timedatectl set-local-rtc boolean

timedatectl set-local-rtc boolean

To configure your system to maintain the clock in the local time, replace boolean with yes (or, alternatively, y, true, t, or 1). To configure the system to use UTC, replace boolean with no (or, alternatively, n, false, f, or 0). The default option is no.

To change the current date, type the following at a shell prompt as root:

timedatectl set-time YYYY-MM-DD

timedatectl set-time YYYY-MM-DD

Replace YYYY with a four-digit year, MM with a two-digit month, and DD with a two-digit day of the month.

Note that changing the date without specifying the current time results in setting the time to 00:00:00.

timedatectl set-time "2017-06-02 23:26:00"

~]# timedatectl set-time "2017-06-02 23:26:00"

To list all available time zones, type the following at a shell prompt:

timedatectl list-timezones

timedatectl list-timezones

To change the currently used time zone, type as root:

timedatectl set-timezone time_zone

timedatectl set-timezone time_zone

Replace time_zone with any of the values listed by the timedatectl list-timezones command.

timedatectl list-timezones | grep Europe

~]# timedatectl list-timezones | grep Europe
Europe/Amsterdam
Europe/Andorra
Europe/Athens
Europe/Belgrade
Europe/Berlin
Europe/Bratislava
…

timedatectl set-timezone Europe/Prague

~]# timedatectl set-timezone Europe/Prague

As opposed to the manual adjustments described in the previous sections, the timedatectl command also allows you to enable automatic synchronization of your system clock with a group of remote servers using the NTP protocol. Enabling NTP enables the chronyd or ntpd service, depending on which of them is installed.

The NTP service can be enabled and disabled using a command as follows:

timedatectl set-ntp boolean

timedatectl set-ntp boolean

To enable your system to synchronize the system clock with a remote NTP server, replace boolean with yes (the default option). To disable this feature, replace boolean with no.

timedatectl set-ntp yes

~]# timedatectl set-ntp yes

To display the current date and time, run the date command with no additional command line options:

date

date

This displays the day of the week followed by the current date, local time, abbreviated time zone, and year.

By default, the date command displays the local time. To display the time in UTC, run the command with the --utc or -u command line option:

date --utc

date --utc

You can also customize the format of the displayed information by providing the +"format" option on the command line:

date +"format"

date +"format"

Replace format with one or more supported control sequences as illustrated in Example 3.6, “Displaying the Current Date and Time”. See Table 3.1, “Commonly Used Control Sequences” for a list of the most frequently used formatting options, or the date(1) manual page for a complete list of these options.

date

~]$ date
Mon Sep 16 17:30:24 CEST 2016

date --utc

~]$ date --utc
Mon Sep 16 15:30:34 UTC 2016

date +"%Y-%m-%d %H:%M"

~]$ date +"%Y-%m-%d %H:%M"
2016-09-16 17:30

To change the current time, run the date command with the --set or -s option as root:

date --set HH:MM:SS

date --set HH:MM:SS

Replace HH with an hour, MM with a minute, and SS with a second, all typed in two-digit form.

By default, the date command sets the system clock to the local time. To set the system clock in UTC, run the command with the --utc or -u command line option:

date --set HH:MM:SS --utc

date --set HH:MM:SS --utc

date --set 23:26:00

~]# date --set 23:26:00

To change the current date, run the date command with the --set or -s option as root:

date --set YYYY-MM-DD

date --set YYYY-MM-DD

Replace YYYY with a four-digit year, MM with a two-digit month, and DD with a two-digit day of the month.

Note that changing the date without specifying the current time results in setting the time to 00:00:00.

date --set "2017-06-02 23:26:00"

~]# date --set "2017-06-02 23:26:00"

Running hwclock with no command line options as the root user returns the date and time in local time to standard output.

hwclock

hwclock

Note that using the --utc or --localtime options with the hwclock command does not mean you are displaying the hardware clock time in UTC or local time. These options are used for setting the hardware clock to keep time in either of them. The time is always displayed in local time. Additionally, using the hwclock --utc or hwclock --local commands does not change the record in the /etc/adjtime file. This command can be useful when you know that the setting saved in /etc/adjtime is incorrect but you do not want to change the setting. On the other hand, you may receive misleading information if you use the command an incorrect way. See the hwclock(8) manual page for more details.

hwclock

~]# hwclock
Tue 15 Apr 2017 04:23:46 PM CEST   -0.329272 seconds

For information on how to change the time zone, see Section 3.1.4, “Changing the Time Zone”.

