Clive's Blog

Installing Fedora 16 on a System that can not boot GPT Labelled Disks

2012-01-28T11:44:00.002+02:00

Some Systems Particularly Fujitsu Siemens Life books, Apple Macs and some others,
Cannot Boot If the Hard drive is Formatted using this Newer GPT format.

Fedora 16 uses the new GPT format since it does have some benefits.
However if you want to install Fedora 16 on a Lifebook or an Apple mac, you need to do the following.

You need to pass parameter nogpt to the Fedora installer.

To do this, at the initial bootloader menu for the Fedora installation, where you can select to install, install in basic graphics mode, boot to the rescue mode and so on, hit the Tab key, then edit the command line for the Fedora installer and add the word nogpt. you can do this when using the Live CD or the Complete distribution DVD.

Then install as normal and your Machine should now boot and work as expected.

Do not choose custom partitioning layout, You must let the system create it's own layout first and then if you want , You can edit what it creates to suite your requirements. If you choose custom layout, the 1MB problematic BootBios partition is created and this will give you the following error "
"you have not created a bootloader stage1 target device"

mount.nfs: access denied by server while mounting

2012-01-23T20:31:00.000+02:00

If your nfs mounts stop working
and mount-a gives you the following error.
mount.nfs: access denied by server while mounting /blah_blah_blah/blah_blah

Chances are, your machine has been upgraded and now uses the NFS version 4 as default nfs version
instead of 3

To fix this issue you need to explicitly tell nfs to mount your share using the older nfs version 3

simply add nfsvers=3 to your nfs mount stanza in your /etc/fstab file

eg
vi /etc/fstab

192.168.1.10:/shared/files /mnt/files nfs soft,intr,nfsvers=3 0 0

save the file and type
mount -a

Your nfs mounts will now work.

Resolve transparency issues with Guake

2012-01-06T11:14:00.000+02:00

If you set Guake to start automatically when your computer starts, depending on how quickly your Gnome session loads, there may be an issue with it starting before Gnome has completed it's full initialization.

when this happens, the transparency in quake does not work as it should, You cannot see the windows behind the Guake terminal, It lets you see your Background wallpaper only.

A solution for this is to delay the start up of Guake, so that Gnome is allowed to initialize fully before Guake starts.

To do this , run

gnome-session-properties

under startup-programs edit your entry for Guake.

and add sleep 8 && infront of guake,
like so

sleep 8 && guake

This gives guake an 8 second delay before starting, and should be enough to let Gnome fully initialize, and your transparency will work as it should.

Problem mounting a LVM

2012-01-04T11:46:00.000+02:00

To manually mount a drive that contains a LVM (Logical Volume)
do the following.

lvddisplay

will output info about your logical volume
the important thing to note here is
the line which says VG Name
VG Name vg_lvm

sometimes you will get a lv status as not available
to make it available type

vgchange -a y

this will activate any LVMS that werent active and make them available.

then to mount the LVM simply type

mount /dev/vg_lvm /mnt

Problem installing Oracle Virtual box extension pack

2011-12-31T10:08:00.004+02:00

If you would like to use the USB ports on your virtual machine in virtual box.
You need to install the virtual box extension pack available from the download section at www.virtualbox.org

However opening the downloaded extension pack from virtualbox and clicking the install button, sometimes gives the following error

"Failed to install the Extension Pack Oracle_VM_VirtualBox_Extension_Pack-.vbox-extpack. The installer failed with exit code 127: The value for the SHELL variable was not found the /etc/shells file This incident has been reported.. Result Code: NS_ERROR_FAILURE (0x80004005) Component: ExtPackManager Interface: IExtPackManager "

I find that installing the extension pack using the command line fixes this problem.
simply cd into the folder were the extension pack you downloaded resides,
and type the following. replacing the xxxx with the version of the extension pack you downloaded.

sudo VBoxManage extpack install --replace Oracle_VM_VirtualBox_Extension_Pack-4.1.xxxx.vbox-extpack

and it will install properly, you should get the following back.

0%...10%...20%...30%...40%...50%...60%...70%...80%...90%...100%
Successfully installed "Oracle VM VirtualBox Extension Pack".

Free up space on your hard drive.

2011-12-07T14:01:00.001+02:00

ext2/ext3 and ext4, file systems automatically reserve space for themselves. (5% by default)
This is necessary for your root partition, so that if you fill up the hard drive, Linux will still have space to write to the log files and to allow privileged processes to run so that they can avoid file system fragmentation.
However, if your hard disk is say a 650GB or bigger hard drive, that 5% amounts to a significant amount of disk space, and is a total overkill.
Additionally, you do not need this reserved space on hard drives that are only used for storage (ie are not part of your root partition)
so, how do we take back this valuable hard disk real estate ?
We use tune2fs.

so as an example, type

tune2fs -m 1 /dev/sda2
to change the 5% to 1% on /dev/sda2

if /dev/sda was a 650GB hard drive this would give you an additional 26 GB Free!

tune2fs -m 0 /dev/sda2
will reduce the 5% to 0%

to add reserved space for privileged processes back to a drive
type
tune2fs -r 20000 /dev/sda2
will give back 20000 blocks, which should be more than sufficient

you can run tune2fs on Logical volumes as well.

tune2fs -m 1 /dev/mapper/vg-lv_home
will reclaim space from your logical volume

Just change /dev/mapper/vg/-lv_home to the name of your logical volume.
you can see all your volumes and partitions by typing df -h

Simple Webserver

2011-12-01T09:58:00.001+02:00

python -m SimpleHTTPServer

Will serve your current Directory tree at
http://IP_of_machine_you_ran_the_command_on:8000

Serve current directory tree at http://$HOSTNAME:8000/

Check your spelling

2011-11-30T10:06:00.001+02:00

yum install aspell

or apt-get install aspell for Ubuntu systems

then in future when ever you need to know how to spell a word simply type

aspell -a <<< 'word'

save man pages as pdf

2011-11-23T09:28:00.001+02:00

man -t ls | ps2pdf - ls.pdf

Will save the man pages for ls to ls.pdf

substitute ls for the programme man pages you want to save as a pdf

Script Terminal Session

2011-11-22T17:45:00.001+02:00

script -f /tmp/filename

will place all output of the terminal, including carriage returns, to a file (/tmp/filename)

So then on another terminal session type

tail -f /tmp/filename

This file can be tail -f by one or more terminals to display Live the information of the main terminal.

Great way to share your screen on short notice.

to Stop scripting type
<Cntrl> D

Ascii Digital Clock

2011-11-20T16:13:00.001+02:00

install banner

yum install banner
then type

watch -n1 'banner `date +%T`'

How To Add a start up script to be Run at Boot time in Ubuntu

2011-11-19T11:47:00.001+02:00

First Save your script in

/etc/init.d/

then type:

sudo update-rc.d script_name defaults

This script will now run each time you boot up.

sort the contents of a text file in place

2011-11-16T15:18:00.001+02:00

This will sort the contents of a file without the need to pipe it into a second file.

great for cron jobs

sort -g name_of_file_to_sort.txt -o $_

Dropbox Free 2GB account

2011-11-14T16:34:00.001+02:00

Always have your stuff when you need it with Dropbox.
2GB account is free!

Click Here To open an account

Dropbox will allow you to share folders across multiple computers.

Removing old unused Kernels from your Fedora system

2011-11-04T12:07:00.004+02:00

Old unused Kernels can take up a fair amount of Disk Space.

To identify kernels that may be safely removed from your System,

run the following in a Terminal:

curl -O 'http://skvidal.fedorapeople.org/misc/kernel-prune.py'
chmod a+x kernel-prune.py
./kernel-prune.py

Then to safely remove the kernel versions listed by the above command, run the following as root:

PKGS=`./kernel-prune.py`
echo $PKGS
yum remove $PKGS

Remove empty directories or folders

2011-10-28T19:05:00.001+02:00

find -depth -type d -empty -exec rmdir {} \;

Integrate google contacts into your Mutt address Book

2011-10-21T12:29:00.001+02:00

Goobook will alow you to interact with your gmail contacts from the command line and also enable mutt to access them

install goobook
type

easy-install -U goobook

Once installed create .netrc file in your home folder with the credentials to your google account
Vim ~/.netrc

inside .netrc put the following

machine google.com
login yourgmailaddress@gmail.com
password yourpassword

save the file

to test if it is working type

goobook dump_contacts

this will dump all your contact information from gmail to stn out

to search for a string from your gmail contacts type

goobook query query

eg to search for clive type

goobook query clive

if you want to use goobook from mutt

edit your .muttrc file and add in the following line:

set query_command="goobook query '%s'"

to query the address book from inside mutt use the "Q" key

If you want to be able to use to complete email addresses instead of Ctrl-t add this:

bind editor complete-query

To add email addresses (with "a" key normally bound to create-alias command) add the following line:

macro index,pager A "goobook add" "add the sender address to Google contacts"

If you want to add an email's sender to Contacts, press "a" while it's selected in the index or pager.

Rename image files according to EXIF date

2011-09-29T19:50:00.002+02:00

This will rename all of your pictures in a given folder and prefix the date and time that the picture was taken in front of the file name.

Useful if your camera screws up your naming convention of your pictures, or if you want to simply organize all your pictures by date

yum install exiv2

cd to the folder with all your pictures that you want to rename

and type:

exiv2 -r'%Y%m%d-%H%M_:basename:' rename $(ls)

will rename to

20110929-2005_DSC_3782.JPG

Install Oracle 11G 32bit on 64bit Rhel 6

2011-09-16T11:35:00.000+02:00

Install the following prerequisites

yum install gnome-icon-theme-2.28.0-2.el6.noarch sgml-common-0.6.3-32.el6.noarch dmz-cursor-themes-0.4-4.el6.noarch libstdc++-devel-4.4.4-13.el6.x86_64 kernel-headers-2.6.32-71.el6.x86_64 elfutils-libelf-devel-0.148-1.el6.x86_64 libgcc-4.4.4-13.el6.i686 nss-softokn-freebl-3.12.7-1.1.el6.i686 glibc-2.12-1.7.el6.i686 mpfr-2.4.1-6.el6.x86_64 libXt-1.0.7-1.el6.x86_64 libXmu-1.0.5-1.el6.x86_64 libXxf86misc-1.0.2-1.el6.x86_64 libXxf86vm-1.1.0-1.el6.x86_64 libaio-0.3.107-10.el6.i686 libstdc++-4.4.4-13.el6.i686 ncurses-libs-5.7-3.20090208.el6.i686 readline-6.0-3.el6.i686 libICE-1.0.6-1.el6.i686 xorg-x11-xauth-1.0.2-7.1.el6.x86_64 cpp-4.4.4-13.el6.x86_64 libtool-ltdl-2.2.6-15.5.el6.x86_64 unixODBC-2.2.14-11.el6.x86_64 ppl-0.10.2-11.el6.x86_64 cloog-ppl-0.15.7-1.2.el6.x86_64 libmcpp-2.7.2-4.1.el6.x86_64 mcpp-2.7.2-4.1.el6.x86_64 xorg-x11-server-utils-7.4-15.el6.x86_64 compat-db42-4.2.52-15.el6.x86_64 compat-db43-4.3.29-15.el6.x86_64 libdmx-1.1.0-1.el6.x86_64 libXxf86dga-1.1.1-1.el6.x86_64 libXv-1.0.5-1.el6.x86_64 libIDL-0.8.13-2.1.el6.x86_64 ORBit2-2.14.17-3.1.el6.x86_64 GConf2-2.28.0-6.el6.x86_64 libbonobo-2.24.2-4.el6.x86_64 gtk2-engines-2.18.4-5.el6.x86_64 shared-mime-info-0.70-4.el6.x86_64 libdaemon-0.14-1.el6.x86_64 avahi-0.6.25-8.el6.x86_64 avahi-glib-0.6.25-8.el6.x86_64 gnome-vfs2-2.24.2-6.el6.x86_64 libtool-ltdl-2.2.6-15.5.el6.i686 unixODBC-2.2.14-11.el6.i686 libuuid-2.17.2-6.el6.i686 libSM-1.1.0-7.1.el6.i686 libXau-1.0.5-1.el6.i686 xorg-x11-utils-7.4-8.el6.x86_64 compat-libstdc++-33-3.2.3-69.el6.x86_64 celt051-0.5.1.3-0.el6.x86_64 libXp-1.0.0-15.1.el6.x86_64 libxcb-1.5-1.el6.i686 libX11-1.3-2.el6.i686 libXext-1.1-3.el6.i686 ConsoleKit-x11-0.4.1-3.el6.x86_64 libXi-1.3-3.el6.i686 xorg-x11-xinit-1.0.9-13.el6.x86_64 libXtst-1.0.99.2-3.el6.i686 libXt-1.0.7-1.el6.i686 compat-libstdc++-33-3.2.3-69.el6.i686 glibc-headers-2.12-1.7.el6.x86_64 glibc-devel-2.12-1.7.el6.x86_64 gcc-4.4.4-13.el6.x86_64 compat-gcc-34-3.4.6-19.el6.x86_64 gnome-themes-2.28.1-6.el6.noarch system-icon-theme-6.0.0-2.el6.noarch system-gnome-theme-60.0.2-1.el6.noarch ncurses-devel-5.7-3.20090208.el6.x86_64 libgnome-2.28.0-11.el6.x86_64 gcc-c++-4.4.4-13.el6.x86_64 readline-devel-6.0-3.el6.x86_64 glibc-devel-2.12-1.7.el6.i686 compat-db-4.6.21-15.el6.x86_64 unixODBC-devel-2.2.14-11.el6.i686 unixODBC-devel-2.2.14-11.el6.x86_64 libaio-devel-0.3.107-10.el6.i686 libaio-devel-0.3.107-10.el6.x86_64 compat-gcc-34-c++-3.4.6-19.el6.x86_64

next you must install the 32 bit version of the Glib libraries

yum install glib-devel.i686

connect to the server with
ssh -X oracle@serverip address

./runInstaller -ignoresysprereq

the Oracle Xwindow will open on your desktop,
follow instructions to complete the installation.

