Look from 15 ft away

When you look at this picture up close you see its Albert Einstein.

But if you stand 15 feet away,

It will become Marilyn Monroe.

Give it a try

How to deny users access to certain sites at specific times

right, now you've got Squid up and running and its saving your company oodles of bandwidth as it serves cached websites to your users. other great features of squid is its use of Access lists (ACL's). Here is a way that you can restrict your users access to specific sites during specific times, lets say for this example that you do not want your users to access youtube, facebook and myspace between 8:30 am and 5:00pm but you didn't mind if they accessed those sites before 8:30am and after 5:00pm one way of accomplishing this is the following.
create a file in your /etc/squid/ directory called band_sites
you can do this by typing vi /etc/squid/band_sites
then in the empty file put a list of sites you want to ban your users from visiting
like so
myspace.com
facebook.com
youtube.com

save the file by typing :wq
change the ownership of the file so that the squid group can access the file
chown root.squid /etc/squid/band_sites
and then change the permissions to the file
chmod 640 /etc//squid/band_sites

edit your squid configuration file and then add the following ACL's.
It is important that you put these ACL's at the top
of the file, before your http_access allow our_networks
since ACL's are applied from top to bottom.
vi /etc/squid/squid.conf
acl work_time time 8:30-17:30
acl band_sites dstdom_regex -i "/etc/squid/band_sites"
http_access deny band_sites work_time

save your config file
and then reload squid by typing
/etc/init.d/squid reload

Done

Squid Proxy quick and easy

the Squid config file can be quite daunting as it has over 4000 lines.

here's how to get squid up and running quickly.

Before activating squid you need to add three lines to the config file.
You need to add the hostname of your squid server. To do this add the following line to your
/etc/squid/squid.conf file , add it near the associated comment in the file.
were hostname.domainname.com is the host name of your squid proxy server.

visible_hostname hostname.domainname.com

Next you need to add the following basic access lists, so that your machines will be able to connect to squid.
acl our_networks src 192.168.0.0/24
http_access allow our_networks

were 192.168.0.0/24 is the address's of the machines that will be accessing your proxy server. You can add as many address ranges as you want. eg
acl our_networks 192.168.0.0/24 172.16.0.0/24 10.0.0.0/24
etc etc. save your changes and exit.
Make sure that you allow port 3128 on your firewall, as that is the default port that squid uses. You can change this port to anything you want like 8080 by editing the default port stanza in your /etc/squid/squid.conf file

type squid -z
this will create the squid swap directories.

Make sure that squid starts up on start up by typing
chkconfig squid on this will insure it starts on run levels 3 and 5

and then start squid by typing /etc/init.d/squid start

Done, squid should be up and running and caching webpages for your users.

Squid is a high performance very flexible and powerful caching proxy server
with many configurable options , for example, you can set up
password protected web browsing authentication for your users,
so that you can monitor web usage associated to login name, not only IP address. This is useful in an environment were more than one user uses the same machine. You can also restrict access to websites at certain times of the day for certain users.A comprehensive user guide on squid is available at http://euler.aero.iitb.ac.in/docs/web/squid/html/book1.html

Apache , how to password protect your site

You can limit access to your websites to authorised users with passwords, these credentials can be different and independent of the regular users of your web server.

edit your /etc/httpd/conf/httpd.conf file and add the following stanza
were the first line is the path of the directory you want to protect

</Directory"/var/www/html/website/">
AuthName "any Text in here you want to be displayed"
AuthUserFile /etc/httpd/webpass
Require valid-user
< /Directory >

once you have edited the file you will need to restart or reload the httpd daemon do this by typing
/etc/init.d/httpd reload
next type the following
htpasswd -c /etc/httpd/webpass username
were username is the username you want to allow access to the site
you will be prompted for a password for the username you entered and the information will be saved into the /etc/httpd/webpass file in an encrypted format, so even if someone reads that file they will not be able to make out what the password is.
If you want to add more authorised users to the file simply use the same command but without the -c option
-c was to create the original file , since it has now been created you just want to add users so you don't use the -c
eg htpasswd /etc/httpd/webpass username2when you access the site you will be prompted for a user name and password.

