" /> Braindump: novembre 2003 Archives

« octobre 2003 | Main | décembre 2003 »

novembre 26, 2003

Disk Usage of hidden files in a dir

Disk Usage FAQ

This will give you a list of non-hidden folders in the current directory, the number of KB used by each of them, and sort them by size. If you have very large hidden files/folders (files/folders starting with a dot (.) are considered hidden), then you can use this somewhat more complex command to get the same sort of list as before, except including hidden files:

/bin/ls -la | awk '{print $9}' | grep -v '^\.\./$' | grep -v '^\./$' | xargs du -sk | sort -n

better use du -sh then du -sk... it's more lisible

novembre 24, 2003

Mail server with Linux

NewsForge | Setting up server tools for spam- and virus-free mail interesting Article...

novembre 21, 2003

Envoie un email avec attachment du terminal

utiliser mutt (mutt.org) et entrer la commande suivante: mutt -n -F /dev/null -s "sujet" -a fichier.123 email@domaine.com < /dev/null

novembre 19, 2003

RPM error ou Apt-get

Si jamais : rpmdb: unable to join the environment error: db4 error(11) from dbenv->open: Resource temporarily unavailable error: cannot open Packages index using db3 - Resource temporarily unavailable (11) error: cannot open Packages database in /var/lib/rpm alors run this before running apt-get: export LD_ASSUME_KERNEL=2.2.5 c'est un probleme avec le kernel 2.6-test et rpm.

novembre 18, 2003

How To Create A Favicon

photo matt » How To Create A Favicon I’m going to make a confession: I can’t stand favicons. To clarify, I love the idea and the little icons on my Mozilla tabs are nifty, but I hate having to make them. This is partially due to working within the constraints of 16 by 16 pixels, but more so that until now I haven’t found a good way to generate said icons on Windows. I was jealous as a whip (can a whip be jealous?) when Noel posted instructions detailing how to do it on a Mac. For aforementioned reasons they weren’t applicable to me, so I set out to find a clean way to do this on Windows without spending any moolah. At this point someone is probably wondering what in the world a favicon is. As far as I know, it’s not a standard of any kind (and if it was it’d be a badly implemented one) but it’s a widely supported feature in modern browsers that allows a site to specify a small graphic or icon to go next to its address in the address bar and theoretically as the icon for the page when it is bookmarked as well. (Some examples of favicons.) I believe Internet Explorer was the first to implement this. Due to popular demand there is a new photomatt.net favicon (you may need to reload that link directly to see it). To see it in Internet Explorer, bookmark this site (which you should do anyway). In Mozilla and its progeny you should see it just fine automatically, and possibly in Safari though I don’t have that handy to test. To see it in IE for Mac you need to sacrifice an Intel CPU and do a favicon dance. Actually I’m not sure why IE5/Mac has trouble with some favicons, at some point in the past I tracked it down to MIME issues, but it’s not really worth the effort anymore. Another good reason to have a favicon.ico in the root of your site is some browsers request that file whether it is linked in your HTML or not, so if there’s nothing there it fills up your error logs. Since I watch error logs pretty closely this has always been an annoyance for me. So what’s the trick to creating lightweight multi-size favicons? I used to use the online java tool the folks at favicon.com offered, but now they seem more concerned with making money than providing free tools. More recently I’ve used Icon Forge which I can easily say is one of the most awful programs I have ever used in my life. Truly horrid. I wouldn’t recommend anyone do that, so here’s the process I came up with. (Any excuse to use a nested list.) 1. Download png2ico, which is a small, free utility for Windows, Linux, et cetera that works quite well. Extract it to c:/. 2. Create an image you’d like to use at a decent size (at least 32x32 pixels) in your favorite image editor. I like Photoshop so here’s what I did there: 1. Ctrl + N to start a new document. Choose 32x32 pixels for the size. Cram whatever you want to use in there, I choose a comic Josh did of me a while ago. 2. Do a Save for Web (Ctrl + Alt + Shift + S) and save it as a PNG with the filename icon-32.png to the same folder as the program you just downloaded (to keep things simple). If you want to keep the size down I would recommend taking it down to 16 colors. Don’t forget transparency if you need it. 3. Now go back and resize the image you’re working on to 16x16 pixels (Tools → Image Size [is there a shortcut for that?]) 4. Save this image as a PNG with the filename icon-16.png in the same directory as the above. 3. Now it gets a little tricky, open up the command line. Try Start → Programs → Accessories → Command Prompt. 4. Navigate to the folder where the png2ico.exe file is, if you followed the directions above you can use the command cd \png2ico. 5. Now you just have to enter a command to roll those two PNG files you made into one nice ICO file. Here you go: png2ico.exe favicon.ico --colors 16 icon-32.png icon-16.png . You may be able to use command line completion (pressing a letter or two and then tab) to fill some of that in for you. You could potentially embed 64x64 and 128x128 pixel sizes into the icon file by just specifying additional PNGs of that size, but for a web favicon that really isn’t needed. Just remember this if you ever want to make a nice application icon. For an applicatoin icon you’d probably want to use a PNG-24 with full alpha transparency, which this tool supports as well. 6. Now there should be an favicon.ico file in that same folder which you should upload to the root of your site and then link to it with something like 7. Have a drink. Now I know that sounds like a tricky process, but it’s actually not as hard as it may read and of course if you have any problems leave a comment and I’ll try to help you. There is supposedly a graphical front-end for using png2ico but it was so badly designed it’s actually easier to use the command line, as unlikely as that seems. Update: Ian has found my favicon twin. Where have you been all my life? Update 2: Oskar van Rijswijk recommends IrfanView in the comments. You might want to give that a try too.