Point RHEL 6 installation to Centos6 repositories

2011-09-14T16:07:00.008+02:00

Migrating from RHEL6 to CentOS 6

mkdir TMP

yum remove rhnlib abrt-plugin-bugzilla
yum remove redhat-release-notes*

rpm -e --nodeps redhat-release redhat-indexhtml

for 64 bit version use
rpm -e --nodeps redhat-release-server.x86_64
rpm -e --nodeps redhat-indexhtml-6-1.el6.noarch

cd TMP

wget http://mirror.centos.org/centos/6/os/x86_64/Packages/centos-release-6-0.el6.centos.5.x86_64.rpm

wget http://mirror.centos.org/centos/6/os/x86_64/Packages/centos-indexhtml-6-1.el6.centos.noarch.rpm

wget http://mirror.centos.org/centos/6/os/x86_64/Packages/yum-3.2.27-14.el6.centos.noarch.rpm

wget http://mirror.centos.org/centos/6/os/x86_64/Packages/yum-plugin-fastestmirror-1.1.26-11.el6.noarch.rpm

rpm -Uvh *.rpm
cd ..
rm -rf TMP
yum clean all
yum upgrade

voila, your Redhat machine can now get updated from the Centos repositories

Spliting 1 large MKV file into 2 smaller MKV files

2011-08-30T13:59:00.003+02:00

Lets say you have a 6GB MKV file that you want to split into 2 X 3GB MKV files

mkvtoolnix to the rescue

install mkvtoolnix

yum install mkvtoolnix

once installed cd into the directory that has the file you want to split
lets say the file is called thor.mkv
to split it into 2 files of 3GB each simply type the following.

mkvmerge --split size 3g thor.mkv -o thor1.mkv
hit enter

you will land up with 2 extra files thor1.mkv and thor2.mkv, each 3gb in size (the original file will also still be in the directory

Rsync

2011-06-07T08:11:00.007+02:00

Backing up data using rsync command

I have stopped using scp to copy files from computer to computer and far prefer to use rsync.
rsync command uses the same format as scp, (so there is no learning curve and if you are used to using scp, then switching to rsync is no trouble at all) rsync has the benefit of being able to continue from a failed copy, and also has a wealth of other advantages over scp.

rsync is a great tool for backing up and restoring files.

Example of the remote server and folder that needs to be backup or copied:
Remote host name: server.example.com
Remote folder: /home/serverfolder/
Remote user: user1

rsync -arv user1@serverexample.com:/home/serverfolder/ /home/cgerada

(/home/cgerada is the local folder path of the machine I am on and to were I want to copy to)
or to copy into the directory that I am currently in you could type
rsync -arv user1@serverexample.com:/home/serverfolder/ .

Here is what the "-arv" option does:
a = archive - means it preserves permissions (owners, groups), times, symbolic links, and devices.
r = recursive - means it copies directories and sub directories
v = verbose - means that it prints on the screen what is being copied
add --progress at the end of the command to get a running tally of what's going on
eg
rsync -avr * /media/usb/ --progress

another good example

rsync -avr --progress --delete --log-file=/var/log/$(date +%Y%m%d)_rsync.log user1@serverexample.com:/home/folder/ /home/folder/

will create a log file and document the progress into the logfile
-- delete will delete on the destination server what ever files have been deleted from the source (it wont delete files on your source server, only destination)

Excluding files

rsync -avr --exclude '*.iso' source/ destination/

Will Exclude all iso files

or you can write it like this , it doesn't matter, it still works
rsync -avr source/ destination/ --exclude '*.iso' --progress

Output your microphone to a remote computer’s speaker

2010-12-03T00:23:00.000+02:00

dd if=/dev/dsp | ssh -c arcfour -C username@host dd of=/dev/dsp

This will output the sound from your microphone port to the ssh target computer’s speaker port. The sound quality is bad, so you will hear a lot of hissing,
but it works.

Email alert on Root Login

2010-12-02T23:46:00.004+02:00

This will allow you to be notified instantly via email whenever someone logs into your server as root.

ssh into your server

su to root

sudo -i

or su -

cd to /root

cd /root

edit your .bashrc file

vim .bashrc

add the following to the end of the file

echo 'ALERT - Root Shell Access (YourserverName) on:' `date` `who` | mail -s "Alert: Root Access from `who | cut -d"(" -f2 | cut -d")" -f1`" you@yourdomain.com

Replace YourServerName with the name of your server.

Replace you@yourdomain.com with the email address you want the alerts sent to.

:x to save and exit

logout from your server, close the connection and log back in.

You will receive an email alert of the root login after a few minutes.

Mutt Tips

2010-11-27T13:26:00.001+02:00

searching in mutt

* ~f brucewayne :From: matches "brucewayne"
* ~s party : messages with subject containing "party"
* ~d <2w : messages less than two weeks old. Also: year, month, week, day.
* ~t clarkk : To: matches clarkk (useful for sent-mail folders)
* ~O : old (i.e. unread but not new) messages.
~N is new unread.
~U is unread, i.e. both together.
* ~p : messages addressed to you (useful if your inbox is bombarded with mailing list or system report activity).
* ~p ~U : for messages to you you haven't read yet.
* . : matches everything. In effect, remove the limit.

l limit messages matching
l all show all messages
:set sort=from sort messages by "From"
:set sort=threads sort messages by "Thread"
:set sort=date sort messages by "Date"

mailbox "=cgerada" will show alerts in cgerada mailbox

Bash Cheat Sheet

2010-11-26T13:56:00.003+02:00

 !! - Last command (usefull if you forget to run a command as sudo)
 sudo !!  (runs last command as sudo)
 !foo - Run most recent command starting with 'foo...' (ex. !ps, !mysqladmin)
 !foo:p - Print command that !foo would run, and add it as the latest to
 command history
 !$ - Last 'word' of last command ('/path/to/file' in the command 'ls -lAFh
 /path/to/file', '-uroot' in 'mysql -uroot')
 !$:p - Print word that !$ would substitute
 !* - All but first word of last command ('-lAFh /path/to/file' in the command
 'ls -lAFh /path/to/file', '-uroot' in 'mysql -uroot')
 !*:p - Print words that !* would substitute

 ^foo^bar - Replace 'foo' in last command with 'bar', print the result, then
 run. ('mysqladmni -uroot', run '^ni^in', results in 'mysqladmin -uroot')

 {a,b,c} passes words to the command, substituting a, b, and c sequentially
 (`cp file{,.bk}` runs `cp file file.bk`)

 Ctrl + a - Jump to the start of the line
 Ctrl + b - Move back a char
 Ctrl + c - Terminate the command
 Ctrl + d - Delete from under the cursor
 Ctrl + e - Jump to the end of the line
 Ctrl + f - Move forward a char
 Ctrl + k - Delete to EOL
 Ctrl + l - Clear the screen
 Ctrl + r - Search the history backwards
 Ctrl + R - Search the history backwards with multi occurrence
 Ctrl + t - Transpose the current char with the previous
 Ctrl + u - Delete backward from cursor
 Ctrl + w - Delete backward a word
 Ctrl + xx - Move between EOL and current cursor position
 Ctrl + x @ - Show possible hostname completions
 Ctrl + z - Suspend/ Stop the command
 Ctrl + x; Ctrl + e - Edit line into your favorite editor

 Alt + < - Move to the first line in the history  Alt + > - Move to the last line in the history
 Alt + ? - Show current completion list
 Alt + * - Insert all possible completions
 Alt + / - Attempt to complete filename
 Alt + . - Yank last argument to previous command
 Alt + b - Move backward
 Alt + c - Capitalize the word
 Alt + d - Delete word
 Alt + f - Move forward
 Alt + l - Make word lowercase
 Alt + n - Search the history forwards non-incremental
 Alt + p - Search the history backwards non-incremental
 Alt + r - Recall command
 Alt + t - Transpose the current word with the previous
 Alt + u - Make word uppercase
 Alt + back-space - Delete backward from cursor

 (Here "2T" means Press TAB twice)
 $ 2T - All available commands(common)
 $ (string)2T - All available commands starting with (string)
 $ /2T - Entire directory structure including Hidden one
 $ (dir)2T - Only Sub Dirs inside (dir) including Hidden one
 $ *2T - Only Sub Dirs inside without Hidden one
 $ ~2T - All Present Users on system from "/etc/passwd"
 $ $2T - All Sys variables
 $ @2T - Entries from "/etc/hosts"
 $ =2T - Output like ls or dir
 .bash_profile = sourced by login shell,
 .bashrc = sourced by all shells,
 .bash_aliases = should be sourced by .bashrc

Run something:
 for i in a b c; do $i 'hello'; done

Do something on a bunch of files:
 for i in *.rb; do echo $i; done

If syntax:
 if [ -e .ssh ]; then echo "hi"; fi

file check flags:
 -e:  file exists
 -f:  regular file (non directory)
 -d:  directory
 -s:  non-zero file
 -x:  execute permission

Avoid duplicates in your history:
 export HISTIGNORE="&:ls:ls *:[bf]g:exit"

SMBCLIENT

2010-11-10T23:53:00.004+02:00

smbclient -L servername
will show you all available samba / windows shares

To connect to a windows or samba share type

smbclient \\\\servername\\share -U username

you will be asked for your windows password for the username specified

once connected smbclient works like an FTP client

type help for a list of commands.

Keep in mind, you'll need a leading "\" before spaces (ex: My\ Filename.txt).

or alternatively put your filenames in quotes eg "My Filename.txt"

once connected
to copy directories and subdirectories type
recurse

to not be asked (prompted)if you want to replace files. type
prompt

Setting UP VNC server on a CentOs or Redhat server

2010-11-03T11:08:00.018+02:00

To set up VNC properly, so that you have access to the local
default X console of your server as if you are sitting in front
of the physical server.
follow these steps.

On the server, type vncpasswd as root to set a VNC password.
You will use this password when connecting with vncviewer

Edit the file /etc/X11/xorg.conf

In the stanza called Screen, add this line:
Option "passwordFile" "/root/.vnc/passwd"

then
add in the following lines at the end of the file:

Section "Module"
Load "glx"
Load "dbe"
Load "extmod"
Load "freetype"
Load "type1"
Load "dri"
Load "vnc"
EndSection

save the file

Allow the ports in the iptables Firewall
by typing the following:

system-config-securitylevel

In the "Other ports", add the following range.

5900-5904

Save and close the tool then restart the firewall by typing the following:
service iptables restart or /etc/init.d/iptables restart

type

chkconfig vncserver on

to have vncserver automatically start when the server next boots up.

Then finally RESTART the server.

recovering from a read only / mount

2010-10-29T16:56:00.005+02:00

When the boot process aborts upon failing to find a removed or failed hard disk due to the system not finding the device that your /etc/fstab file references , it asks for a password and gives you the option to drop into maintenance mode , however when in maintenance mode you are unable to edit your /etc/fstab file to fix the problem since your / partition is mounted Read only!

to fix the situation simply type

mount -n -o remount /
will remount the / partition in rw mode and you can now edit /etc/fstab and remove the
line with the faulty disk or wrong entry, and then reboot as normal.

Encrypt a file whilst in Vim

2010-08-22T01:20:00.001+02:00

Encrypt File in Vim
Save and encrypt the current file:
:X
Enter encryption key: ********
Enter same key again: ********
Once you’ve encrypted a file using :X, the next time you open that file, Vim
will prompt for the encryption key.

How to Upgrade from Fedora 12 to Fedora 13 (32 bit and 64 bit versions)

2010-05-25T23:33:00.009+02:00

Do the following as root.

download latest fedora repos

For 32 bit version type:

wget ftp://download.fedora.redhat.com/pub/fedora/linux/releases/13/Everything/i386/os/Packages/fedora-release-13-1.noarch.rpm
or for 64 bit version type:
wget ftp://download.fedora.redhat.com/pub/fedora/linux/releases/13/Everything/x86_64/os/Packages/fedora-release-13-1.noarch.rpm

import gpg-key

rpm --import ftp://download.fedora.redhat.com/pub/fedora/linux/releases/13/Everything/i386/os/RPM-GPG-KEY-fedora-i386

or for 64 bit version type:

rpm --import ftp://download.fedora.redhat.com/pub/fedora/linux/releases/13/Everything/x86_64/os/RPM-GPG-KEY-fedora-i386

rpm --import ftp://download.fedora.redhat.com/pub/fedora/linux/releases/13/Everything/i386/os/RPM-GPG-KEY-fedora-i386

install rpmlibs dependency. Required to install fedora-release-13

yum install rpm-libs -y

upgrade fedora release

rpm -Uvh fedora-release-13-1.noarch.rpm

upgrade fedora distro

yum upgrade -y

Reboot and Enjoy

Compose Key

2010-01-12T23:27:00.010+02:00

I often need to type characters that aren’t on the keyboard, like € ½ ÷ © ¥ or ¢.

compose key to the rescue.

pick a key on your keyboard you don’t use much, like [Insert], [CapsLock], or [menu], and make it the “compose key”.

Then to make any character, you just hit the compose key, then type the two obvious keys that, when combined, make up the character.