Logical Volumes LVM

Logical Volumes are the greatest thing since sliced bread
if your data is stored on a logical volume and you run out of disk space, you can simply add more hard drives to your system and then grow your logical volume onto the new physical hard drives giving your data the extra space it needs, logical volumes can also work on top of Raid since logical volumes by them selves gives you no redundancy at all it is a good idea to have them setup on top of a Raid array.

To set up a logical volume partitions must first be converted into physical volumes using the pvcreate command. once you have added your new hard drives to the system, use fdisk to tag the drives as LVM's the tag hex code for LVM is 8e once tagged you can convert the drives to physical volumes to convert /dev/hda and /dev/hdb into physical volumes type:

pvcreate /dev/hda
pvcreate /dev/hdb

NOTE : to setup a LVM on top of a linux software Raid array you simply convert your software raid device to a physical volume eg:
pvcreate /dev/md0

Once you have one or more physical volumes created, you can create a volume group from these PVs using the vgcreate command.

vgcreate vg1 /dev/hda /dev/hdb

this creates a VG called vg1 from the two disks, /dev/hda and /dev/hdb
more PVs can be added to this volume group using the vgextend command.

pvcreate /dev/hdc
vgextend vg1 /dev/hdc

this will add /dev/hdc to the volume group "vg1"
to remove the PV from vg1 use the vgreduce command

vgreduce vg1 /dev/hdc
you can add as many disks to the volume as you like, think as the volume
as your cache of storage.
Use lvcreate command to create a logical volume which will use the free capacity in the volume group pool. (ie your storage cache)

lvcreate -n lv1 -L 100G vg1

or you can specify the capacity in PE's "physical extents" to find out how many PE's are available
in your volume group type.

vgdisplay vg1 | grep "Total PE"

which returns

Total PE 34456

Then use lvcreate to create a logical volume with 34456 extents

lvcreate -n lg1 -L 34456 vg1

you can also allocate a logical volume from a specific physical partition in the volume group by specifying the partition at the end of the lvcreate command.

lvcreate -L100G -n lg1 /dev/hda /dev/hdb

A logical volume can be removed from a Volume group using lvremove
you must first umount the logical volume.

umount /dev/vg1/lg1
lvremove /dev/vg1/lg1

when you add more hard drives to your system and add them to the Volume group you can then extend the logical volume to make use of the added storage by using the lvextend command. You can specify either an absolute size for the extended LV or how much additional storage you want to add to the LV.

lvextend -L120G /dev/vg1/lg1

will extend the logical volume to 120 GB, while

lvextend -L+20G /dev/vg1/lg1

will extend the logical volume by an additional 20 GB. Once a logical volume has been extended, the file system must be expanded to use the added storage.
to do this use the resize2fs command.

resize2fs /dev/vg1/lg1your done...

other usefull commands
pvs will list all your partitions that you have assigned to a volume group
lvs will list all of your configured logical Volumes
vgs will show you how much available or free space you have available in your volume group
lvscan will scan for active logical volumes
vgdisplay will display the information of your volume group
lvdisplay will display currently configured logical volumes

For a good guide to grow a Virtual Machine checkout the following link
http://www.jaredlog.com/?p=1133

Software raid on Linux

to create a software raid in Linux we use the mdadm command
first you will need the partitions available to you for the raid, using fdisk you must tag the partitions with the "linux raid autodetect " tag using the hex code id of fd to do this just type fdisk /dev/hda (you use the name of the partion you want to tag then type t and then type fd type w to save and then type partprobe to probe the changes into your kernel

next you need to create your raid partition , lets create a raid 1 partition which is a mirrored set and it uses 2 disks, but we are going to add a 3rd disk and use it as a spare, so if one of the 2 disks in the mirror break the spare will automatically replace it in the raid configuration and rebuild itself.

so we have 3 partitions taged with the "linux raid autodetect" tag id fd

to create a raid 1 partition we type mdadm -C /dev/md0 -l 1 -n 2 -x 3 -a yes /dev/hd{3..5}
-C = create
-l 1 = raid level 1
-n 2 = how many disks we will be using
-x 1= x stands for spare (how many spare disks we will be using
-a yes = instructs udev to create the md device file if it does not already exist
/dev/hd{3..5} are the disks you want to use in the raid you could type them separately ie /dev/hd3 /dev/hd4 /dev/hd5 if you want but /dev/hd{3..5} is shorter to type and is the exact same thing.