Automating rsync with a Simple Expect Script

Automating rsync with a Simple Expect Script Expect is a great tool in a system administrators arsenal and can be used to easily automate tasks that require periodic user input. This can allow the administrator to make better use of their time than watching the application or utility to spot the next time it requires input. In the following example expect is used to automate the inputing of a password for a series of rsync commands tunneled through ssh. The script automates a series of rsync operations using only the password for access to the remote host so that the security of the two machines is not reduced by making the source machine trust the destination machine in any way (for example .rhosts or a ssh key with an empty pass phrase). The script reads a password from the user and then holds that password in a variable for use each time the ssh application that rsync is using as a tunnel asks for it. The "stty -echo" prevents the password from being echoed to the screen when it is typed in and the "stty echo" turns it back on. #!/usr/bin/expect -f spawn date expect "#" send_user "The password for HOSTNAME: " stty -echo expect_user -re "(.*)\n" {set PASSPH $expect_out(1,string)} send_user "\n" stty echo set timeout -1 spawn date expect "#" spawn rsync -ave ssh --numeric-ids HOSTNAME:/etc /sdc/ expect "password:" { send "$PASSPH\n"} expect "#" spawn date expect "#" spawn rsync -ave ssh --numeric-ids HOSTNAME:/admin /sdc/ expect "password:" { send "$PASSPH\n"} expect "#" spawn date expect "#" spawn rsync -ave ssh --numeric-ids HOSTNAME:/home /sdd expect "password:" { send "$PASSPH\n"} expect "#" spawn date expect "#" spawn rsync -ave ssh --numeric-ids HOSTNAME:/mail /sdd expect "password:" { send "$PASSPH\n"} expect "#" spawn date expect "#" spawn rsync -ave ssh --numeric-ids HOSTNAME:/work /sdc/ expect "password:" { send "$PASSPH\n"} expect "#" spawn date expect "#"

Voodoopad notetaker for OSX

Welcome to Flying Meat Software, home of VoodooPad

novembre 17, 2003

RendezVous setup

The Tao of Mac - blog/2003-11-16 Dancing With Rendezvous So here I am, trying to get my home network into shape, and fiddling around with Rendezvous to figure out how it works. I've had the source code to Apple's latest mDNSResponder sitting on my hard disk for a couple of weeks now, and after setting it up on my RedHat box I decided to get it working under Cygwin. 15 minutes later, I had mDNSResponderPosix running on my XP box under Cygwin. The port mainly consists of brutally hacking out IPv6? support (by studiously removing any references to AF_INET6) and hardwiring if_nametoindex() (which I can't find inside the Cygwin libraries) to always return 1 - I have only the one interface on that box, so this wanton hack works fine for me. (I do seem to have an outstanding issue with the XP port, since it does not advertise some services properly, but I'll check that later. It was a hack, anyway...) While configuring it on either XP or Linux, however, I came across a few interesting issues: * First off, the mDNSResponderPosix configuration file uses an amazingly dumb format. Sure, it's just sample code, but using ^A (Ctrl+A) to separate attributes is just too impractical to be of any real use, even for testing (mine now use semicolons as separators, at least until I find any conflicts). * You can't, in fact, use mDNSResponderPosix to advertise services for other machines - you have to use mDNSProxyResponderPosix, which requires a separate invocation for each service you want to advertise - i.e., no pretty configuration file either, and a non-trivial bunch of RAM wasted for each service. * Panther won't see your nice Rendezvous services if you have the firewall active. That's all well and good, until you realize there is no way to poke a UDP-based hole in your firewall using the GUI. Shame on you, Apple - users may want their firewalls simple, but definetly not dumb. * There is no comprehensive reference of Rendezvous configuration. I had to download Network Beacon and iRoster to understand a bit more about the services I could define and the parameters available. The good news is, it works. Panther picked up on SSH and HTTP services as soon as I added them to a Rendezvous responder, and I'm currently experimenting with SMB and AppleShare? services. Here's a little sample from my Linux box: # cat /etc/rendezvous.conf The Tao Of Mac _http._tcp. path=/ 80 Public CVS _http._tcp. path=/cgi-bin/cvs/index 80 zeus _ssh._tcp. none 22 The _http._tcp. services show up in the Safari Rendezous? menu, and the SSH service inside Terminal.app in the "connect to..." menu. The path attribute is the only one I know of so far, and its meaning is pretty obvious. I had to add none to the attributes line on the SSH entry to have mDNSResponderPosix parse the file at all, but your mileage may vary. And this is the first thing I don't like about Rendezvous - the lack of an attribute reference for each standard service. The other is the lack of a comprehensive way to set up non-local services - for instance, I might want to advertise a remote file server that is on another LAN without mucking about with mDNSProxyResponderPosix. Sure, Network Beacon does that flawlessly, but I want a generic UNIX daemon I can recompile for whatever I'm running, not a GUI app. There are some interesting possibilities I'll be exploring, like dynamically advertising URLs to the latest updated items on my blogroll. I've already discovered Python bindings for Rendezvous, and once I find the time to learn a bit more Python, I'll probably start with this Twisted-Python post. Time will tell, I guess. Now, back to our regularly scheduled programming.