For example:

* To get €, just type e then =

* To get ©, just type o then c

* To get ® just type o then r

* To get £, just type L then -

* To get ¥, just type Y then =

* ¢ is c then |

* ÷ is - then :

* ½ is 1 then 2

* ¼ is 1 then 4

* ñ is n then ~

By default this function is not assigned to any key. You can tell the X server what key to use for this function with the following command
setxkbmap -option compose:keyname

for example

setxkbmap -option compose:caps

to assign it to the caps-lock key.

or setxkbmap -option compose:rwin

to assign your right "Windows" key
to make it persisistent after a reboot simply insert the command in your
/etc/rc.local file

Loads of Linux GAMES

2009-12-30T20:03:00.010+02:00

djl is an open-source game manager for Linux, written in Python

download the installer script from http://en.djl-linux.org/?q=node/19
Once you download the file you will need to extract it.
tar -xzvf djl-1.2.20.tar.gz

The djl.sh contained inside the archive needs to be executable in order to run, so you may have to make it executable by typing the following.
chmod +x djl.sh

then to run the script, type ./djl.sh

When you run the script the first time, if you do not have the Python framework installed, you'll get an error. Fortunately The script will point out the missing python-qt4 libraries. Fire up your package manager and install it. Alternatively, use the command line to install the package.
yum install "package name" or apt-get install "package name"

Once you have everything in place, run the application. You will be asked to configure djl. This includes configuring the installation directory for your games, the Web browser of your choice, the default tab in the main menu, the font size, updates, dependencies, and more. Very convenient.

After you download the News items, you're ready to roll.

Go to Repository tab and start enjoying this powerful game manager. You can search the games by genre, or by additional categories, like license or price.

Games are just as easy to un-install as they are to install

Enjoy

Setting up a DHCP server

2009-11-06T11:50:00.005+02:00

assuming the Network you want to add a DHCP server to is the

192.168.1.0/24 network

your router IP Address is 192.168.1.1

Your ISP's DNS servers IP Address is 194.158.2.2

the leases that you want to give out are 192.168.1.128 to 192.168.1.254

first install the DHCP server software.

yum install dhcp.i386

once installed

edit /etc/dhcpd.conf (if it doesn't exist create it)

vi /etc/dhcpd.conf

add in the following lines

ddns-update-style interim;
ignore client-updates;

subnet 192.168.1.0 netmask 255.255.255.0 {

range 192.168.1.128 192.168.1.254;

default-lease-time 21600;
max-lease-time 43200;
option routers 192.168.1.1;
option ip-forwarding off;
option domain-name-servers 194.158.2.2;
option broadcast-address 192.168.1.255;
option subnet-mask 255.255.255.0;

save the file :wq

next, configure the dhcpd service to start at start up

chkconfig dhcpd on

to make sure it is running either reboot or type
/etc/init.d/dhcpd start

that's it , your done. Your DHCP server will give out IP addresses to any clients that connect to your network.
there are many other options that you can add to your DHCP server, like reserving an IP address for a specific mac-address etc

to see all of these option just check out the man pages of dhcpd
type
man dhcpd

Source .bashrc when you connect over SSH

2009-11-05T18:34:00.004+02:00

If your .bashrc file is not being sourced when you connect to your system over SSH and it only gets sourced when you open up a terminal locally on the system.

you may need to add the following to your etc/profile file

if [ -e ~/.bashrc ]; then
. ~/.bashrc
fi

VMWare boot from CD

2009-11-03T12:51:00.006+02:00

VMWare can be very frustrating when you try and boot a VM from a CD .

The VM’s BIOS is set to boot from disk first, so you need to change the boot device order. The problem is that the boot process is so fast that you never have enough time to hit the F2 key and enter the bios setup to change the boot order of your VM.
A solution to the problem is to edit the .vmx file in your VM's directory and simply add the following line.

bios.bootDelay = “boot delay in milliseconds”

for example if you want to give yourself 20 seconds add the following line
bios.bootDelay = “20000”

save the file and then restart your Virtual machine.
You will now have enough time to enter into the VM's console and hit the F2 key so that you can edit the boot order in the Bios.

Right Click Open Terminal in current folder

2009-10-28T08:57:00.007+02:00

nautilus-open-terminal runs on Gnome Windows manager and it allows you to right click in your file manager
and open up your terminal in the current folder. Clearly a very useful tool.

It used to be installed as a default application in many distributions but for some reason it was left out of Fedora 11

To add it back in simply type
sudo yum install nautilus-open-terminal

If it somehow got left out of your Ubuntu installation, then type
sudo apt-get install nautilus-open-terminal

You will need to restart your Gnome session to activate it.

How to Install Google Chrome on Ubuntu

2009-10-23T07:49:00.006+02:00

edit the /etc/apt/sources.list file

sudo vim /etc/apt/sources.list

Add one of the following

For ubuntu 9.10 (armic) add the following two lines

deb http://ppa.launchpad.net/chromium-daily/ppa/ubuntu karmic main
deb-src http://ppa.launchpad.net/chromium-daily/ppa/ubuntu karmic main

For ubuntu 9.04 (Jaunty) add the following two lines

deb http://ppa.launchpad.net/chromium-daily/ppa/ubuntu jaunty main
deb-src http://ppa.launchpad.net/chromium-daily/ppa/ubuntu jaunty main
For ubuntu 8.10 (Intrepid) add the following two lines

deb http://ppa.launchpad.net/chromium-daily/ppa/ubuntu intrepid main
deb-src http://ppa.launchpad.net/chromium-daily/ppa/ubuntu intrepid main

Save the file

Next add the GPG key by typing:

sudo apt-key adv --recv-keys --keyserver keyserver.ubuntu.com 0xfbef0d696de1c72ba5a835fe5a9bf3bb4e5e17b5

Update the source list. by typing

sudo apt-get update

Install chromium by typing

sudo apt-get install chromium-browser
Done

Clone a hard Drive

2009-10-19T20:38:00.008+02:00

Good, easy way to clone a hard drive.

dd which is used for converting and copying files, can be used as a powerful and simple image cloning application.

dd if=/dev/hda of=/dev/hdb

done

if you want to see your progress

then type in another terminal
kill -SIGUSR1 xxxx
were xxxx is the process ID of the running dd process
and the progress will report on the original terminal that you started your cloning operation on.

share a single mouse and keyboard accross multiple computers

2009-10-14T21:13:00.011+02:00

Here's the scenario.

you have 3 PC's on your Desk. One running Linux , One running MAC OS and the other running Windows XP.

all 3 with their own Monitor .

wouldn't it be cool, to be able to use the same Mouse and keyboard for all 3 PC's. and to be able to copy and paste, Text, Images and HTML content between the PC's.

No Problem, (drum roll...) ... in steps Synergy.

Synergy lets you share a single mouse and keyboard between multiple computers with different operating systems, each with its own display.

Redirecting the mouse and keyboard is as simple as moving the mouse off the edge of your screen. Synergy also merges the clipboards of all the systems into one, allowing you to cut-and-paste between systems. it also synchronizes screen savers so they all start and stop together.

Synergy uses TCPIP to communicate mouse position and keyboard keystrokes between the PC's. So all you need for Synergy to work is to have your PC's connected to the same network. (No additional hard ware is required)

you can download synergy from http://synergy2.sourceforge.net/

and read the user guide and installation instructions from http://synergy2.sourceforge.net/running.html

Shutdown a Windows Machine from your Linux Machine

2009-10-06T22:51:00.007+02:00

Ever need to reboot or shutdown a Windows machine on your network, from your Linux workstation.
No problem.

apt-get install samba-common package
or
yum install samba-common package

net rpc shutdown -I ipAddressOfWindowsPC -U username%password

This will issue a shutdown command to the Windows machine. username must be an administrator on the Windows machine.

Other commands are:

net rpc shutdown -r : reboot the Windows machine

net rpc abortshutdown : abort shutdown of the Windows machine

Type:

net rpc

to show all commands

How to get a complete list of packages that are installed on your system

2009-09-28T11:23:00.002+02:00

dpkg --get-selections

will show you a complete list of packages installed on your Ubuntu system

and
rpm -qa
will give you the complete list on a Fedora / Redhat /CentOS system

since these lists are long its a good idea to pipe them to less

dpkg --get-selections | less

and
rpm -qa | less

Get Counted (The Linux Counter)

2009-09-26T10:19:00.004+02:00

http://counter.li.org/

Argument list too long

2009-09-25T10:31:00.003+02:00

Today I was limited by rm

I needed to clean up a folder by deleting previous years (2008) log files which amounted to a few thousand files

rm logs-2008*

returned me the error
/bin/rm:Argument too long

The reason for this error is a limitation of your running kernel and will limit you to other commands as well. Like mv and cp, if the amount of files you want to act on is larger than the set limitation.

a work around is to pipe the matching files to rm one at a time.
To do this, issue the following command

find -name 'log2008*' | xargs rm (substitute 'log2008*' for your search string)

If the files you are trying to remove have spaces in them, then you need to use the following command

find -name 'log2008*' | -print0 | xargs -0 rm

Static Routes

2009-09-24T16:04:00.006+02:00

To add a static route to say the 10.10.1.0/24 network from your machine through your gateway router who's IP is 192.168.1.1

route add -net 10.10.1.0 netmask 255.255.255.0 gw 192.168.1.1 dev eth0

will add the route to your kernel and it will be available immediately. However this will not survive a reboot.
To make this persistent after a reboot you need to input the route into a configuration file

on Ubuntu edit

/etc/network/interfaces

and Red hat / Centos / Fedora

edit /etc/sysconfig/network-scripts/route-eth0

if the route-eth0 file file does not exist (it probably won't) then create it
and add the following

10.10.1.0/24 via 192.168.1.1

save the file and then restart networking to read in the new route
/etc/init.d/networking restart

How to install Google Chrome on Fedora

2009-07-08T15:13:00.006+02:00

vi /etc/yum.repos.d/chromium.repo


paste the following into the file

[chromium]
name=Chromium Test Packages
baseurl=http://spot.fedorapeople.org/chromium/F$releasever/
enabled=1 
gpgcheck=0


:wq to save

then yum install chromium

voila

Dreambox HD

2009-05-15T10:29:00.006+02:00

Every once in a while something comes along that really impresses me, my Blackberry was one of them, Virtual Machines another, my WD 1 Terabyte Mybook and now dream box HD has just been added to that list.

The dream box is a Linux based set-top box with a MIPS processor, a Satellite card , gigabit Ethernet card, USB slot digital audio out and DVI / HDMI out .(dependiing on the model you buy)

connected to a motorized satellite dish, you can receive thousands of Satellite channels available under the Sky, as you can imagine , there is no shortage of choice of channels,

The HD channels I must say are awesome to watch, and by installing an internal 500GB Sata drive, you can pause live television, and record 77 hours of HD television in HD.

Were the Dream box comes into its own, is the pluggins that are available for it, and the fact that it is a Linux O.S connected to your home network and the Internet, means that it easily serves as a HD media center for all of your Multimedia content. and the possibilities are endless. My current setup allows me to stream television to every PC or Laptop in my house, I can change channels from the web interface available to every PC laptop in my house, my dream box also accesses my WD 1 terabyte Mybook drive were all my HD home video is stored, as well as all my digital pictures, which I can now enjoy in the comfort of my lounge in full HD and in 5.1 surround sound. My MP3 collection is now served up to my HiFi set and my Media tomb UPnP stream is also accessible via the Dreambox. I can access my dreambox from a blackberry, veiw the program guide and setup a recording from a Blackberry or any 3G phone.

the dream box has been the missing link that I've been waiting for that has made complete media convergence for the home in HD now easy to achieve.

the dreambox 8000 HD can take up to 4 tuners , which means you can record 3 different channels at the same time whilst watching a 4th, provided they are all on the same Satellite.

Now to find the time to do anything Else.

using NMAP to Scan your entire network for Conficker

2009-04-01T10:29:00.008+02:00

Since a signature has been discovered that conficker worm leaves
on infected machines, you can now scan a machine and ask it ,if it is infected with the conficker worm,
beta5 version of NMAP provides this ability.

follow these quick steps to scan entire networks and give them a clean
bill of health from the conficker worm.
to download and install Nmap beta 5 do the following:

wget http://download.insecure.org/nmap-dist/nmap-4.85BETA5.tar.bz2
bzip2 -cd nmap-4.85BETA5.tar.bz2 | tar xvf -
cd nmap-4.85BETA5
./configure
make
su root
make install

to Scan for conficker type the following

nmap -PN T4 -p139,445 -n -v --script=smb-check-vulns --script-args safe=1 [target network]

eg:
nmap -PN T4 -p139,445 -n -v --script=smb-check-vulns --script-args safe=1 192.168.1.0/24

the scan will take a while depending on the size of your network.

saving a file in VI as root

2009-03-31T23:15:00.002+02:00

It often happens that you open up a file for editing using vi or vim and only when you come to save the file, you realise you did not open the file with root privileges and are unable to save the file.

when you type :wq!
you get E212: Can't open file for writing.

If that happens to you , simply type

:w !sudo tee %

you will be asked for your sudo password
enter your password and
press enter when asked

(vi/vim will detect that the file has been changed and ask whether you want
it to be reloaded.)

As a shortcut, you can define your own command.

Put the following in your /etc/vimrc

command W w !sudo tee % > /dev/null

and then in future simply type

How to Stop yum from updating your Kernel

2009-03-27T09:14:00.002+02:00

On a Server and also on your own machine, kernel Upgrades can break already installed 3rd party Applications, since the application would have been compiled for use on a specific kernel, I find this to be particularly a problem with vmware and Virtual box, every time my system upgrades its kernel there are a few packages that i need to recompile to get to work, this is a real pain, and on your server can lead to serious problems. To stop yum from updating your Kernel
You can tell yum to skip kernel updates by adding kernel-* to the 'exclude=' option in /etc/yum.conf. if the exclude option does not exist simply add it, add in a line that says exclude=kernel-*
you can do the same for any package that you do not want to update, for example, I run a patched version of postfix on one of my servers, since ive included a quota patch when I compiled it , I do not want postfix to upgrade to an unpatched version. So to stop that particular server from upgrading postfix I simply added postfix to the 'exclude=' option in /etc/yum.conf
you can add multiple exclude options by simply adding exclude=app_name_to_exclude under one another.