once done you need to format your raid partition.
mkfs.ext3 /dev/md0
next create a directory were you want to mount your raid partition
mkdir /media/raid1
lets give the partition a label we will use the label name in the fstab file this is not necessary however it is good practice to label your partitions so that if they ever change their /dev position the label will remain the same and they will still mount.
e2label /dev/md0 raid1

then we can mount it in fstab using its label name ... in your /etc/fstab file add the following line
LABEL=raid1 /media/raid5 ext3 defaults 1 2
save your fstab file and type mount-a to have your fstab file read and loaded by the system
to monitor our raid partition we can type cat /proc/mdstat
or watch -n1 cat /proc/mdstat this will update the monitoring process every second

you can even simulate a drive failure to test if your raid works,
type watch -n1 cat /proc/mdstat in a terminal window and set that window to always be on top , then open another window to fail your drive in and you can watch your raid rebuild itself in the monitoring window.
in the other window type mdadm /dev/md0 -f /dev/hd3 (this will fail drive /dev/hd3 in your raid)
(watch what happens in your monitoring window) you can then remove the failed drive from the raid set by typing mdadm /dev/md0 -r /dev/hd3
and to put a new drive back into you raid set type mdadm /dev/md0 -a /dev/hd3

Setting up and Managing Disk Quota's

Disk quota's are very important as they prevent your users from filling up your hard drive, to set-up disk quota's on your /home directory, insure that your /home directory is configured as a separate partition, if it is not then you will need to set up your quota's on your root partition ie /
edit your /etc/fstab file and edit the line for your /home or your / partition and add the usrquota option like so
/dev/hda/ /home ext3 defaults,usrquota 1 2

save your fstab file and then type
mount -a
so that the fstab files changes are read by the kernel

next

type quotacheck -cugm
this will scan the quota file system and is necessary to run first before you can add quota's
c = create files
u = scan user quota's
g= scan group quota's
m= no remount
then to add a quota type the following substitute "username" for the username you want to add the quota for

edquota -u username /home

vi will then open the quota file for that user that looks like this

Disk quotas for user username (uid 500):
Filesystem blocks soft hard inodes soft hard
/dev/hda 707896 0 0 13 0 0

simply edit the file to the settings you want. A soft limit is your warning limit and a hard limit is your never exceed limit. blocks are storage size 1000 blocks is equal to roughly 1MB and you can restrict the user to number of inodes each file uses 1 inode. large amounts of small or empty Files can also fill up a file system , since an empty file still requires an inode so if you set a hard limit on the inodes of say 1000 that means the user will only be able to save a maximum of 1000 files in their home folder even if the files are of 0kb in size.
to limit a user to say 1GB of storage set the hard limit of the blocks to 1000 000 as 1000 blocks is equal to roughly 1MB , so to limit them to 100MB set the hard limit to 100 000 blocks
save the file by typing :wq

to see what quota's have been set and to see the usage by users on all file systems, type repquota -a

a user can also see their own quota statistics by typing quota
or root can type quota -u username

You can also use the setquota command, to set a users quota (instead of edquota)which has the advantage of not using an editor making it ideal for implementing in a script. For example, to set the soft block limit to 100, a hard block limit of 200, a soft inode to 10 and a hard inode to 15 , execute the following command.

setquota -u username100 200 10 15 -a /home

How to further Secure your Server for SSH

server1.hq.org
is the name of your server that is available on the Public Internet to you from your local machine using SSH
although SSH in itself is a secure protocol to use as it encrypts the user names and passwords, to further protect your server from brute force attacks as well as to insure that even if a hacker decrypts the user name and password of your connection he will still not be able to take over your machine with admin privileges follow these steps.

since port scanning is so easy to do, i do not recommend bothering changing your default ssh port to another port, it will take a hacker all of 1 millisecond to find out what port you have changed to.