novembre 14, 2003

Other OSX softwares (BBEdit and xScope)

The Iconfactory: Your Quality Freeware Icons Hub (xs_home.asp) "BBEdit":http://www.barebones.com/products/bbedit/index.shtml

novembre 12, 2003

Improving User Passwords with apg

ONLamp.com: Improving User Passwords with apg [Oct. 30, 2003] A few years back, I wrote about password policies and using a dictionary cracker to monitor compliance to a network's password policy. In today's article, I'll demonstrate an application from the ports collection that can assist users in choosing complex yet memorable passwords. The apg, or automatic password generator, intrigued me, since it supports the pwdgen protocol, defined by RFC 972. Yes, I know I need to get out more often, but I find it interesting that this protocol has been available since 1986, yet most people have never heard of it or had the opportunity to use it in a network. Let's install this application and see how useful it is: % cd /usr/ports/security/apg % make install clean The port will actually install three utilities: the apg client, the apgd server, and the Bloom filter manager, apgbfm. Each utility has an associated manpage, all chock-full of examples and useful URLs for additional reading. One of those URLs leads to NIST, the National Institute of Standards and Technology. NIST is known for its security best practices or FIPS (Federal Information Processing Standards). The other URL that is worth checking out explains that Bloom filter. In its simplest use, apg will generate six random passwords, in the hopes that one of them will appeal to you as a password choice. The passwords will be complex, meaning they won't be found by a dictionary cracker. To help make the passwords memorable, include the t switch, which will show you how to pronounce the generated passwords. Here's an example: $ apg -t UlmIrrors1 (Ulm-Irr-ors-ONE) ziadrotAw (zia-drot-Aw) FoacodCurt (Foac-od-Curt) wroztAm1 (wrozt-Am-ONE) HeudIfpyd9 (Heud-If-pyd-NINE) BeshDaftem (Besh-Daft-em) By default, apg creates passwords of eight to 10 alphanumeric characters, using both upper and lower case. However, you can use additional switches to conform to any password policy. For example, to force the inclusion of symbols: $ apg -MS -t loce>fruo (loc-e-GREATER_THAN-fruo) afmisbol: (af-mis-bol-COLON) pamob(ocon (pam-ob-LEFT_PARENTHESIS-oc-on) swotbuad# (swot-bu-ad-CROSSHATCH) naynalwak) (nayn-al-wak-RIGHT_PARENTHESIS) cravser- (crav-ser-HYPHEN) To ensure that each password is 14 characters long, specify 14 as both the minimum (-m) and maximum (-x) length: $ apg -MS -m14 -x14 -t If your password policy insists on truly random passwords that aren't pronounceable, use -a1 instead of -MS: $ apg -a1 -m14 -x14 V/u|X@/qO%y;`r ux:S};"JRCf]I8 LLV5lb!WY5qH!9 -vUY&x6Lj+:IO^ m(X2R.I`C2["Mi jO%H3w1ZMRnZTj Hmmm. I think I'd better stick with the pronouncable passwords. apg also supports the ability to check the randomly generated passwords against either a dictionary file or a Bloom filter file. If it happens to create a random password that is found in either file, it will scrap it and generate another password. Your FreeBSD system comes with the dictionary file /usr/share/dicts/words. If this file isn't on your particular system, you can install it by going into /stand/sysinstall, choosing configure and then distributions, and selecting dict. This file is alphabetical and in ASCII text, meaning you can add your own words. It's common to add words like: R00t r00t r00T and so on, since the words are case-sensitive. It is recommended that you spend some time adding the words you don't want showing up as passwords in your network. Once you're finished, configure apg to double-check against your dictionary file by using the -r switch and specifying the name of the file: $ apg -MS -m14 -x14 -t -r /usr/share/dict/words Also in FreeBSD Basics: Cleaning and Customizing Your Ports portupgrade Ports Tricks SMTP Proxies HTTP Proxies Even better, take the time to create a Bloom file. This will require you to specify both the name of the dictionary and the desired name of the generated Bloom file: $ apgbfm -d /usr/share/dict/words -f ~/bloomfile Counting words in dictionary. Please wait... This command can be run as a regular user. In this instance, I chose to create the Bloom file in my home directory. Once the file is generated, use the -b switch to tell apg where the Bloom file is located: $ apg -MS -m14 -x14 -t -b ~/bloom If you try both the -r switch and the -b switch with apg, you'll find that the Bloom file is much quicker, as it uses an algorithm to determine whether or not the password would be found in the dictionary file. The last switch I'll mention is the -s, or seed, switch. This switch is recommended, as it gives the random number generator a seed to work with: $ apg -MS -m14 -x14 -t -b ~/bloom -s Please enter some random data (only first eight are significant) (eg. your old password):> jasvafwabvoud, (jas-vaf-wab-voud-COMMA) rhylpoj:oruch~ (rhylp-oj-COLON-or-uch-TILDE) dibogcewbowug{ (dib-og-cewb-ow-ug-LEFT_BRACE) abun`frelfoksi (ab-un-GRAVE-frelf-oks-i) dircunittanas" (dirc-un-itt-an-as-QUOTATION_MARK) rhaph"drockeet (rhaph-QUOTATION_MARK-droc-keet) Notice that these passwords are quite complicated, but still fairly pronouncable. For those of you who prefer GUI-based utilities, the apg author has also released the tkAPG front end. There isn't a port for this utility, but it is easy enough to install on your FreeBSD system. Grab the source. Once you've downloaded the file, untar it and cd to the newly created directory: $ tar xzvf tkapg-0.0.2a.tar.gz $ cd tkapg-0.0.2a This directory contains a README and a script file called tkapg. Open the script in your favorite editor, and change this line: exec wish "$0" "$@" to: exec /usr/local/bin/wish8.3 "$0" "$@" Once you've saved the changes, go to an X Window session, open an xterm, cd into the tkapg-0.0.2a directory, and type: $ ./tkapg A little GUI will pop up, allowing you to generate random passwords. I found the GUI to be a bit slower than the command line. It also didn't offer each switch possibility. However, take the time to check it out, as it may meet your password generation needs. If you decide to stick with the command line, you may want to create a shell script so you don't have to remember to type in all of your options. Here, I've modified the suggestion from man apg to include my desired options: $ vi ~dlavigne6/bin/pwgen.sh #!