White Background

2009-03-24T23:43:00.003+02:00

Test smtp server with required authentication

2009-03-24T17:18:00.006+02:00

To test your smtp server, to see if it is an open relay or to
test if your authentication works on it. Use telnet to connect
to the server, this allows you to very quickly test different connection
scenarios to the server. this method is very useful if you
want to test how your smtp server behaves from different remote locations,
and all you have is an ssh account into the locations you want to test from.
You can simply ssh into the remote location you want to test from and then
follow these steps
In this example I wanted to test if basic outgoing smtp authentication was working on my server (everything in Bold is what you type everything not in bold is the servers response)

telnet smtp.mailserver.com 25

Trying 195.158.102.65...
Connected to mail.clivesblog.com.
Escape character is '^]'.
220 smtp.mailserver.com.com ESMTP ready
ehlo
250-smtp.mailserver.com ESMTP hello
250-PIPELINING
250-AUTH PLAIN LOGIN CRAM-MD5 DIGEST-MD5 GSSAPI
250-AUTH=PLAIN LOGIN CRAM-MD5 DIGEST-MD5 GSSAPI
250-8BITMIME
250-BINARYMIME
250-CHUNKING
250-SIZE 10485760
250-STARTTLS
250-HELP
250 OK
auth login
334 VXNlcm5hbWU6
Y2xpdmUuZ2VyYWRhQHJzMi5jb20=
334 UGFzc3dvcmQ6
cnMy
235 Authentication successful
mail from:clive.gerada@clivesblog.com
250 Sender accepted
rcpt to:anybody@anyaddress.com
250 Recipient accepted
data
354 Ready to receive data; remember .
subject: any subject

double space (ie hit the space bar twice)

then enter any text for the body of the email

.

250 Mail queued for delivery
quit
221-smtp.mailserver.com ESMTP is closing connection
221 Good bye

the Y2xpdmUuZ2VyYWRhQHJzMi5jb20=
and cnMy

is my username and password encoded in Basd64 cypher

you have to encode it in base64 for the server to understand it.
you can use the following online tool to encode and decode to and from base64
http://ostermiller.org/calc/encode.html

How to Encrypt/decrypt files

2009-03-24T08:34:00.004+02:00

If you want to protect files so that they can transverse across cyberspace safely, or you just want to protect them from
prying eyes with a password.

use the gpg command.

gpg -c filename

You will be asked for a pass phrase.

enter your pass phrase.

You will be asked to repeat your pass phrase
a file will be created with the .gpg extention

Caution: if you forget your pass phrase you will not be able to recover your file. the encryption used is that good.

to decrypt the file simply type
gpg filename.gpg

enter your pass phrase when asked.

To do multiple files I usually zip them into one zip file and then encrypt the zip file.
you can do this in one shot by typing the following

zip - file1 file2 file3 file4 file5 | gpg -eat > outfile.zip.asc

2009-03-21T16:00:00.000+02:00

Alternating between directories in your Terminal

2009-03-20T18:29:00.005+02:00

often, I am working in a directory which has a long path eg /home/cgerada/long/complicated/directory/structure/folder/

and then want to temporally change to another directory to do something and change back to the directory I was in

instead of using cd to change to the other directory rather use
pushd eg pushd /directory

that way when you are done in /directory and you want to return to /home/cgerada/long/complicated/directory/structure/folder/

simply type popd

and you will be returned to /home/cgerada/long/complicated/directory/structure/folder/

cd - is also very useful and will take you to your last working directory

and is great for switching between 2 directories .. just type cd - and then cd- again to alternate between 2 working directories

Quick way to Rip a DVD

2009-03-19T22:00:00.002+02:00

Insert your DVD into your DVD Drive of your PC/Laptop

and type the following in your terminal

dd if=/dev/cdrom of=/cdrom_image.iso

your DVD will be saved as an iso image in your current directory.

.ssh/config

2009-03-14T18:30:00.005+02:00

ssh reads configuration information from a config file
(if you have one) before connecting to a machine.

This way you can tell ssh how you want to connect toparticular machines. If you have a lot of different
machines that you connect to,  especially if youconnect to them on different ports and with different
user names then
it is a great idea to create the following file
.ssh/config

type vi .ssh/config

and popultate the config file with the information
of the machines that you connect to.
eg
Host *netaxiz.com
Port 2222
User clive
    
Host ipcop1
Port 222
User root
Host home
Hostname 192.168.0.10
User clive
Port 768

with the above information in the config file if you typessh machine.netaxiz.com
will be the equivalent of typing
ssh -p 2222 clive@machine.netaxiz.com

and typing scp file1 ipcop1:file1
will be the equavelent of typing 
scp -P222 file1 root@ipcop1

as you can see the config file can save you a lot of time.

The port and the username from the config file will
automatically be used every time you connect to the
machines listed in the config file.
Were this is especially usefull is when you want to
copy ssh keys to a remote machine using the
ssh-copy id command when the remote machine uses
a different port to 22.

Lets say you want to copy your public keys to your
machine called home but machine home only allows
 ssh connection on port 768. By adding in the information
above for machine home. I can now simply type
ssh-copy-id -i ~/.ssh/id_rsa.pub home
to transfer the keys.

if you get the following error when using ssh
Bad owner or permissions on .ssh/config
then you must change the permissions of the config file.

cd .ssh

chmod 600 config

libdvdcss

2009-03-08T12:35:00.002+02:00

To Play a commercial DVD in your media player
you need to install libdvdcss

you will also need libdvdcss to be able to backup your commercial DVD's ;)

yum install libdvdcss

or apt-get install libdvdcss depending on your distro

RPM Fusion Repository

2009-02-23T20:01:00.009+02:00


RPM Fusion Repository provides software that the Fedora Project
or Red Hat doesn't want to ship.
You will find software like VLC media player, Mencoder FFmpeg
and other software that is not available in the stock Fedora or
Red hat repositories.


to install the RPM Fusion repository on your system simply type
the following.

rpm -ivh http://download1.rpmfusion.org/free/fedora/
rpmfusion-free-release-stable.noarch.rpm

then you can install software directly ie
yum install vlc

How to find out what Distro you are running

2009-02-23T11:59:00.003+02:00

uname -a will give you information about your running Kernel. To find out what Distribution is installed on a Particular system try one the following:

cat /etc/issue

or

cat /proc/version

or

cat /etc/*release

How to change the Time Zone on your Redhat / Centos system

2008-10-30T11:51:00.003+02:00

cp /usr/share/zoneinfo/Africa/Johannesburg /etc/localtime

will set your time zone to SAST

you can simply use Tab auto completion to find the exact time zone you want by choosing the continent and city of your choice for example to change your timezone to London's time

cp /usr/share/zoneinfo/Europe/London /etc/localtime

to change to universal time type

cp /usr/share/zoneinfo/Universal /etc/localtime

to change to GMT time type

cp /usr/share/zoneinfo/GMT /etc/localtime

if asked if you want to overwrite the localtime file answer yes.

Tab auto completion is very useful in finding the exact time zone you want.

How to backup and restore a Mysql database

2008-10-14T15:38:00.007+02:00

To backup your mysql database type the following.

mysqldump -u username -ppassword database_name > dump.sql

make sure not to leave a space between the -p and the password, otherwise mysql will prompt you for a password and will assume that your password is the database name.

the entire database will be backed up into the dump.sql file

then to restore the database type the following

'mysql -u username -ppassword database_name < dump.sql'

How to reset a Forgotton Password in MYSQL

2008-09-25T16:28:00.002+02:00

ever forgotton your root password for your mysql database, or any other users password for that matter, no problem here
simply stop mysql by typing
/etc/init.d/mysqld stop

then restart Mysql with the following command

mysqld_safe --skip-grant-tables

You should see mysqld start up successfully. Now you should be able to connect to mysql without a password.

mysql --user=root mysql

update user set Password=PASSWORD('new-password');
flush privileges;
exit;

once done restart mysql normally

/etc/init.d/mysqld restart

Shaaawiiing

How to add multiple users and passwords to your system

2008-09-17T09:44:00.005+02:00

for names in user1 user2 user3 user4 user5
do
useradd $names
echo $name"anypassword" | passwd --stdin $names
done

the above will add user1 , user2 ,user3, user4 and user5 to your system.
All users will have the password "their user name followed by anypassword"
You could have your list of users in a text file and enter the commands like so, presuming your text file is called users.txt and in your text file you just insert the user names underneath one another eg

user1
user2
user3

etc

for names in `cat users.txt`
do
echo $names
useradd $names
done

If you want to add usernames and passwords from a list, then make a text file like so

user1:password1
user2:password2
user3:password3

etc
save the file , in this example we'll save it as userlist.txt
then

for names in `cat userlist.txt`
do
user=`echo $names | cut -f1 -d:`
pwd=`echo $names | cut -f2 -d:`
useradd $user
echo $pwd | passwd --stdin $user
done

How to remove @#$ Annoying Console beeps

2008-09-01T21:54:00.005+02:00

To Remove all console beeps whilst running X type
xset b off
this will disable the annoying console beeps for all programs.
To remove the console beep when running in run level 1 2 or 3 without X, or on one of the virtual consoles ( cntrl-Alt 1 to 6) type
setterm -blength 0

Nog a sweet IP Tables rule

2008-08-28T10:46:00.004+02:00

This one will force your users through your Squid proxy server, even if your users are configured to access the net directly

iptables -t nat - A PREROUTING -i eth0 -p tcp --dport 80 -j REDIRECT --to-ports 3128

assuming that your squid proxy is configured to use port 3128 the above rule on your iptables firewall.

or if your squid proxy server is on a different server say 192.168.1.10 then
iptables -t nat - A PREROUTING -i eth0 -p tcp --dport 80 -j REDIRECT -d 192.168.1.10 --to-ports 3128

if you need to insert the rule at line number 5 of an existing chain then
iptables -t nat - I PREROUTING 5 -i eth0 -p tcp --dport 80 -j REDIRECT --to-ports 3128

will forward all standard port 80 http traffic to your Squid Proxy server on port 3128 .......sweet

Making files undeletable, updatable only and unbackupable

2008-08-26T09:19:00.005+02:00

Attributes on a file can help you control what people can do with different files you can make files
1: Undeletable (Even by root)
2: Updatable only (Even by root)
3: Unbackupable :) (Even by root)

1: to make a file undeletable type
chattr +i filename
even if root trys to delete the file they will not be allowed to, To make the file deletable again you will need to type
chattr -i filename

2: to make a file updateable only, which means that you will be able to append content to the file but you will not be allowed to delete it or remove content from it
type

chattr +a filename

3: to prevent a file from being backed up by admins using the dump command

type

chattr +d filename
to list the set attributes of a file type
lsattr filename

tip to extract configured settings only in a config file

2008-08-19T20:30:00.004+02:00

some config files are huge, and have more comments "#" and blank space than they do actual configured settings.
sometimes you need to just have a look at the settings that are configured and not all the comments.
to do this try the following.

cat filename.conf |grep -v "^#" | grep -v "^$" | less

will list the config file without all the lines with comments and will also leave out all the blank space
giving you information on your configured settings only.

the -v switch in grep tells grep to list files that do not contain the following string
the ^ (caret) means the beginning of a line and the $ means the end of a line and then passing the output
to less, allows you to page through the file using your arrow keys

Centralised Logging host

2008-08-14T22:25:00.003+02:00

The last thing a cracker does after they have compromised your system is they try and remove all traces of what they have done on your system, they do this by altering or deleting your log files.

Log files are essential in monitoring your system and recovering it back to a working state after a failure or after being compromised. It is a very good idea to have your Log files stored on a central server, both for convenience and security reasons. In a large network it is also more convenient to have all your log files accessible in one central place.

decide on the server that will accept log messages from the other servers. On that server edit your
/etc/sysconfig/syslog file

and edit the stanza SYSLOGD_OPTIONS="-m 0"
add a -r like so
SYSLOGD_OPTIONS="-r -m 0"
-r =(receive log files)

restart syslogd by typing /etc/init.d/syslog restart
now your server is ready to accept logging messages from your other servers/machines

on the machine that you want to send the log files from. Edit your /etc/syslog.conf file
and add the following line
user.* @192.168.1.60

were 192.168.1.60 is the ip address of the server that you setup to receive the log files, you can substitute the ip address with the hostname of the server if you want.

restart syslogd by typing /etc/init.d/syslog restart
your server @ 192.168.1.60 will now receive and store all the log files from your machine that you have setup to send from.

you can test this new setup by using the logger command to create a log message
logger -i -t Clive "Testing centralised logging"
The message should appear in your centralised logging servers /var/log/messages file

Automounting Home Directories from a Centralized NFS server

2008-08-12T09:08:00.007+02:00

In previous posts we configured NFS , client and server. Discussed auto mounting NFS shares and centralized user management . whats left to do is to centralize our users home directories. This makes backups easier to carry out as all users data is kept in one place. It also means that our users can login from any machine on the network and they will have immediate access to all of their files. which is pretty cool.

Right, so NFS server is setup and running on your Server, you must export the /home folder on your NFS server by adding it to your /etc/exports file and then type exportfs -a
NIS should also be configured and running on the same server as described in my previous post.