create a Private / Public Key pair on the computer that you use that you want to connect from
to do this type ssh-keygen
you will get the following response
Generating public/private rsa key pair.
Enter file in which to save the key (/root/.ssh/id_rsa):
hit enter to have your keys saved in /root/.ssh/ directory (this directory will be off the home directory of the user that you were when you ran the ssh-keygen command in my case i was the root user
next you will be asked if you want to create a pass phrase for the key
Enter passphrase (empty for no passphrase):
here you can enter a password , remember this password is for the key (should your local computer be compromised and someone steals your private key, they will still need to know what the password is)
or you can leave the password out, it is useful to leave the password out if you are using this technique to automate an ssh connection for the purpose of file transfer using a cron job ill explain how to do that in another posting)
once the key is created you need to transfer the public key to your server1.hq.org which after all is the server you want to secure. To do that enter the following
ssh-copy-id -i root/.ssh/id_rsa.pub username@server1.hq.org
were root/.ssh/ is the folder were your keys were saved to.
the ssh-copy-id command will transfer the public key to your server and save it into the correct folder,
you could manually use scp to copy the key accross but ssh-copy-id does it all for you and puts the key were it should be.

now you will be able to connect to your server without logging in, once connected to your server you need to edit your /etc/ssh/sshd_config file use your favourite editor to edit this file and add the stanza PermitRootLogin no
save your file, and then reload the sshd service by typing /etc/init.d/sshd reload this will load in the new settings from now on you have to connect to your server over ssh using a standard user account, once you are on the server you can sudo to the root user to perform admin tasks, the reason why we do this is in case a hacker decrypts the secure ssh password he will still only have access to a non privileged user account which is better than if they were to compromise your server with your admin password.

Forwarding Ports over SSH

lets say that the only access you have to a remote network is through SSH but you have an application that needs to securely access port 5901 on the remote network, (however this port is blocked to the outside world) SSH to the rescue. You can create a tunnel over SSH and then run your application and it will connect to the desired port by first being tunneled over your ssh connection

ssh -L 5901:remote-server:5901 user@ssh-remote-server

once the connection has been made over ssh and you have authenticated with your ssh password,
simply fire up your application that requires the remote port and point it to your localhost port 5901 and it will be tunneled over the ssh connection. in this example we tunneled vnc over ssh to make the connection
simply type vncviewer localhost:1

the remote server will think that the connection has been initiated from the local server on its network (the ssh server)

another example lets say you want to browse a web server on a remote machine through your local port 8080
ssh -L 8080:remote-server:80 user@ssh-remote-server
once you have authenticated on ssh, open up your browser and type http://localhost:8080 in your address bar, you will access the web-page of the remote server:80

the added advantage of doing this is that your tunnel is encrypted and traffic travelling between your local and remote machines is secure.

Access Control Lists (ACL's)

by Default only root user can assign permissions on Directories and Folders.
however if a standard user wants to allow access to a folder to one of his colleagues
you must use ACL Access control list

first off acl needs to be instated on the mounted file system that you want to allow users to manage their own permissions on, to do this edit your /etc/fstab file and make sure that that you add the acl option to the mount so that it looks something like this
/dev/hda /home ext3 defaults,acl 1 2

save your fstab file and force the Kernel to re-read its contents by typing
mount -a

this will read in the contents of your fstab file and remount all the file systems with the the new settings.

then for a standard user to give access to a certain folder they must use the setfacl command
so to give user2 read write access to /home/user1/projects folder user 1 would type
setfacl -m u:user2:rw /home/user1/projects

the m stands for modify. to remove permissions you would replace the m with an x and then simply state the folder you wanted permissions removed from
eg setfacl -x /home/user1/projects
you could set permissions to individual files as well not only directories
eg setfacl -m u:user2:rw /home/user1/projects/filename
you can set permissions using rwx notation as well for example
To deny a user acces to a file type the following
setfacl -m u:user2:---/home/user1/projects/filenameto give him read access only you can type the following
setfacl -m u:user2:r--/home/user/projects/filename

if you want to see what permissions exist on a certain folder
type getfacl /home/user1/projects

you should get a response similar to the following were you can see the added permissions for user 2
# file: home/user1/project
# owner: user1
# group: user1
user::rwx
user:user2:rw-
group::r-x
mask::rwx
other::r-x

To do the same to a samba share so that Windows users are controlled by the ACL
do the following

Add ACL support to a Partition:

1. vim /etc/samba/smb.conf
In share you want ACL support add: nt acl support = yes