Besides displaying the date and time, you can manually set the hardware clock to a specific time.

When you need to change the hardware clock date and time, you can do so by appending the --set and --date options along with your specification:

hwclock --set --date "dd mmm yyyy HH:MM"

hwclock --set --date "dd mmm yyyy HH:MM"

Replace dd with a day (a two-digit number), mmm with a month (a three-letter abbreviation), yyyy with a year (a four-digit number), HH with an hour (a two-digit number), MM with a minute (a two-digit number).

At the same time, you can also set the hardware clock to keep the time in either UTC or local time by adding the --utc or --localtime options, respectively. In this case, UTC or LOCAL is recorded in the /etc/adjtime file.

hwclock --set --date "21 Oct 2016 21:17" --utc

~]# hwclock --set --date "21 Oct 2016 21:17" --utc

You can synchronize the hardware clock and the current system time in both directions.

When you synchronize the hardware clock and the system time, you can also specify whether you want to keep the hardware clock in local time or UTC by adding the --utc or --localtime option. Similarly to using --set, UTC or LOCAL is recorded in the /etc/adjtime file.

The hwclock --systohc --utc command is functionally similar to timedatectl set-local-rtc false and the hwclock --systohc --local command is an alternative to timedatectl set-local-rtc true.

hwclock --systohc --localtime

~]# hwclock --systohc --localtime

Red Hat Enterprise Linux uses a user private group (UPG) scheme, which makes UNIX groups easier to manage. A user private group is created whenever a new user is added to the system. It has the same name as the user for which it was created and that user is the only member of the user private group.

User private groups make it safe to set default permissions for a newly created file or directory, allowing both the user and the group of that user to make modifications to the file or directory.

The setting which determines what permissions are applied to a newly created file or directory is called a umask and is configured in the /etc/bashrc file. Traditionally on UNIX-based systems, the umask is set to 022, which allows only the user who created the file or directory to make modifications. Under this scheme, all other users, including members of the creator’s group, are not allowed to make any modifications. However, under the UPG scheme, this "group protection" is not necessary since every user has their own private group. See Section 4.3.5, “Setting Default Permissions for New Files Using umask” for more information.

A list of all groups is stored in the /etc/group configuration file.

In environments with multiple users, it is very important to use shadow passwords provided by the shadow-utils package to enhance the security of system authentication files. For this reason, the installation program enables shadow passwords by default.

The following is a list of the advantages shadow passwords have over the traditional way of storing passwords on UNIX-based systems:

Most utilities provided by the shadow-utils package work properly whether or not shadow passwords are enabled. However, since password aging information is stored exclusively in the /etc/shadow file, some utilities and commands do not work without first enabling shadow passwords:

Press the Super key to enter the Activities Overview, type Users and then press Enter. The Users settings tool appears. The Super key appears in a variety of guises, depending on the keyboard and other hardware, but often as either the Windows or Command key, and typically to the left of the Space bar. Alternatively, you can open the Users utility from the Settings menu after clicking your user name in the top right corner of the screen.

To make changes to the user accounts, first select the Unlock button and authenticate yourself as indicated by the dialog box that appears. Note that unless you have superuser privileges, the application will prompt you to authenticate as root. To add and remove users, select the + and - button respectively. To add a user to the administrative group wheel, change the Account Type from Standard to Administrator. To edit a user’s language setting, select the language and a drop-down menu appears.

Figure 4.1. The Users Settings Tool

View larger image

When a new user is created, the account is disabled until a password is set. The Password drop-down menu, shown in Figure 4.2, “The Password Menu”, contains the options to set a password by the administrator immediately, choose a password by the user at the first login, or create a guest account with no password required to log in. You can also disable or enable an account from this menu.

Figure 4.2. The Password Menu

View larger image

To add a new user to the system, type the following at a shell prompt as root:

useradd options username

useradd options username

…where options are command-line options as described in Table 4.2, “Common useradd command-line options”.

By default, the useradd command creates a locked user account. To unlock the account, run the following command as root to assign a password:

passwd username

passwd username

Optionally, you can set a password aging policy. See the Password Security section in the Red Hat Enterprise Linux 7 Security Guide.