On the clients computer you need to edit your /etc/auto.master file and add the following entry

/home /etc/auto.home

then create a file called /etc/auto.home and put the following line in your new /etc/auto.home file

* -rw,nosuid,soft servername:/home/&

were servername is the name or ip address of your nfs/nis server

This entry in your /etc/auto.home file will insure that any directory a user tries to access under their own local /home directory (due to the"*" character) will cause an NFS mount on the server within its exported /home filesystem.
you could also add the following mount options to further improve matters

rsize=8192,wsize=8192 which would speed up NFS communication for reads (rsize) and writes (wsize) by setting a larger data block size, to be transferred at one time. do not set this option on older Linux kernels with older network cards as some network cards do not work well with the larger block sizes .
to add this option the file would look like so.

* -rw,nosuid,soft,rsize=8192,wsize=8192 servername:/home/&

The ampersand (&) takes the value of the user name in each line.

Done, your users home directories are now all centralized on your /nfs/nis server

Centralized user authentication with NIS

2008-08-11T21:51:00.013+02:00

On a network with lots of users you will need to centralize your /etc/passwd file and your user database so that you can manage all your users in one place. you can centralize user management using NIS so that all users are added and deleted on one machine only. Users can log in from any other client machine, without the need to have a local user account on their own machines. (Together with Autofs described in my previous post and my next post on automounting /home directory over nfs . User databases can be managed in one place)
You can have multiple NIS servers on the same domain acting as Master and Slaves all managing one central user database.
The server acts as the central repository for all user names, passwords, and groups. The data is replicated from the /etc/passwd file to NIS databases.

On the server, you need to install a package called ypserv.

type apt-get install ypserv if you are using a debian based distribution or type

yum install ypserv if you are using a Red Hat derivative one.
After installing ypserv you need to setup a domain name that is used by server and client.

to setup your domain name type

domainname example

to make it persistent edit /etc/sysconfig/network file and add the following line

NISDOMAIN = example

were example is the name of your domain,

Next you need to convert the existing passwd, group and shadow files that contain user information and passwords to the NIS database format. You can do this using the following command:

/usr/lib/yp/ypinit -m

From now on, every time you add a user, delete a user, you have to update the NIS database. You can do this using the command:

make -C /var/yp

you should setup a cron job to run every hour or so to update the database for you automatically, do this by typing in crontab -e

and then adding the following line to your crontab file

0 * * * * make -C /var/yp &> /dev/null

this will build your nis database at the top of every hour

save the file

start the NIS server by typing

/etc/init.d/ypserv start

The server is now ready to handle authentication requests from the clients.

On the client, you need to install the yp-tools package, apt-get install yp-tools
for debian based distro's and yum install yp-tools for red hat derivative ones
then type
system-config-authentication
which will open your gui configuration program
click on enable NIS
and then click on configure NIS
enter the domain name ie example
and the ip address of your NIS server. if you don't have a gui then you can alternatively edit your /etc/yp.conf file, and point it to the appropriate server and domain name by adding the following line
domain example server servers_ip_address

The /etc/nsswitch.conf file lists the order for how lookups for various things are done, such as DNS lookup, user authentication, etc . to make NIS authentication faster, change the following in your /etc/nsswitch.conf file from:

passwd: files nisplus nis
shadow: files nisplus nis
group: files nisplus nis

To the following:

passwd: nis files nisplus
shadow : nis files nisplus
group: nis files nisplus

start the NIS client service by typing

/etc/init.d/ypbind start

you will now be able to login to your client machine using the 
usernames that are stored on your NIS Server. you will get
an error about not being able to mount your home directory, but my
next post on automounting home directories centrally addresses that problem

Auto mount for Red Hat Derivative Distributions

2008-08-10T12:09:00.011+02:00

In my previous 2 posts we setup NFS client and NFS server. There is another way of setting up the client so that the mount is temporary and only made if and when the share is required, this way speeds up your boot process as the NFS share will only mount if and when you need it and not during boot time. A mounted file system or share will always stay mounted until you umount it, this can cause problems with NFS especially if your connection to your server is lost as your machine would not have umounted the share.
Auto mounter to the rescue.
automounter will mount your shares on a temporary basis, as and when you need them. it will also umount your shares automatically after an interval of inactivity (60 seconds by default).
to setup automounter edit your /etc/auto.misc file and add the following

name_of_share -fstype=nfs 192.168.0.160:/share

were 192.168.1.60:/share is your nfs share on the server
name_of_share can be any name you choose, this will just specify the directory name you need to change to to automount the share.

save your /etc/auto.misc

now your /etc/auto.misc file is informed by the information in your /etc/auto.master file (you shouldent have to change anything in there but to understand how automount works it is a good idea to look inside the file.
if you look inside your /etc/auto.master file you will see 2 entries that look like so
/misc /etc/auto.misc
/net -hosts

this informs your auto.misc file to temporally mount your share under /misc
and your share will also be browsable under /net

you will need to ls /net/192.168.0.160 to see the shares on your server

or cd into /misc/name_of_share to access the share (even though you don't see the server or the share under /misc and /net they will appear only when you cd into them

the mount will stay mounted whilst the directory is in use and then for 60 seconds longer after inactivity The mount will disappear you will need to cd or ls the sharename to access it again.

if you type cd .. so that you are in the /misc folder and then type ls again you will now see your share, but it will only be there for 60 seconds and then it will automatically umount and dissapear

if you wanted to change the place that the automounts take place from /misc to some other directory of your choice then you will need to edit your /etc/auto.master file and change /misc to whatever you like. Once saved restart the automounter service.
/etc/init.d/autofs restart
for your changes to take effect.

Debian based distributions uses different tools to accomplish the same, I will cover the debian tools in a future post.

NFS Server

2008-08-10T11:40:00.007+02:00

To share a directory on your computer and make it available to other computers on your network.
first make sure that nfs is installed and running as a service
/etc/init.d/ nfs status

if it is not running type /etc/init.d/ nfs start

and to make it start automatically at boot time type
chkconfig nfs on
(if your distribution doesn't come with chkconfig read this previous post on how to install it CHKCONFIG on Ubuntu)

nfs is also reliant on some other processes to be running for nfs to work these processes are portmap, rpc.mountd,nfsd and rpc.rquotd except for portmap the nfs script will start the others up, however if you have problems with nfs you can check if these services are running by typing
rpcinfo -p

NFS is very straightforward to setup there is only one file you have to edit and that is /etc/exports
edit it and add the following
/directory_name_to_be_shared 192.168.0.0/24(ro,sync,insecure)
make sure there are no spaces between the allowed network and the first (

were 192.168.0.0/24 is the network that you want to make the share available to, this could be a single ip address, a few ip addresses separarted by commas a domain name etc
ro = read only (you can change this to rw for read / write access)
insecure = will allow access on ports above 1024

save your file then type
exportfs -a to activate your nfs shares

If you add more shares to your /etc/exports file just add them underneath one another and then type
exportfs -ua and then
exportfs -a

this will re-read any modifications that you may have made.

NFS Client

2008-08-10T11:13:00.003+02:00

you are able to connect to NFS shares that servers on your network have exported and made available to connect to. to see what NFS shares a server is making available simply type
showmount -e [server ip address or server name]

eg

showmount - e 192.168.1.60

This will show you what shares are available.
to temporally connect to the share you can mount it, and connect to it eg
mkdir /mnt/sharename
mount -t nfs 192.168.0.60: /share /mnt/sharename

to make the following persistant after reboots add the following to your /etc/fstab file
192.168.0.60: /share /mnt/sharename/ nfs soft, intr,timeout=100 0 0

-soft = will error out if share is not available
-intr = will allow nfs to be killed if server is unreachable
-timeout =100 very important as without a timeout if the share hangs you will not be able to login to your system.

save your /etc/fstab file and you are done.

Swap Space

2008-08-10T10:04:00.009+02:00

During the life of your PC you most probably will be adding more physical RAM to it, in which case you may want to also increase the amount of swap space, swap space is disk space that is reserved for memory usage, the same as a paging file in Windows.
If your kernel needs more memory than what your physical RAM can produce it will write data to your swap space and use it as RAM, people will argue on how much swap space you should make available, some seem to think that if you add enough ram you don't even need swap space however this is not a good idea since swap space is always used no matter how much RAM your system has, Linux will always move infrequently used programs and data to swap space even if you have Gigabytes of Ram. Since Hard disk costs are so low I always stick to the rule of thumb with regards to how much swap space is enough, no matter how much physical Ram I add to my system I always increase my swap space accordingly up to a maximum of 4Gb (I never make swap space bigger than 4GB no matter how much RAM I have). The rule of thumb is that you should have double the amount of swap space available as the physical RAM on your computer. If you have 1GB of physical RAM then you should allocate 2GB of your hard drive to swap space.

Swap space is configured during installation but you can easily add more at anytime.

There are 2 methods of adding swap space to your system the one method is to create a partition of the swap space type and allocate that partition to swap space. The other way is to create a file of the required size (like a paging file) and then allocate that file to swap space.

To use the partition method you will need to create the partition using fdisk
create the partition to the size that you want to allocate as swap space and then set the partition id to type 82
once the partition is created issue the following command
mkswap -L SWAP-hda7 /dev/hda7

were hda7 is the the partition that you created

edit your /etc/fstab file and add the following entry

LABEL=SWAP-hda7 swap swap defaults 0 0

Save your /etc/fstab file and then issue the following command to read it into memory and turn it on
swapon -a

Done

Option 2,: To use a file instead of a partition, lets say you want to add a 2GB swapfile to your system
type
dd if=/dev/zero of=/swapfile bs=1024M count=2

this will create a 2GB sized file called /swapfile
then type
mkswap -L SWAPFILE /swapfile
then edit your /etc/fstab file and add the following entry

LABEL=SWAPFILE swap swap defaults 0 0
save your /etc/fstab file
and then type
swapon -a to read the file into memory and turn on all swap entries

you can check your swap status by typing
swapon -s

Fuser

2008-08-08T18:53:00.005+02:00

Ever needed to umount a device or file system or needed to umount your portable USB drive
but you can't as you keep getting a "Device is busy" error.

You cannot umount a file system that has open files, file handles, or if the file system is currently in use. not knowing what is using the device or what is keeping it busy can be extremely frustrating.
fuser to the rescue.
fuser will tell you what processes are using a file system and keeping it busy, fuser will also allow you to kill the processes that are preventing you from umounting the filesystem or device.
Lets say it is your usb memory stick on /dev/sda1 that you cannot umount.
Type
fuser -v /dev/sda1

will show you what and who is locking your device.
Then type
fuser -km /dev/sda1
to kill all the processes that are locking up and keeping your device busy.
then you will be able to umount your device without any errors.

fuser will also tell you what process or user is accesing a specific file.
Type fuser -v /filename eg
fuser -v /home/cgerada/filename.txt
and if you wanted to kill the process that is locking up the file, simply type
fuser -km /home/cgerada/filename.txt

Working with Groups and Shared Directories.

2008-08-06T15:56:00.006+02:00

There are three special sets of permissions that can be set to files and folders.
namely the Sticky Bit, 1770 (+t) the Set Group ID (sgid) 2770 (g+s) and the Set User ID (suid) 4770(u+s)

The Sticky bit and the sgid permissions are useful to set onto folders that are shared and accessed by a group of users.

the suid permission i will explain in another post since it is not relative to this topic.

Sticky Bit:

The sticky Bit sets permissions to a Directory that allows for only the owner of a file to be able to delete the file.
when the sticky bit is set users are only allowed to delete files that they created.
to set the sticky bit onto a folder simply type
chmod 1770 /folder_name
or
chmod +t /folder_name

eg chmod 1770 /marketing
or chmod +t /marketing

this would mean that every file created in the /marketing folder can only get deleted by the user who created that file.

Set Group ID (Sgid):

The sgid permission set onto a directory will insure that every file that is created inside that directory will inherit its permissions from the directory group and not from the person who created the file. This is essential in shared directories as it allows all users who are part of the group to have access to the files in the directory. an FTP shared directory for example would have the sgid permission set so that all files uploaded into the ftp folder would inherit the groups permission and not the permissions of the person who uploaded the file.

to set the sgid onto a directory simply type

chmod 2770 /folder_name
or
chmod g+s /folder_name

eg chmod 2770 /marketing
or chmod g+s /marketing

it makes sense to set both the sticky bit and the sgid onto a group directory. To set both permissions onto the same directory type
chmod 3770 /folder_name
eg chmod 3770 /marketing

lets demonstrate this in a real life scenario. We need to setup a group and a shared folder called Marketing and we want clive, jenny, ian and anthony to all have access to the Marketing folder
we need them all to be able to save files into the folder and we need them to be able to edit their own files but we do not want them to be able to delete each others files.

First we need to create the marketing folder

mkdir /marketing

next we need to create the marketing group that clive, jenny, ian and anthony are all part of. a quick way to do this is to type
groupadd marketing
and then edit your /etc/group file and add the users seperated by commas that you want to have access to the group were you find marketing:x501: (the users must exist on the system)
like so
marketing:x:501:clive,jenny,ian,anthony
next assign no specific user and the marketing group to have ownership to the group. type
chown nobody.marketing /marketing
next we want to assign the sticky bit as well as the sgid to the /marketing folder, so that all files created in the /marketing folder are accessible by everybody who is part of the marketing group
but only users who created the files are able to delete them.
type chmod 3770 /marketing

Done.

Find

2008-08-06T12:08:00.005+02:00

The fundamentals behind the Unix Philosophy are :

All Programs do only one thing but they do it really well.
All programs must work together i.e. The output of one program must be able to be passed to the input of another.
Programs must handle text streams because that is the universal interface.