/bin/sh apg -MS -m14 -x14 -t -b /usr/home/dlavigne6/bloom -s Once I save this file, I need to make it executable: $ chmod +x ~dlavigne6/bin/pwgen.sh When I want to generate random passwords, I simply type: $ pwgen.sh If you want to test your script right away and you use the C shell, type rehash so it will find your new executable. Another alternative is to create an alias. Since I only plan on using apg from one machine and I'm always in the C shell, I added this line to ~/.cshrc: $ alias apg /usr/local/bin/apg -MS -m14 -x14 -t \ -b /usr/home/dlavigne6/bloom -s Now, whenever I type apg, it automagically uses all of my desired switches. Again, if you want to test your alias right away, tell the C shell to reread its configuration file: $ source ~dlavigne6/.cshrc Up to this point, we've concentrated on the apg client, meaning we haven't actually used the pwdgen protocol yet. Like any TCP/IP protocol, pwdgen requires both a client component and a server component. The job of the server component is to listen for client requests on its well-known port. To determine what port that is: $ grep pwdgen /etc/services pwdgen 129/tcp #Password Generator Protocol pwdgen 129/udp #Password Generator Protocol This service is started by the inetd daemon, meaning you'll need to edit /etc/inetd.conf as the superuser so that it includes this line: pwdgen stream tcp nowait root /usr/local/sbin/apgd apgd Once you've saved your change, simply type inetd to start the service. Alternatively, if you already have inetd listening for other services, inform it of your changes by typing: % killall -1 inetd This command should show inetd listening on TCP port 129: % sockstat -4 USER COMMAND PID FD PROTO LOCAL ADDRESS FOREIGN ADDRESS root inetd 92412 4 tcp4 *:129 *:* The advantage of using apgd is that you don't have to install the apg port on each user's computer. As users need to generate random passwords, they simply connect to port 129 on the apgd server. In this example, apgd is running on a server with an IP address of 10.0.0.1: $ telnet 10.0.0.1 129 Trying 10.0.0.1... Connected to 10.0.0.1. Escape character is '^]'. AilEjmacGa yotgakki DrehojOird yejBabif albEifia jolnapt6 Connection closed by foreign host. Notice a few things here. One, don't panic over the telnet word. The insecure telnet service isn't running on 10.0.0.1. Instead, I've used the telnet client to make a direct connection to the pwdgen port of 129. In essence, telnet is acting as the apg client. Second, using this method, the user has no control over the options used by apg, as they are pre-configured on the server. Depending upon your security policy, this may be seen as a bonus, as users won't be able to generate non-compliant passwords. Let's take a closer look at that generated output. Remember, when I added my line to /etc/inetd.conf, I didn't include any switches to apgd. This means that I received the default of eight to 10 alphanumeric characters with no symbols. Also note the lack of the pronunciation guide, since I didn't include -t in my inetd entry. I should probably change that entry to include the switches applicable to my network's password policy: pwdgen stream tcp nowait root /usr/local/sbin/apgd \ apgd -MS -m14 -x14 -t -b /usr/local/etc/bloom Notice that that is now one very long line (wrapped for the sake of this article). Make sure you don't use an editor that tries to turn it into two lines. I've also created a Bloom file in a directory that is accessible to all users, rather than in one particular user's home directory. Notice also the lack of the -s switch; unfortunately, this option is not available with apgd. Finally, I also have to remember to inform inetd of the changes: % killall -1 inetd Now, when a user connects to the apgd server: $ telnet 10.0.0.1 129 Trying 10.0.0.1... Connected to 10.0.0.1. Escape character is '^]'. yeog-flaysdok: (ye-og-HYPHEN-flays-dok-COLON) caijpyfratcef| (caij-py-frat-cef-VERTICAL_BAR) ajyafdiwubaig] (aj-yaf-di-wub-aig-RIGHT_BRACKET) nohoktegrogib( (no-hok-te-grog-ib-LEFT_PARENTHESIS) nobkarcyonnip= (nob-karc-yonn-ip-EQUAL_SIGN) hirkadlarjiaf[ (hirk-ad-larj-iaf-LEFT_BRACKET) Connection closed by foreign host. If you decide to use the apgd server, you can also modify /etc/syslog.conf so it will keep track of when users use this service. Let's see what happens if I add these lines to the bottom of /etc/syslog.conf: !apgd *.info /var/log/apgd.log To inform syslog of these changes: % killall -1 syslogd Oct 19 12:40:36 syslogd: /var/log/apgd.log: No such file or directory Oops. I forgot to make that log file: % touch /var/log/apgd.log % killall -1 syslogd Next, I'll test the results by connecting to the apgd: $ telnet localhost 129 and then checking out the entry in the log: % more /var/log/apgd.log Oct 19 12:43:01 genisis apgd[92692]: password generation request from 127.0.0.1.49334 While not the most descriptive log entry, I do have a record of which IP address, in this case the localhost, used the pwdgen protocol and at what time. This should get you started on generating random passwords. If you plan on trying this on your own system or in a very small network, you may prefer to install the apg port on each computer. For a larger network, install and configure apgd on one of your servers and instruct your users how to connect to port 129. In the next article, I'll take a look at the science of stenography and some proof-of-concept utilities in the ports collection. Dru Lavigne is an instructor at Willis College in Ottawa. In her non-existent spare time, you can find her shooting Remic's Rapids or cycling through Gatineau Park.