At this point, a locked account called juan exists on the system. To activate it, the administrator must next assign a password to the account using the passwd command and, optionally, set password aging guidelines (see the Password Security section in the Red Hat Enterprise Linux 7 Security Guide for details).

To add a new group to the system, type the following at a shell prompt as root:

groupadd options group_name

groupadd options group_name

…where options are command-line options as described in Table 4.3, “Common groupadd command-line options”.

Use the usermod utility to add an already existing user to an already existing group.

Various options of usermod have different impact on user’s primary group and on his or her supplementary groups.

To override user’s primary group, run the following command as root:

usermod -g group_name user_name

~]# usermod -g group_name user_name

To override user’s supplementary groups, run the following command as root:

usermod -G group_name1,group_name2,... user_name

~]# usermod -G group_name1,group_name2,... user_name

Note that in this case all previous supplementary groups of the user are replaced by the new group or several new groups.

To add one or more groups to user’s supplementary groups, run one of the following commands as root:

usermod -aG group_name1,group_name2,... user_name

~]# usermod -aG group_name1,group_name2,... user_name

usermod --append -G group_name1,group_name2,... user_name

~]# usermod --append -G group_name1,group_name2,... user_name

Note that in this case the new group is added to user’s current supplementary groups.

System administrators usually like to create a group for each major project and assign people to the group when they need to access that project’s files. With this traditional scheme, file management is difficult; when someone creates a file, it is associated with the primary group to which they belong. When a single person works on multiple projects, it becomes difficult to associate the right files with the right group. However, with the UPG scheme, groups are automatically assigned to files created within a directory with the setgid bit set. The setgid bit makes managing group projects that share a common directory very simple because any files a user creates within the directory are owned by the group that owns the directory.

For example, a group of people need to work on files in the /opt/myproject/ directory. Some people are trusted to modify the contents of this directory, but not everyone.

When a process creates a file, the file has certain default permissions, for example, -rw-rw-r--. These initial permissions are partially defined by the file mode creation mask, also called file permission mask or umask. Every process has its own umask, for example, bash has umask 0022 by default. Process umask can be changed.

What umask consists of

A umask consists of bits corresponding to standard file permissions. For example, for umask 0137, the digits mean that:

Umasks can be represented in binary, octal, or symbolic notation. For example, the octal representation 0137 equals symbolic representation u=rw-,g=r--,o=---. Symbolic notation specification is the reverse of the octal notation specification: it shows the allowed permissions, not the prohibited permissions.

How umask works

Umask prohibits permissions from being set for a file:

The following figure shows how umask 0137 affects creating a new file.

Figure 4.3. Applying umask when creating a file

View larger image

umask 0000
touch file
mkdir directory
ls -lh .

[john@server tmp]$ umask 0000
[john@server tmp]$ touch file
[john@server tmp]$ mkdir directory
[john@server tmp]$ ls -lh .
total 0
drwxrwxrwx. 2 john john 40 Nov 2 13:17 directory
-rw-rw-rw-. 1 john john 0 Nov 2 13:17 file

umask

~]$ umask
0022

umask -S

~]$ umask -S
u=rwx,g=rx,o=rx

umask octal_mask

~]$ umask octal_mask

umask 0337

~]$ umask 0337

umask 337

~]$ umask 337

umask -S symbolic_mask

~]$ umask -S symbolic_mask

umask -S u=r,g=r,o=

~]$ umask -S u=r,g=r,o=

grep -i -B 1 umask /etc/bashrc

~]$ grep -i -B 1 umask /etc/bashrc

grep -i -B 1 umask /etc/bashrc

~]$ grep -i -B 1 umask /etc/bashrc
  # By default, we want umask to get set. This sets it for non-login shell.
--
  if [ $UID -gt 199 ] && [ “id -gn” = “id -un” ]; then
    umask 002
  else
    umask 022

  if [ $UID -gt 199 ] && [ “id -gn” = “id -un” ]; then
    umask 002
  else
    umask 227

  if [ $UID -gt 199 ] && [ “id -gn” = “id -un” ]; then
    umask 002
  else
    umask 227

john@server ~]$ echo 'umask 227' >> /home/john/.bashrc

john@server ~]$ echo 'umask 227' >> /home/john/.bashrc

The permission mask is initialized to this value. If not specified,
the permission mask will be initialized to 022.

# The permission mask is initialized to this value. If not specified,
# the permission mask will be initialized to 022.
UMASK 077