This philosophy is what makes every command in Linux so Feature rich, and the Find command is no exception. Find does one thing, and that is to find files on your system and it does it really really well.

the basics of the find command are
find -name "file1.txt"

this will search all directories from the directory that you are in and will look for the file named file1.txt

find -iname "file1.txt"

will search all directories from the directory that you are in and will perform a case insensitive search for the file named file1.txt ie it will find in its search if it exists File1.txt FiLe1.TxT, FILE1.TXT and file1.txt

find / -name "file1.txt"

will search your entire file system for file1.txt

find / -name "*.txt"

will search your entire file system for all files ending in .txt

find / -name "*able*"

will search your entire file system for all files that have able in their name.

right, now that we've got the basics out of the way.

multiple search criteria can be passed to find eg

find / -name "*.txt" -user cgerada

will search for and find all .txt files that are owned by user cgerada only.

find / -name "*.txt" -not -user cgerada

will search for and find all .txt files that are NOT owned by user cgerada (so all other users .txt files will be listed)

Right ... Moving on ................

find / -size +10M

will search your file system finding all files that are greater than 10Mb in Size.
this is extremely useful for cleaning up your hard drive of large zip archives that are taking space and are no longer needed but you do not remember were they are.

you can substitute the M for a G for gigabyte ie
find / -size +1G

will find all files on your file system that are larger than 1 GB

moving on...................

lets say you need to find a document on your system that you were working on in the last hour, you cannot remember the name of the document the only unique criteria you know is that you worked on it less than an hour ago.

find / -amin -60

will list all files that were accessed less than 60 Minutes ago

-amin = when file was last read (accessed)
-mmin = when file was last changed (modified)
-cmin = when file data or meta data last changed

if you want to look for files that were accessed more than 1 day ago use -atime instead of -amin eg

find / -atime -5
will list all files that were accessed less than 5 days ago

you can narrow down you search to find all .txt files that were accessed less than 5 days ago and are less than 1mb in size

find / -name "*.txt" -size -1M -atime -5

moving on ..................

find is able to find files that are newer or older than a known file.
lets say you want to find a file that you know was created after the time that you created file1.txt but you cannot remember the name of the file.

find / -newer file1.txt
will list all files that are newer than file1.txt.You can combine search criteria to narrow down your search eg
find / -name "*.txt" -newer file1.txt will search for all .txt files that were created after file1.txt and of course you can negate your search criteria so that you can search for all files that are older than file1.txt eg
find / -name "*.txt" -not -newer file1.txt

will find all .txt files that were created before file1.txt

moving on.......................

Find is able to execute other commands on files that it has found.
to execute other commands on the results of your search we use the
-ok or the -exec switches
lets say for example your hard disk has become full and you want to move all files that end in .zip that are bigger than 100Mb into a directory called /largefiles

find / -name "*.zip" -size +100M -ok mv {} /largefiles/ \;

the -ok switch lets you confirm each file before it is moved
if you substitute -ok for -exec then you will not be asked and the move will just take place.

I advise you to first run the command with out the -ok or -exec option which will just list the files, then if you are happy that the correct files have been listed re-run the command and add in the -exec option
the {} are place holders that will put every file it finds in the place holder and run the command on that file name .
The reason that the command ends in a \; is because find uses ; as the delimiting character and so does the bash shell so to prevent bash from interpreting the ; we need to put a \ in front of it. that way the interpreting of the ; delimiter is passed on to find.

other examples: Lets say you want to rename all .zip files on your system to .old files

find / -name "*.zip" -exec mv {}.old \;

or lets say you want to find all files on your system that end in .sh and make them all executable

find / -name "*/sh" -exec chmod 755 {} \;

remember whenever you use the -ok or -exec option your statement must end in a \;

one last example:

lets say you want to be prompted before removing all of cgerada's tmp files that are over 5 days old

find /tmp -ctime +5 -user cgerada -ok rm {} \;to do the same but not be prompted you would use the -exec option like so
find /tmp -ctime +5 -user cgerada -exec rm {} \;

Bonus: this will remove all empty directories/folders

find -depth -type d -empty -exec rmdir {} \;

IP tables rule to secure against Brute force Attacks

2008-08-02T11:04:00.013+02:00

make sure you read my previous post "How to further secure your sever for SSH" and applying
those tips first and then applying these rules.

The following 2 iptables commands will limit the amount of ssh logins to your server to only 4 allowed per minute from the same ip address
as compared to the default unlimited setting. you can change the numbers to any limits that you wish.

The reason why you would want to do this is to protect against scripts that are written to gain access to your system via brute force attacks to your server.
look at your /var/log/secure log file to see just how often a dictionary of user-names and passwords has been tried to login to your server.
by instating the following 2 iptables rules you secure yourself against these type of brute force login attacks.

change eth0 to whatever Ethernet port your server is connected to the outside world through.

iptables -I INPUT -p tcp --dport 22 -i eth0 -m state --state NEW -m recent \--set

iptables -I INPUT -p tcp --dport 22 -i eth0 -m state --state NEW -m
recent \--update --seconds 60 --hitcount 4 -j DROP

you must then save your rules

/etc/init.d/ iptables save

The --state switch receives a comma separated list of connection states as an argument, by using "--state NEW" this makes sure that only new connections are managed.

The --set parameter in the first rule also insures that the IP address of the host which initiated the connection will be added to the "recent list", where it is then checked if used again in our second rule.

The --update switch in the second rule checks whether the IP address is in the list of recent connections, to port 22, port 22 will be in the list because we used the --set switch to add it in the first rule.

Once it has confirmed that the ip address of the host has indeed connected before, then the --seconds switch is used to insure that the IP address is only going to be flagged if the last connection was within the time frame specified. The --hitcount switch will measure if the count of connection attempts is greater than or equal to the number given.

this rule will drop any connections if The IP address which initiated the connection has previously been added to the list and The IP address has sent a packet in the past 60 seconds and The IP address has sent more than 4 packets in total.

1000th Visit

2008-08-02T08:18:00.002+02:00

Today 02 August 2008 @ 06:20.00 GMT

Securtiy with IPTABLES

2008-07-31T22:18:00.008+02:00

Another way to secure your server is by using iptables, you can use iptables together with tcp_wrappers or on their own, the choice is yours, the advantage with iptables is that iptables can be used to ACCEPT, DROP or REJECT packets of Data, it can also be used to FORWARD specific Data onto different Destinations and it can be used to configure NAT (Network Address Translation) also known as Masquerading.

the usage of IPTABLES is as follows:

iptables -t type (action) (direction) (type of packet) -j (what to do)

their are two types that you can choose (the -t switch)
filter = sets a rule for filtering packets
nat= configures Network Address Translation, also known as Masquerading
the default type is filter , if you don't specify a -t type the iptables command will assume that you are trying to setup a filtering rule. so you can leave out the -t switch if you are setting up a firewall rule.
next is the (action)
you can either
-A append a rule
-D delete a rule
-L list the currently configured Rules
-F flush the rules

next you need to specify which packets are the rules applied to (direction of packet)
INPUT = all incoming packets
OUTPUT = all outgoing packets
FORWARD = all packets that are being forwarded to another computer.

next you need to specify the source or destination address of the packet
-s ipaddress
-d ipaddress

next you need to specify the protocol of the packet using the -p switch
eg
-p tcp and then the port using the --dport switch eg
-p tcp --dport 80
and then finally what needs to be done with the packet which is the -j switch
DROP = the packet is dropped (no message is sent to the requesting host)
REJECT = the packet is rejected and an error message is sent to the requesting host
ACCEPT = the packet is Accepted
an ACCEPTED Packet can be forwarded by using the - A switch and then FORWARD
lets set up an iptable chain.
The first step is always to see what iptables are already configured . type
iptables -L
this reads the iptables from your /etc/sysconfig/iptables file (we do not edit this file directly it is best to use the iptables command with the relevant switches to configure your chains.)
iptables -L will return your rules in three different categories INPUT,FORWARD and OUTPUT
the following command will set a rule that denies all traffic from 192.168.0.0 network
iptables -A INPUT -s 192.168.0.0/24 -j REJECT
the following rule will make your server un-ping-able as it will drop all ICMP (ping) packets. Assume that your network is 192.168.0.0 the (!) inverts the meaning in this case the command applies to all IP addresses except those on the 192.168.0.0 network

if you need to insert the rule at line number 3 of the chain then type
iptables -I INPUT 3 -s 192.168.0.0/24 -j REJECT

iptables -A INPUT -s !192.168.0.0/24 -p icmp -j DROP
to delete any of the above commands simply retype them and change the -A to a -D eg:
iptables -D INPUT -s !192.168.0.0/24 -p icmp -j DROP will remove the previous chain
you can check your progress by typing iptables -L at anytime.
Once you have added the iptable rules that you want , you need to save your configuration. This is done with the following command
/etc/init.d/iptables save
this will save your configuration into the /etc/sysconfig/iptables file
you also need to insure that iptables starts up on run levels 2,3,4 and 5 so that it is persistent after a reboot
to do this type the following
chkconfig iptables on

Security with TCP wrappers

2008-07-31T19:30:00.010+02:00

TCP_wrappers is on by default and you do not need to start any service for it to work.
TCP_wrappers is configured by editing 2 files /etc/hosts.allow and /etc/hosts.deny

When your system receives a network request for a service. The request is passed on to tcp_wrappers
tcp_wrappers is very straight forward and easy to set-up.
Users and clients that are listed in /etc/hosts.allow are allowed access to the listed services
and users and clients that are listed in the /etc/hosts.deny file are denied access to the listed services.
It's important to know the order of things that your system takes to make its decisions. When a request is made of your system, your system will first read your /etc/hosts.allow file and if it finds a rule in there for the requested service the rule is obeyed and no additional searches take place. If there are no rules in /etc/hosts.allow for the requested service then your system will look in /etc/hosts.deny and if it sees a rule in their for the service the service is denied. If your system sees no rules in neither /etc/host.allow nor in /etc/hosts.deny then the service is automatically granted access.
the syntax of your access rules are as follows

(SERVICES to allow or block separated by commas) : Clients or source destinations
so lets set up some rules, edit /etc/host.deny using your favourite text editor and add the following line

ALL : ALL

this will make your server air tight as every service from every host is Denied.
however we can allow the clients and services that we want by adding them to the /etc/hosts.allow file, remember your system Will first check your /etc/hosts.allow file and if it finds any rules in there then those rules are obeyed and no further checking for those rules will take place , so by adding the following line to /etc/hosts.allow

ALL : 192.168.0.0/24

substitute 192.168.0.0/24 with the ip address of the network that you want to allow access to your server from

this will allow access to all services from the 192.168.0.0 network to have access on your server but all other networks will be denied since the rule in your /etc/hosts.deny file will block them.

Your access rules can be very flexible , for example you could add a rule like so into your /etc/hosts.allow file

ALL : 192.168.0.0/24 EXCEPT 192.168.0.10

this would allow all hosts from the 192.168.0.0 network access to all services on your server except for host 192.168.0.10 who will be denied.

you can also allow access to specific services only eg:

sshd, ftpd, telnetd, http : 192.168.0.20

would allow host 192.168.0.20 to ssh, ftp telnet and access your server over http .

likewise you could also deny access to specific services and specific users by adding the rules into your /etc/hosts.deny file

eg :
ALL EXCEPT sshd : 192.168.0.0/24
added to your /etc/hosts.deny file would deny all services except ssh from all hosts on the 192.168.0/24 network.

as you can see TCP_WRAPPERS is extremely flexible and straight forward to use.

Other recognised commands that you can put into your /etc/hosts.allow and /etc/hosts.deny files are
.hostname.com (will block or allow clients from the specified hostname eg :
ALL : hostname.com in your /etc/hosts.allow file will allow all clients from the hostname.com domain access to all services on your server.

user@machine_name.hostname.com will apply to the specific user from a given computer

192.168. since the IP address ends with a . it specifies all hosts whose IP address starts with 192.168.

to see the exact names of all the services that you can allow or deny take a look at your /etc/services file.

Running Commands Conditionally

2008-07-31T11:38:00.014+02:00

in Linux every command you run produces and records an exit status on whether the command was successful or not. If a command is successful the exit status will be recorded as "0" and if the command is not successful then the exit status is recorded as any number between "1 and 255". The exit status of the last command that you ran is recorded inside the $? variable.
To see what the exit status was of your previous command simply type echo $?
were this is useful is it allows you to run commands conditionally, based on the commands exit status. When you type two commands and you separate them with a && the second command will only run if the first command produced an exit status of "0" ie was successful.
If you separate the commands with a || then the second command will only run if the first command produced an exit status of "1-255" ie was not successful.
eg
ping 192.168.0.1 -c1 -w2 && echo "host is up"
- c1 = send 1 ping packet
-w2 = wait 2 seconds for a response

will display "host is up" if the ping command was successful at reaching the host at 192.168.0.1 and
ping 192.168.0.1 -c1 -w2 || echo "host is down"
will display "host is down" if the ping command was unsuccessful in reaching the host at 192.168.0.1

to get the desired result you should combine the commands like so

ping 192.168.0.1 -c1 -w2 && echo "host is up" || echo "host is down"

since you don't care about the actual output of the ping command (you are only interested if it was succesful or not ) You can redirect stdout and stderror to /dev/null so your final command would be something like:
ping 192.168.0.1 -c1 -w2 &> /dev/null && echo "Host is up" || echo "Host is Down"

Air Asia Advert

2008-07-28T12:27:00.002+02:00

Save, Convert and join Youtube movies for playback on your Blackberry

2008-07-27T08:23:00.009+02:00

lets say you see 4 movie clips on you tube that you want to join together to form 1 movie and save it to and play it on your Blackberry.
to start first download the mencoder tool. It should be available in your distributions repository.
type apt-get install mencoder if you have a debian derivative distro or
type yum install mencoder if you have a red hat one.