CVS for All

CVS homedir Joey shows you how to keep track of everything with CVS. I keep my life in a CVS repository. For the past two years, every file I've created and worked on, every e-mail I've sent or received and every config file I've tweaked have all been checked into my CVS archive. When I tell people about this, they invariably respond, ``You're crazy!'' After all, CVS is meant for managing discrete bodies of code, such as free software programs that are worked on and available to a lot of people or in-house projects that are collaboratively developed by several employees. CVS has a reputation of being a pain to deal with, and it has a lot of crufty bits that regularly drive users up the wall, like its mistreatment of directories. Why inflict the pain of CVS on yourself if you don't have to? Why do it on such a scale that it affects nearly everything you do with your computer? I get three major benefits from keeping my whole home directory in CVS: home directory replication, history and distributed backups. The first of these is what originally drove me to CVS for my whole home directory. At the time, I had a home desktop machine, two laptops and a desktop machine at work. Rounding this out were perhaps 20 remote accounts on various systems around the world and many systems around the workplace that I might randomly find myself logging in to. I used all of these accounts for working on the same projects and already was using CVS for those projects. I'm a conservative guy when it comes to my computing environment (I've used the same wallpaper image for the past five years), and at the same time I'm always making a lot of little tweaks to improve things. Whenever I go to work and something wasn't just like I had tweaked it the night before, I'd feel a jarring disconnect, and annoyingly copy over whatever the change was. When I sat down at some other system at work, to burn a CD perhaps, and found a bare Bash shell instead of the heavily customized environment I've built up over the past ten years, it was even worse. The plethora of environments, each imperfectly customized to my needs by varying degrees, was really getting on my nerves. So one day I cracked and sat down and began to feed my whole home directory into CVS. It worked astonishingly well. After a few weeks of tweaking and importing I had everything working and began developing some new habits. Every morning (er, afternoon) when I came into work, I'd cvs up while I read the morning mail. In the evening, I'd cvs commit and then update my laptop for the trip home. When I got home, I'd sync up again, dive right back into whatever I'd been doing at work and keep on rolling until late at night--when I committed, went to bed and began the cycle all over again. As for the systems I used less frequently, like the CD burner machine, I'd just update when I got annoyed at them for being a trifle out of date. It only took a few more weeks before the advantage of having a history of everything I'd done began to show up. It wasn't a real surprise because having a history of past versions of a project is one of the reasons to use CVS in the first place, but it's very cool to have it suddenly apply to every file you own. When I broke my .zshrc or .procmailrc, I could roll back to the previous day's or look back and see when I made the change and why. It's very handy to be able to run cvs diff on your kernel config file and see how make xconfig changed it. It's great to be able to recover files you deleted or delete files because they're not relevant and still know you've not really lost them. For those amateur historians among us, it's very cool to be able to check out one's system as it looked one full year ago and poke around and discover how everything has evolved over time. The final major benefit took some time to become clear. Linus Torvalds once said, ``Only wimps use tape backup: real men just upload their important stuff on FTP and let the rest of the world mirror it.'' I'm not a real enough man to upload my confidential documents to ftp.kernel.org though, so I've been wimping along with backups to tape and CD and so on. But then it hit me: take, for example, one crucial file, like my .zshrc or sent-mail archive: I had a copy of that file on my work machine, and on my home machine, and on my laptop and several other copies on other accounts. There was another copy encoded in my CVS repository too. I'm told that the best backups are done without effort--so you actually do them--and are widely scattered among many machines and a lot of area so that a local disaster doesn't knock them out. They are tested on a regular basis to make sure the backup works. I was doing all of these things as a mere side effect of keeping it all in CVS. Then I sobered up and remembered that a dead CVS repository would be a really, really bad thing and kept those wimpy backups to CD going. But the automatic distributed backups are what keep me sleeping quietly at night. Later, when I left that job, the last thing I did on my work desktop machine was: cvs commit ; sudo rm -rf /. And I didn't worry a bit; my life was still there, secure in CVS. A full checkout of my home directory with all the trimmings often runs about 4GB in size. A lot of that will be temporary trees in tmp/ and rsynced Ogg Vorbis files (so far, I have not found the disk space to check all of them into CVS). My CVS repository currently uses less than 1GB of space, though it is steadily growing in size. I keep some 13,000 files in CVS, and so a full CVS update of my home directory is a sight to see and takes a while. These days I'm often stuck behind a dial-up connection, and I mostly just use one laptop, so I might go days between CVS updates. Other better-connected systems have automatic CVS updates done via cron each day. I cvs commit whenever I want to make a backup of where I am in a file or when I am at the point of releasing something. I still also do a full commit of my home directory every day or so. I confess that some of my CVS commit messages are less than informative--``foo'' has been used far too many times on some classes of files. I even do some automatic CVS commits; for example, my mailbox archives are committed by a daily cron job. There are other benefits of course. I attend many tradeshows and other events that require me to sit down at some computer out of the box, use it for an hour or a day and never see it again. I can check out the core of my CVS home directory in about five minutes, and after that it is just as comfortable as if I'd SSH'd home and was doing everything there. I even get my whole desktop set up in that five minutes. In a chaotic tradeshow environment, there is nothing more reassuring than having your familiar computer setup at your fingertips as you demo things to the hordes of visitors. Keeping your home directory in CVS is not all fun though. Anyone who's used CVS in a large project probably has had to resolve conflicts engendered by two people modifying the same file. At least you can curse the other guy who committed the changes first while you deal with this annoying task. Most of you have probably not had to resolve conflicts between the file you modified at home and at work, then cursing at yourself. Then there are CVS's famous problems: poor handling of