2. To add access to a group to a folder:
setfacl -m g:GROUPNAME:rwx FOLDERPATH

OR To add access to a user to a folder:
setfacl -m u:USERNAME:rwx FOLDERPATH

3. Remove Permissions for others:
chmod 770 FOLDERPATH

4. Check permissions:
getfacl FOLDERPATH

5. Remove ACL:
setfacl -d acl-entry
ex: setfacl -d g:GROUPNAME FOLDERPATH

DMIDECODE

want to find out what type of memory a remote machine uses and what slots are available to upgrade?

use dmidecode,
dmidecode will dump the systems DMI contents in a human readable format , This information includes system manufacturer, model name, serial number, BIOS version, asset tag as well as a lot of other details of varying level of interest and reliability depending on the manufacturer. This will often include usage status for the CPU sockets, expansion slots (e.g. AGP, PCI, ISA) and memory module slots, and the list of I/O ports (e.g. serial, parallel, USB).

lets say a remote client wants to upgrade their memory and they call you to order more memory, but they have no idea if their machine takes dimms or simms or if it even has any available slots left you can simply ssh into their machine type 'dmidecode | less' at the command line and you will know exactly what memory the machine takes and what slots are free as well as a wealth of information about the other hardware attributes of the machine.

CHKCONFIG on Ubuntu

Ubuntu has got it's own tools for telling the system which services to automatically start at the different run levels, none of them unfortunately is chkconfig which happens to be my favourite tool on Red Hat derivative distributions if you are like me and like using what you are used to by typing the following into your bash shell you can use chkconfig instead of the Ubuntu tools.

$ apt-get install libnewt0.52
$ ln -s /usr/lib/libnewt.so.0.52 /usr/lib/libnewt.so.0.50
$ wget http://www.tuxx-home.at/projects/chkconfig-for-debian/chkconfig_1.2.24d-1_i386.deb
$ dpkg --force-all -i chkconfig_1.2.24d-1_i386.deb

usage of chkconfig is as follows

chkconfig --level 0123456 program_name on
will turn on program_name so that it starts up on all runlevels, this is a bad example since you would seldom want an app or service to run on runlevel 0 (shutdown) or run level 6 (reboot)

chkconfig --list

will show you a comprehensive list of all services / programs and what run levels they will start on.

another easy to use tool for editing runlevels is sysv-rc-conf

to install
apt-get install sysv-rc-conf

and then just type sysv-rc-conf
gives a very easy to use interface for managing your runlevel symlinks

Disable Caps Lock

The only time I use the caps lock button on my keyboard is when I accidentally press it and start typing in UPPERCASE. To disable it in Linux all you have to do is enter this on the command line:

 $ xmodmap -e "remove lock = Caps_Lock"

To set this permanently, paste the above line in your ~/.bashrc file

or if you are a vim user and you want to swap caps lock for your escape key

do the following

create the following file in your home directory

.Xkbmap

put the line below in the said file:
-option caps:swapescape

or if you don't want to swap the two keys around, instead you just want caps lock to behave the same as escape and escape key to still be the escape key.
Then put the following line in instead
-option caps:escape

The next time you log-in into an X session, the changes will take effect. Alternatively you can just run the command
setxkbmap`cat ~/.Xkbmap`
and the changes will take effect immediately.

POTHOLE OF THE MONTH - Luanda, Angola

UPnP

I spent today configuring my media server using Media Tomb on the WD My book world edition The WD my book world edition i must say is a very nice product and I am very pleased with it. UPnP sounded like something worth trying after reading how it is supposed to seamlessly and easily make all your media files available to the machines and other devices on your network, i was used to sharing my media files on the network and using the built in database (Library) of Windows media player on each machine to access my media but was hoping that by using UPnP my PDA, and later on my music center could seamlessly and easily access my media. My guests at home could access my media on their cell phones etc.