When you watch a movie clip on you tube the .flv file is automatically saved into your /tmp folder so once you have watched a clip that you want, you can simply copy it from your /tmp folder and save it somewhere safe, youtube saves its files with a name that starts with Flash followed by some arbitrary characters like FlashFgna. Copy these files to another folder so that they do not get deleted as your system will delete all files in your /tmp folder when you log out. so for my example watch the four movies you want on you tube, each one in a different tab of your browser once you have watched all 4 movies, open up a terminal window
type cd ~ then type mkdir videos which will create the directory were we are going to be working in.
cd videos to cd into the folder
type copy /tmp/Flash* .
will copy the four .flv files to your /home/username/videos/ folder don't worry if you don't see the .flv extension they are .flv files Linux doesn't care for extensions.

Sometimes you can skip the following step and you can try and join and convert your Flash files from .flv to .mp4. using the mencoder tool. but I have been much more successfull first encoding the files to the .avi format and then if i want to put the file on my Blackberry i will encode from .avi to .mp4

to encode from Flash to .avi we need to create the tool that will convert flv to avi files, here is a script that can do this.

Copy the following lines into your clipboard by highlighting them directly from this post and hitting cntl- "c"

#!/bin/sh

if [ -z "$1" ]; then
echo "Usage: $0 {-divx|-xvid} list_of_flv_files"
exit 1
fi

# video encoding bit rate
V_BITRATE=1000

while [ "$1" ]; do
case "$1" in
-divx)
MENC_OPTS="-ovc lavc -lavcopts \
vcodec=mpeg4:vbitrate=$V_BITRATE:mbd=2:v4mv:autoaspect"
;;
-xvid)
MENC_OPTS="-ovc xvid -xvidencopts bitrate=$V_BITRATE:autoaspect"
;;
*)
if file "$1" | grep -q "Macromedia Flash Video"; then
mencoder "$1" $MENC_OPTS -vf pp=lb -oac mp3lame \
-lameopts fast:preset=standard -o \
"`basename $1 .flv`.avi"
else
echo "$1 is not Flash Video. Skipping"
fi
;;
esac
shift
done

type vi /usr/local/bin/flv2avi.sh
(/usr/local/bin is a good place to save scripts as it is part of your path environment which means you will be able to execute your script from anywhere on your system)

this will open up your vi editor
once open type "i" to go into insert mode
then click on edit paste to paste the code into your script.

type :wq to save your script and exit out of vi

type chmod 755 /usr/local/bin/flv2avi.sh to make your script executable

to convert all the .flv files to avi we can do them all in one command. Type flv2avi.sh -divx Flashfile1 Flashfile2 Flashfile3 Flashfile4

were file1 file2 file3 file4 are the .flv files you want to convert.
once done you will have 4 additional files in your /home/username/videos folder all with .avi extensions.

now to join these files together and convert them to one .mp4 file which is the format that works best on your blackberry we also do it all in one command
mencoder file1.avi file2.avi file3.avi file4.avi -o newfilename.mp4 -ovc lavc -oac lavc
this will join all 4 files into one file and convert it to a .mp4 file
next just copy the file onto your blackberry and you will be able to play it using your blackberry's media player.

Multiple Terminals in one Terminal Window with Terminator.

2008-07-26T08:10:00.004+02:00

After a very short while of working on my desktop I often find myself with a mass of open terminal windows, and it sometimes becomes difficult to work as I struggle to find the Terminal Window that I want. I don't particularly like to use tabbed terminals to open multiple terminals, as I often need to see all of my open terminals side by side at the same time. Terminator to the Rescue!

Terminator is a virtual terminal program that allows you to split multiple terminal Windows in the same window. Terminator should be available in your Linux distributions Repository. apt-get install terminator if you use a Debian Flavoured Distribution or yum install terminator if you use a Red Hat one.

Once Installed you will find the terminator icon to start the program under Applications, accessories. or you can start terminator at the command line by typing terminator &

When it starts, a Terminal Window will open which will allow you to open new Terminals within your terminal in a split screened environment. What I like about this is when you minimize your terminal and you want to get back to it just by maximizing one Terminal you have all the terminals you were working on immediately accessible.

Once open try the following

Ctrl+Shift+O

Split terminals Horizontally.

Ctrl+Shift+E

Split terminals Vertically.

Ctrl+Shift+N

Move to next terminal.

Ctrl+Shift+P

Move to previous terminal.

Ctrl+Shift+W

Close the current terminal.

Ctrl+Shift+Q

F11 toggle Full Screen

you can also use your mouse to switch between terminals and to resize them by dragging their borders to the required size.

Session Managment with Screen

2008-07-25T19:26:00.008+02:00

You log into your remote server via SSH and are busy downloading and installing a new program. In the middle of the download you loose your connection to your server. "Connection Closed" You have just lost your session! Screen to the rescue.

Screen is a window manager for your ssh terminal sessions. Screen is an absolute life saver when working over ssh as it allows you to reconnect to your sessions and continue working exactly were you left off. Screen allows you to re-attach to your session.

Screen is available in your Linux distributions repository. To install screen type

apt-get install screen if you are using a Debian based distro. Or yum install screen if you are using a red hat derivative distribution. You will want to run and install screen onto the machine that you are connecting to. Once installed start screen by typing screen.

If you are presented with a text message just hit enter. If nothing happens don't worry it just means that you are now inside a window within screen and it is running and working.

Screen uses the command "Ctrl-A" to send commands to screen instead of the shell. To get help, just type "Ctrl-A" then "?"

Screen supports multiple windows. This is useful for doing simultaneous tasks on the same machine over ssh without opening new sessions. Sometimes I need to run multiple tasks on the same remote machine or whilst one task is busy running I need to start up another task. Without screen I would need to make a new connection to the same machine or even more multiple connections and if any of the connections drop then i am screwed . With screen you connect to your remote machine only once and can run multiple tasks on the same connection and if your connection breaks, no problem you simply reconnect and re-attach your session.

To open a new window, you just use "Ctrl-A" "c"

run your task, eg mtr www.google.com

Now open a new window with "Ctrl-A" "c" again and start another task this time lets start top type top
To get back to your previous screen (mtr www.google.com task), use "Ctrl-A "n"

You can create multiple windows and toggle through them with "Ctrl-A" "n" for the next screen or "Ctrl-A" "p" for the previous one .

If you want to close your session but want to return to it later then you must detach from your session instead of closing it. This will leave your process running and will allow you to re-attach to the same process later. "Ctrl-A" "d". This will drop you into your shell. All screen windows are still there and you can re-attach to them later.

So you are using screen now and busy downloading a new program and suddenly your connection drops. Don't worry screen will keep the download going. Login to your system and type

screen - R to re-attach to your session and then use Ctrl - A "n" and "p" to toggle between all the sessions you were running on the remote system before your connection was lost.

another useful feature of screen is its ability to monitor a window for activity or for silence.

lets say you are downloading a file and you want to know when the download is finished, you will need to monitor for silence on that screen. To do that type "Ctrl-A" "_" . When your download is complete you will get an alert at the bottom with the window number. To quickly go to that window, use "Ctrl-A" " . After you do this, just type in the number of the window and enter. To stop monitoring, go to that window and undo the monitor with the same command. To monitor for activity type Ctrl-A "M" this will alert you when something new appears on the session that you wanted to monitor.

Screen can also be used to share a terminal session with another user. This is very useful if you need to show someone how to do something.

The host starts screen in a local xterm, using the command screen -S SessionName. The -S switch gives the session a name, which makes multiple screen sessions easier to manage.

Type:

screen -S screendemo

The remote user (bwayne) uses SSH to connect to the host computer (cgerada).

Type:

ssh bwayne@cgerada.computer.ip.address

The host (cgerada) then has to allow multiuser access in the screen session via the command CTRL-A :multiuser on .

Type:

CTRL-A
:multiuser on

Next, the host (cgerada) must grant permission to the remote user (bwayne) to access the screen session using the command CTRL-A :acladd user_name where user_name is the remote user's login ID.

Type:

CTRL-A
:acladd bwayne

The remote user can now connect to the hosts 'screen' session. The syntax to connect to another user's screen session is screen -x host_username/sessionname.

Type:

screen -x cgerada/screendemo

Voila both users will now share the same terminal session.

How to convert Multiple Images for emailing

2008-07-25T18:39:00.011+02:00

Imagemagick is normally included with most linux distributions, but if it isn't then you can install it by typing the following
apt-get install imagemagick for debian based distributions
or yum install imagemagick for red hat derivative distributions.

imagemagick is an awesome and extremely powerful image manipulation tool. For more detailed and other uses of this great tool read the man pages ie. man convert or visit their website http://www.imagemagick.org.

I use imagemagic to quickly resize a large batch of jpg files so that they are a suitable size for emailing

cd into the directory that you have your images saved, the ones you want to resize

then type the following

for k in $(ls *.jpg); do convert $k -resize 800x600 re_$k; done

replace 800x600 with whatever size you want to resize your images to. eg 640x480 or 320x200 etc this command will go through your current directory and will convert all your .jpg files by creating new files, saving the new converted files to a new filename with re_ infront of the existing file name. The original files are left intact.

you can also convert your pictures to different formats ie
convert image.jpg image.bmp
or convert image.gif image.tiff
or convert image.png image.jpg
will convert between the different formats

you can also use it to convert to a pdf file or to convert a pdf file to a jpg
eg convert file.jpg file.pdf or convert file.pdf file.jpg

How to Mount an ISO or an MDF image

2008-07-23T09:06:00.006+02:00

The mount command can be used to mount any thing from a samba / nfs share to an ISO image.

in windows you need such tools as Daemon tools , Alcohol 120 etc to accomplish the same. In Linux it's a lot simpler. ISO images can be mounted without any additional tools. MDF images can also be mounted but they first need to be converted to an ISO file. To convert an MDF image to an ISO image use the mdf2iso tool which you can download from your distributions repository. eg yum install mdf2iso if you use a Red Hat derivative distro. Or apt-get install mdf2iso if you use a debian one. Once you convert the MDF file to an ISO you simply use the mount command to mount the image.

mount -t iso9660 -o loop

the loop option mounts the iso as a loopback device. This is neccassery when you are mounting a file of another file system in this case an iso file

Example:

mkdir /mnt/image

mount -t iso9660 -o loop /home/cgerada/films/the_dark_Knight.iso /mnt/image

The ‘-t’ option specifies the file type - this is optional, Linux is intelligent enough to see that the image you are mounting is of the iso9660 file type so you could just as well type.

mount -o loop /home/cgerada/films/the_dark_knight.iso /mnt/image

then cd into the /mnt/image directory to use the files ie cd /mnt/image.

To convert an MDF (alcohol 120) file to an ISO

type mdf2iso filename.mdf newfilename.iso

and then mount the ISO file.

How to Upgrade your full distribution of Ubuntu to the latest version

2008-07-19T20:58:00.004+02:00

For your server that doesn't have a gui
sudo -i
enter your root password
apt-get install update-manager-core
do-release-upgrade
this will do a complete update to the latest version of Ubuntu, including updating of your sources list

on a desktop installation were you have Gnome or KDE installed press ALT -F2 then type
update-manager --devel-release and then click on run
this will also do a complete upgrade.

Look from 15 ft away

2008-07-18T08:46:00.006+02:00

When you look at this picture up close you see its Albert Einstein.

But if you stand 15 feet away,

It will become Marilyn Monroe.

Give it a try

How to deny users access to certain sites at specific times

2008-07-09T18:29:00.007+02:00

right, now you've got Squid up and running and its saving your company oodles of bandwidth as it serves cached websites to your users. other great features of squid is its use of Access lists (ACL's). Here is a way that you can restrict your users access to specific sites during specific times, lets say for this example that you do not want your users to access youtube, facebook and myspace between 8:30 am and 5:00pm but you didn't mind if they accessed those sites before 8:30am and after 5:00pm one way of accomplishing this is the following.
create a file in your /etc/squid/ directory called band_sites
you can do this by typing vi /etc/squid/band_sites
then in the empty file put a list of sites you want to ban your users from visiting
like so
myspace.com
facebook.com
youtube.com

save the file by typing :wq
change the ownership of the file so that the squid group can access the file
chown root.squid /etc/band_sites
and then change the permissions to the file
chmod 640 /etc/band_sites

edit your squid configuration file and then add the following ACL's
vi /etc/squid/squid.conf
acl work_time time 8:30-17:30
acl band_sites dstdom_regex -i "/etc/squid/band_sites"
http_access deny band_sites work_time

save your config file
and then reload squid by typing
/etc/init.d/squid reload

Done

Squid Proxy quick and easy

2008-07-09T11:52:00.007+02:00

the Squid config file can be quite daunting as it has over 4000 lines.

here's how to get squid up and running quickly.

Before activating squid you need to add three lines to the config file.
You need to add the hostname of your squid server. To do this add the following line to your
/etc/squid/squid.conf file , add it near the associated comment in the file.
were hostname.domainname.com is the host name of your squid proxy server.

visible_hostname hostname.domainname.com

Next you need to add the following basic access lists, so that your machines will be able to connect to squid.
acl our_networks src 192.168.0.0/24
http_access allow our_networks

were 192.168.0.0/24 is the address's of the machines that will be accessing your proxy server. You can add as many address ranges as you want. eg
acl our_networks 192.168.0.0/24 172.16.0.0/24 10.0.0.0/24
etc etc. save your changes and exit.
Make sure that you allow port 3128 on your firewall, as that is the default port that squid uses. You can change this port to anything you want like 8080 by editing the default port stanza in your /etc/squid/squid.conf file

type squid -z
this will create the squid swap directories.

Make sure that squid starts up on start up by typing
chkconfig squid on this will insure it starts on run levels 3 and 5

and then start squid by typing /etc/init.d/squid start

Done, squid should be up and running and caching webpages for your users.