directories and binary files. The nearly nonexistent handling of permissions, which is not a big deal in most projects but becomes important when you have a home directory with some public and some private files and directories in it. A slow, bloated protocol, hindered even more by the necessity of piping it all over SSH; the pain of trying to move a file that is already in CVS, or much worse, a whole directory tree, again hits you especially hard when you're using CVS for the whole home directory. And those damn CVS directories are always cluttering up everything. I've developed means of coping with all of these to varying degrees, but like many of us, I'm hoping for a better replacement one day (and dreading the transition). Perhaps it's time that I get down to the details of how I organize my home directory in CVS. I've always managed my home directory with an iron hand, and CVS has just exacerbated this tendency. Let's look at the top level: joey@silk:~>ls CVS/ GNUstep/ bin/ debian/ doc/ html/ lib/ mail/ src/ tmp/ Yes, that's it. Well, except for the 100-plus dot files. Most people use their home directory as a scratch space for files they're working on, but instead I have a dedicated scratch directory, the tmp directory, which I clean out irregularly. In general, when I start a new file or project, I will be checking it into CVS soon, so I begin working on it in the appropriate directory. This document, for example, is starting its life in the html directory and will be checked into CVS soon to live there forever. Of course, sometimes I goof up and then I have to resort to the usual tricks to move files in CVS. And so the first rule of CVS home directories is it pays to think before starting and get the right filename and location the first time. Don't be too impatient to check in the file. CVS is a great way to ensure that you have a nice, clean, well-managed home directory. Every time I cvs update it will helpfully complain to me about any files it doesn't know about. Of course, I make heavy use of .cvsignore files in some directories (like tmp/). If I go to another machine, the home directory looks pretty much the same, though various things might be missing: joeyh@auric:~>ls CVS/ GNUstep/ bin/ tmp/ I use this machine for occasional specific shell purposes. I don't administer the system, so I don't want to put private files there. The result is a much truncated version of my home directory. It's perfectly usable for everything I normally do on that machine, and if I want to, say, work on this document there at some point, I can just type cvs co html and a password and be on my way. The way I make this partial-checkouts system work is by using CVS modules and aliases. I have modules defined for each of the top-level directories and for the home directory (dot files) itself. For example, the entry in my CVSROOT/modules file for the stripped-down version of my home directory looks like this: joeyh -u cvsfix -o cvsfix joey-cvs/home &bin For more complete home directories, I use this instead: joey -u cvsfix -o cvsfix joey-cvs/home &src &doc &debian &html &lib &.hide &bin &mail Notice the .hide module. It results in a ~/.hide directory when I check it out. This directory is where I put the occasional private file that I don't want to appear in home directories--like the one on auric--that are on systems not administered by me. The files in .hide get hard-linked to their proper locations if .hide is checked out, so I can put confidential dot files in there and only check those dot files out on trusted systems. I also have, for example, my Mozilla cookies file in .hide. It's important to distinguish between such files that I need to put in .hide and the entire set of private directories, like my mail directory. Yes, I keep my mail in CVS (except for just-arrived spooled mail, which I keep synced up with a neat little program called isync that is smarter about mail than CVS is). But it's all in its own mail/ directory, so I can omit checking that directory out to systems that I don't trust with my mail or that I don't want to burden with hundreds of megabytes of mail archives. While I'm discussing privacy issues, I should mention that I make some bits of my home directory completely open to the public. This includes a lot of free software in debian/ and src/, and some handy little programs in bin/. This is accomplished by permissions. I have to make sure that most directories in the repository (or at least the top-level directories like mail/) are mode 700, so only I can access them. Other top-level directories, like bin/, are opened up to mode 755. This allows anonymous CVS access and browsing at cvs.kitenet.net/joey-cvs/bin/. This leads to the second rule of CVS home directories: don't import $HOME in one big chunk; break it up into multiple modules. The structure of your repository need not mirror the structure of your actual home directory. Modules can be checked out in different locations to move things around and control access on a per-module level. There's a layer of indirection there, and such layers always make things more flexible and more complex. Some of the projects I work on have their own CVS repositories that are unconnected to my big home directory repository. That's fine too; I simply check them out into logical places in my home directory tree as needed. CVS can even be tweaked to recurse into those directories when updating or committing. Another thing to notice in those lines from my modules file is the use of -u cvsfix to make the cvsfix program run after CVS updates. That program does a lot of little things, including ensuring that permissions are correct, setting up the hard links to files in .hide and so on. One last thing to mention is the issue of heterogeneous environments and CVS. Most of my accounts are on systems running varying versions of Debian Linux on a host of different architectures, but there are accounts on other distributions, on Solaris and so forth. Trying to make the same dot files work on everything can be interesting. My .zshrc file, for example, goes to great pains to detect things like GNU ls, deals with varying zsh versions, sets up aliases to the best available editor and other commands and so on. Other programs, like .xinitrc, check the host they're running on and behave slightly (or completely) differently. I've even at one point had a .procmailrc that filtered mail differently depending on hostname, though the trick to doing that is lost somewhere in one of the innumerable versions stored in my repository. I've even resorted in a few places to files with names of the form filename.hostname--cvsfix finds one matching the current host and links it to the filename. Branches are also a possibility, of course, but despite my heavy use of CVS, I still find some corners of it a black art. Well I guess that's it. I'd be happy to hear from anyone else who keeps their home directory in CVS, especially if you have some tricks to share. In the future I'd like to try checking /etc into CVS too, and if you've successfully done this, I'd love to talk with you. Now I'm off to commit this file. Joey Hess (joey@kitenet.net) is a longtime Debian developer who lives on a farm in Virginia. He enjoys finding new and unlikely places from which to commit code wirelessly to CVS.