The server side of a media server is pretty straight forward to setup, their are also quite a few good programs available that will allow you to turn a PC or the WD my book hard drive into a media server. I posted a link in my previous blog on how to install Media Tomb. However its the client side so far that has disappointed me, since i thought that UPnP by nature should have shown up automatically as an option on all my media programs on all my devices and PCs on my network. At the very least windows media player would automatically and without effort see my UPnP stream ... well it didn't.
the only client program I had some success with was "Nero showtime" but not seamlessly or effortlessly. It seems that the standard hasn't been included into most media players.(i tried Core, VLC, Windows media player)

WD My Book World edition makes for a terrific media center and is a great product especially after you have performed some simple hacks to it. It has a Intel ARM processor and has Linux installed on a 2.5GB partition of the 1 terabyte Hard drive, so you could easily install a web server and use the WD Mybook as a fully functional Web or FTP server with 1 Terra Byte of Hard disk Space and for a lot cheaper that what it would cost you to purchase a PC. if I can only find a good client program to access my Media tomb UpNP stream I'd be plain sailing but I havent' so I'm pretty disappointed about that, I read that the PS3 works with it, I will try it out again when i upgrade my AV receiver to one that has a Gigabit Ethernet port and is able to use my UPnP Stream.

Enabling SSH access on WD My Book

With ssh you can connect to the WD My Book hard drive securely from anywhere in the world to access your media ...nice

this Hack I got from http://martin.hinner.info/ site. Martin is a Linux Guru Guru*
(Guru,Guru is one higher than just a plain Guru) I have my WD MyBook set-up in this configuration and it is has been an absolute lifesaver in times when I have been away from my media.

The process doesn't require hard drive dis assembly. It does not even require physical access to the drive. It works fine on every WD MyBook WE models (both I and II, capacities from 320GB to 2TB).

Spawning sshd

First of all you have to create a new user using standard web interface. SSH will not allow you to log-in as root without password.

Then enter this URL into your browser:

http://ip address of your my_book/auth/firmware_upgrade.pl?fwserver=martin.hinner.info/mybook/firmware.php

You should see a page that displays that "new firmware is available". (default username/password for MyBook is "admin"/"123456").

Click on "Click to download and install".

(Note: if you are interested how this works, click here).

Now you have to be patient, the whole process will take a while - not 30 minutes as stated on the firmware upgrade page, because you are not actually performing any upgrade. The "upgrade" process will generate ssh host keys. This takes maybe 1 or 2 minutes. Then root's password is reset (set to '') and finally, sshd process is spawned.

Please note that you will not be informed about the operation progress. Just try to log in using ssh after a few minutes to see if it has succeeded. When you find out that sshd is running, log in under the user you created in the first step. You should get the bash shell immediately. Then type "su -" (no password) to get the root shell.

Making sshd permament

In order to get ssh daemon running each time you power-up your MyBook, add the following line to /etc/inittab:

::sysinit:/usr/sbin/sshd

Now reboot your MyBook to see it if works.

Other recommendations

Get rid of mionet processes. as it allows "worldwide" data sharing, it's useless since you can install a web server or ftp server on your MyBook. Mionet is written in Java, which kills the arm processor on the mybook.

Consider also installing alternative web administration interface.

No firmware available bug

"No new firmware available" is caused by the failure of MyBook to fetch the upgrade script. Try to reboot MyBook and run the firmware upgrade process again.

MediaTomb UPnP streaming server on WD MyBook World Edition NAS

MediaTomb UPnP streaming server on WD MyBook World Edition

Question

In Skydiving, what is the purpose for the helmet ?

Tribute to Concorde

Today marks the Anniversary of the Concorde.
39 Years ago (today -9th January 1969) the British version of the
supersonic commercial plane made it's first test flight.

the last flight of the Concorde was on November 26th 2003.
ironically it landed on the same runway on its last flight as it took
off from on its first test flight in 1969 (Bristol)

Department of Agriculture

A Department of Agriculture representative stopped at a farm and spoke
to an old Boer.

'I need to inspect your farm.'

The old Boer said, 'OK Boet, but paali..se don't goes in that field over
there.'

The Rep said, 'Mister Boer, I have the authority of the Government with
me.

See this card? It means I am allowed to go WHEREVER I WISH on any
agricultural land

No questions asked or answered,' Have I made myself clear?

The old farmer nodded politely and went about his farm chores.

Later, the old farmer heard loud screams and saw the Agriculture Rep
running for the fence!

Close behind was the farmer's huge-horned prize bull.

The bull was gaining on the Rep with every step.

The Rep was clearly terrified, so the old Boer immediately threw down
his tools,

ran to the fence and shouted out.....

'Your card, Boet!

Your card!

Shows de fakin Bull jou card!'