Squid is a high performance very flexible and powerful caching proxy server
with many configurable options , for example, you can set up
password protected web browsing authentication for your users,
so that you can monitor web usage associated to login name, not only IP address. This is useful in an environment were more than one user uses the same machine. You can also restrict access to websites at certain times of the day for certain users.A comprehensive user guide on squid is available at http://euler.aero.iitb.ac.in/docs/web/squid/html/book1.html

Apache , how to password protect your site

2008-07-08T19:39:00.014+02:00

You can limit access to your websites to authorised users with passwords, these credentials can be different and independent of the regular users of your web server.

edit your /etc/httpd/conf/httpd.conf file and add the following stanza
were the first line is the path of the directory you want to protect

<>

/var/www/html/website
AuthType Basic
AuthName "any Text in here you want to be displayed"
AuthUserFile /etc/httpd/webpass
Require valid-user
< /Directory >

once you have edited the file you will need to restart or reload the httpd daemon do this by typing
/etc/init.d/httpd reload
next type the following
htpasswd -c /etc/httpd/webpass username
were username is the username you want to allow access to the site
you will be prompted for a password for the username you entered and the information will be saved into the /etc/httpd/webpass file in an encrypted format, so even if someone reads that file they will not be able to make out what the password is.
If you want to add more authorised users to the file simply use the same command but without the -c option
-c was to create the original file , since it has now been created you just want to add users so you don't use the -c
eg htpasswd /etc/httpd/webpass username2

when you access the site you will be prompted for a user name and password.

Logical Volumes LVM

2008-07-07T11:38:00.013+02:00

Logical Volumes are the greatest thing since sliced bread
if your data is stored on a logical volume and you run out of disk space, you can simply add more hard drives to your system and then grow your logical volume onto the new physical hard drives giving your data the extra space it needs, logical volumes can also work on top of Raid since logical volumes by them selves gives you no redundancy at all it is a good idea to have them setup on top of a Raid array.

To set up a logical volume partitions must first be converted into physical volumes using the pvcreate command. once you have added your new hard drives to the system, use fdisk to tag the drives as LVM's the tag hex code for LVM is 8e once tagged you can convert the drives to physical volumes to convert /dev/hda and /dev/hdb into physical volumes type:

pvcreate /dev/hda
pvcreate /dev/hdb

NOTE : to setup a LVM on top of a linux software Raid array you simply convert your software raid device to a physical volume eg:
pvcreate /dev/md0

Once you have one or more physical volumes created, you can create a volume group from these PVs using the vgcreate command.

vgcreate vg1 /dev/hda /dev/hdb

this creates a VG called vg1 from the two disks, /dev/hda and /dev/hdb
more PVs can be added to this volume group using the vgextend command.

pvcreate /dev/hdc
vgextend vg1 /dev/hdc

this will add /dev/hdc to the volume group "vg1"
to remove the PV from vg1 use the vgreduce command

vgreduce vg1 /dev/hdc

you can add as many disks to the volume as you like, think as the volume
as your cache of storage.

Use lvcreate command to create a logical volume which will use the free capacity in the volume group pool. (ie your storage cache)

lvcreate -n lv1 -L 100G vg1

or you can specify the capacity in PE's "physical extents" to find out how many PE's are available
in your volume group type.

vgdisplay vg1 | grep "Total PE"

which returns

Total PE 34456

Then use lvcreate to create a logical volume with 34456 extents

lvcreate -n lg1 -L 34456 vg1

you can also allocate a logical volume from a specific physical partition in the volume group by specifying the partition at the end of the lvcreate command.

lvcreate -L100G -n lg1 /dev/hda /dev/hdb

A logical volume can be removed from a Volume group using lvremove
you must first umount the logical volume.

umount /dev/vg1/lg1
lvremove /dev/vg1/lg1

when you add more hard drives to your system and add them to the Volume group you can then extend the logical volume to make use of the added storage by using the lvextend command. You can specify either an absolute size for the extended LV or how much additional storage you want to add to the LV.

lvextend -L120G /dev/vg1/lg1

will extend the logical volume to 120 GB, while

lvextend -L+20G /dev/vg1/lg1

will extend the logical volume by an additional 20 GB. Once a logical volume has been extended, the file system must be expanded to use the added storage.
to do this use the resize2fs command.

resize2fs /dev/vg1/lg1
your done...

other usefull commands
pvs will list all your partitions that you have assigned to a volume group
lvs will list all of your configured logical Volumes
vgs will show you how much available or free space you have available in your volume group
lvscan will scan for active logical volumes
vgdisplay will display the information of your volume group
lvdisplay will display currently configured logical volumes

Software raid on Linux

2008-07-05T20:44:00.006+02:00

to create a software raid in Linux we use the mdadm command
first you will need the partitions available to you for the raid, using fdisk you must tag the partitions with the "linux raid autodetect " tag using the hex code id of fd to do this just type fdisk /dev/hda (you use the name of the partion you want to tag then type t and then type fd type w to save and then type partprobe to probe the changes into your kernel

next you need to create your raid partition , lets create a raid 1 partition which is a mirrored set and it uses 2 disks, but we are going to add a 3rd disk and use it as a spare, so if one of the 2 disks in the mirror break the spare will automatically replace it in the raid configuration and rebuild itself.

so we have 3 partitions taged with the "linux raid autodetect" tag id fd

to create a raid 1 partition we type mdadm -C /dev/md0 -l 1 -n 2 -x 3 -a yes /dev/hd{3..5}
-C = create
-l 1 = raid level 1
-n 2 = how many disks we will be using
-x 1= x stands for spare (how many spare disks we will be using
-a yes = instructs udev to create the md device file if it does not already exist
/dev/hd{3..5} are the disks you want to use in the raid you could type them separately ie /dev/hd3 /dev/hd4 /dev/hd5 if you want but /dev/hd{3..5} is shorter to type and is the exact same thing.

once done you need to format your raid partition.
mkfs.ext3 /dev/md0
next create a directory were you want to mount your raid partition
mkdir /media/raid1
lets give the partition a label we will use the label name in the fstab file this is not necessary however it is good practice to label your partitions so that if they ever change their /dev position the label will remain the same and they will still mount.
e2label /dev/md0 raid1

then we can mount it in fstab using its label name ... in your /etc/fstab file add the following line
LABEL=raid1 /media/raid5 ext3 defaults 1 2
save your fstab file and type mount-a to have your fstab file read and loaded by the system
to monitor our raid partition we can type cat /proc/mdstat
or watch -n1 cat /proc/mdstat this will update the monitoring process every second

you can even simulate a drive failure to test if your raid works,
type watch -n1 cat /proc/mdstat in a terminal window and set that window to always be on top , then open another window to fail your drive in and you can watch your raid rebuild itself in the monitoring window.
in the other window type mdadm /dev/md0 -f /dev/hd3 (this will fail drive /dev/hd3 in your raid)
(watch what happens in your monitoring window) you can then remove the failed drive from the raid set by typing mdadm /dev/md0 -r /dev/hd3
and to put a new drive back into you raid set type mdadm /dev/md0 -a /dev/hd3

Setting up and Managing Disk Quota's

2008-06-27T16:25:00.006+02:00

Disk quota's are very important as they prevent your users from filling up your hard drive, to set-up disk quota's on your /home directory, insure that your /home directory is configured as a separate partition, if it is not then you will need to set up your quota's on your root partition ie /
edit your /etc/fstab file and edit the line for your /home or your / partition and add the usrquota option like so
/dev/hda/ /home ext3 defaults,usrquota 1 2

save your fstab file and then type
mount -a
so that the fstab files changes are read by the kernel

next

type quotacheck -cugm
this will scan the quota file system and is necessary to run first before you can add quota's
c = create files
u = scan user quota's
g= scan group quota's
m= no remount
then to add a quota type the following substitute "username" for the username you want to add the quota for

edquota -u username /home

vi will then open the quota file for that user that looks like this

Disk quotas for user username (uid 500):
Filesystem blocks soft hard inodes soft hard
/dev/hda 707896 0 0 13 0 0

simply edit the file to the settings you want. A soft limit is your warning limit and a hard limit is your never exceed limit. blocks are storage size 1000 blocks is equal to roughly 1MB and you can restrict the user to number of inodes each file uses 1 inode. large amounts of small or empty Files can also fill up a file system , since an empty file still requires an inode so if you set a hard limit on the inodes of say 1000 that means the user will only be able to save a maximum of 1000 files in their home folder even if the files are of 0kb in size.
to limit a user to say 1GB of storage set the hard limit of the blocks to 1000 000 as 1000 blocks is equal to roughly 1MB , so to limit them to 100MB set the hard limit to 100 000 blocks
save the file by typing :wq

to see what quota's have been set and to see the usage by users on all file systems, type repquota -a

a user can also see their own quota statistics by typing quota
or root can type quota -u username

You can also use the setquota command, to set a users quota (instead of edquota)which has the advantage of not using an editor making it ideal for implementing in a script. For example, to set the soft block limit to 100, a hard block limit of 200, a soft inode to 10 and a hard inode to 15 , execute the following command.

setquota -u username100 200 10 15 -a /home

How to further Secure your Server for SSH

2008-06-16T19:58:00.008+02:00

server1.hq.org
is the name of your server that is available on the Public Internet to you from your local machine using SSH
although SSH in itself is a secure protocol to use as it encrypts the user names and passwords, to further protect your server from brute force attacks as well as to insure that even if a hacker decrypts the user name and password of your connection he will still not be able to take over your machine with admin privileges follow these steps.

since port scanning is so easy to do, i do not recommend bothering changing your default ssh port to another port, it will take a hacker all of 1 millisecond to find out what port you have changed to.

create a Private / Public Key pair on the computer that you use that you want to connect from
to do this type ssh-keygen
you will get the following response
Generating public/private rsa key pair.
Enter file in which to save the key (/root/.ssh/id_rsa):
hit enter to have your keys saved in /root/.ssh/ directory (this directory will be off the home directory of the user that you were when you ran the ssh-keygen command in my case i was the root user
next you will be asked if you want to create a pass phrase for the key
Enter passphrase (empty for no passphrase):
here you can enter a password , remember this password is for the key (should your local computer be compromised and someone steals your private key, they will still need to know what the password is)
or you can leave the password out, it is useful to leave the password out if you are using this technique to automate an ssh connection for the purpose of file transfer using a cron job ill explain how to do that in another posting)
once the key is created you need to transfer the public key to your server1.hq.org which after all is the server you want to secure. To do that enter the following
ssh-copy-id -i root/.ssh/id_rsa.pub username@server1.hq.org
were root/.ssh/ is the folder were your keys were saved to.
the ssh-copy-id command will transfer the public key to your server and save it into the correct folder,
you could manually use scp to copy the key accross but ssh-copy-id does it all for you and puts the key were it should be.

now you will be able to connect to your server without logging in, once connected to your server you need to edit your /etc/ssh/sshd_config file use your favourite editor to edit this file and add the stanza PermitRootLogin no
save your file, and then reload the sshd service by typing /etc/init.d/sshd reload this will load in the new settings from now on you have to connect to your server over ssh using a standard user account, once you are on the server you can sudo to the root user to perform admin tasks, the reason why we do this is in case a hacker decrypts the secure ssh password he will still only have access to a non privileged user account which is better than if they were to compromise your server with your admin password.

Forwarding Ports over SSH

2008-06-16T18:47:00.006+02:00

lets say that the only access you have to a remote network is through SSH but you have an application that needs to securely access port 5901 on the remote network, (however this port is blocked to the outside world) SSH to the rescue. You can create a tunnel over SSH and then run your application and it will connect to the desired port by first being tunneled over your ssh connection

ssh -L 5901:remote-server:5901 user@ssh-remote-server

once the connection has been made over ssh and you have authenticated with your ssh password,
simply fire up your application that requires the remote port and point it to your localhost port 5901 and it will be tunneled over the ssh connection. in this example we tunneled vnc over ssh to make the connection
simply type vncviewer localhost:1

the remote server will think that the connection has been initiated from the local server on its network (the ssh server)

another example lets say you want to browse a web server on a remote machine through your local port 8080
ssh -L 8080:remote-server:80 user@ssh-remote-server
once you have authenticated on ssh, open up your browser and type http://localhost:8080 in your address bar, you will access the web-page of the remote server:80

the added advantage of doing this is that your tunnel is encrypted and traffic travelling between your local and remote machines is secure.

Access Control Lists (ACL's)

2008-06-16T09:06:00.004+02:00

by Default only root user can assign permissions on Directories and Folders.
however if a standard user wants to allow access to a folder to one of his colleagues
you must use ACL Access control list

first off acl needs to be instated on the mounted file system that you want to allow users to manage their own permissions on, to do this edit your /etc/fstab file and make sure that that you add the acl option to the mount so that it looks something like this
/dev/hda /home ext3 defaults,acl 1 2

save your fstab file and force the Kernel to re-read its contents by typing
mount -a

this will read in the contents of your fstab file and remount all the file systems with the the new settings.

then for a standard user to give access to a certain folder they must use the setfacl command
so to give user2 read write access to /home/user1/projects folder user 1 would type
setfacl -m u:user2:rw /home/user1/projects

the m stands for modify. to remove permissions you would replace the m with an x and then simply state the folder you wanted permissions removed from
eg setfacl -x /home/user1/projects
you could set permissions to individual files as well not only directories
eg setfacl -m u:user2:rw /home/user1/projects/filename

you can set permissions using rwx notation as well for example
To deny a user acces to a file type the following
setfacl -m u:user2:---/home/user1/projects/filename
to give him read access only you can type the following
setfacl -m u:user2:r--/home/user/projects/filename

if you want to see what permissions exist on a certain folder
type getfacl /home/user1/projects

you should get a response similar to the following were you can see the added permissions for user 2
# file: home/user1/project
# owner: user1
# group: user1
user::rwx
user:user2:rw-
group::r-x
mask::rwx
other::r-x