novembre 11, 2003

PSMON

SourceForge.net: Project Info - PSMON - Process Monitoring Daemon psmon is a *NIX process monitoring daemon which may optionally be run as a standalone program. Allows slaying and respawning of critical processes which die, or exceed pre-determined TTL, concurrent instances and or memory or CPU usage. I should probably explain myself a little better in the man pages for the combined use of --daemon and --cron. Will update it over the weekend I think. If you psmon as a daemon, (psmon --daemon), then it will report to the local console telling you that it's being launched in to the background. If you try and start it as a daemon, but it is already running as a daemon, then it will tell you not to be so silly, and will quit. Now,... what I usually do, is get psmon to start up as a background daemon from cron every 5 minutes or so. That way, is psmon has died for any reason, it will start up again. If it was still already running, then that's fine, because it will just quit and leave the existing instance running. The only problem with that, is that you will get an email from cron every 5 minutes, when psmon reports that it's quitting because it is already running (unless you redirect the output, which I think is nasty and evil). .... soooo ... you can use the --cron option, which will surpress the "psmon is already running as a background daemon" messages that are displayed when trying to launch psmon as a background daemon. If it finds that psmon is *NOT* already running, and it *DOES* in fact start up again as a background daemon, then those messages are still displayed, thus you get an email notification from cron telling you as such.

System management tools

System Management

novembre 10, 2003

Redhat Installation Interface

run redhat-config-packages from Terminal windows (as root)

Kill -s signal processnum

Signal Value Action Comment or death of controlling process SIGINT 2 Term Interrupt from keyboard SIGQUIT 3 Core Quit from keyboard SIGILL 4 Core Illegal Instruction SIGABRT 6 Core Abort signal from abort(3) SIGFPE 8 Core Floating point exception SIGKILL 9 Term Kill signal SIGSEGV 11 Core Invalid memory reference SIGPIPE 13 Term Broken pipe: write to pipe with no readers SIGALRM 14 Term Timer signal from alarm(2) SIGTERM 15 Term Termination signal SIGUSR1 30,10,16 Term User-defined signal 1 SIGUSR2 31,12,17 Term User-defined signal 2 SIGCHLD 20,17,18 Ign Child stopped or terminated SIGCONT 19,18,25 Continue if stopped SIGSTOP 17,19,23 Stop Stop process SIGTSTP 18,20,24 Stop Stop typed at tty SIGTTIN 21,21,26 Stop tty input for background process SIGTTOU 22,22,27 Stop tty output for background process

novembre 04, 2003

Linux Security

Here's how to disable Linux services, according to Dennis: * First, find them: netstat -nlp -inet * Next, disable them: chconfig $SERVICE off * To edit them: inetd.conf OR xinetd.d/* * Finally, double-check with: nmap (from remote machine) You can restrict access in several ways: * Bind services to specific interfaces, via their config files * Use the hosts.allow command * Implement belts and suspenders such as ipchains, iptables, and ipfwadm Bastille, Tripwire, AIDE, and Samhain You should also run Bastille — an interactive lockdown/hardening script — assuming that it supports the distro you're using. Currently, Bastille provides support for Red Hat, SuSE, Debian, Mandrake, and TurboLinux distros of Linux, along with HP-UX and Mac OS X. "Bastille Linux provides feedback to administrators about security during installation. The focus is on proper configuration," concurs Spire Security's Lindstrom. As opposed to configuration issues, most other approaches to vulnerabilities today focus on software bugs, he says. Dennis considers Tripwire — a long-standing security solution — to be rather antiquated, in comparison to the newer AIDE. He recommends the installation of both AIDE and Samhain, an open source security project from Lunapark that includes a network console, stealth option, and LDAP authentication. 'Jail Services' and Other Firewalls Virtually no one would dispute the merits of network firewalls with packet detection. For added layers of protection, though, Dennis advises the use of "jail services" such as chroot, Linux capabilities (Lcap), User Mode Linux (UML), VMware, and dedicated hardware. "You can think of all of these as firewalling processes, too. One caveat, though, is that chroot isn't root safe. Also, UML and other VMs may cost too much in [terms of] performance," he adds. Get Rid of Deprecated Protocols You should also swap out older and less secure "deprecated protocols" with newer alternatives, says Dennis, who suggests the following replacements: Protocol Alternative POP/IMAP POPS/IMAP (SSL) telnet ssh/scp/sftp rdist rsync -e ssh NIS resync /etc/passwd.group) LDAP over SSL NFS Still a question mark No Panacea for Cryptography Available cryptographies include FreeS/WAN, Kerberos, OpenSSH, and several more. As Dennis sees it, each still has pros and cons. For example, FreeS/WAN, a freeware edition of IPSEC VPNs, "potentially secures deprecated protocols." It is also interoperable with other IPSEC implementations. On the other hand, FreeS/WAN is "NAT hostile," he charges. Lindstrom also doesn't detect any type of panacea out there for cryptography. "It is nice to know that there is a freeware version of IPSEC VPNs. But the problem of encryption adoption isn't the dollar cost. It's the management and performance issues," Lindstrom maintains. Security Is Nothing Without Physical Side Without solid physical security, even the most battened down OS can be compromised in an instant. "Physical security really depends on the situation," Lindstrom says. "Laptops should be under lock and key when not in the user's possession. Sensitive data should be locked up in data centers or other appropriately controlled areas. Access to and from these rooms should be controlled and monitored. Environmental controls should be in place to protect against disasters. Locking I/O devices such as keyboards and monitors is a good idea."

novembre 02, 2003

Rouler des applications X remote avec Cygwin

Par exemple sur la station rouler: -startx ensuite: xhost 172.x.x.x pour ajouter la machine remote ensuite sur la machine remote apres s'être connecté par ssh: DISPLAY=hostworkstation:0 ; export DISPLAY