moving to ubuntu – Grey Panthers Savannah

Living on the edge with Ubuntu

gpanther — Fri, 06 Jun 2008 09:16:00 +0000

As I said earlier, I’m not very impressed with Ubuntu 8.04 (hardy), but I’ll give it an other chance. There are some rumors floating around that July 10 there will be some major updates and the steady stream of updates seem to fix a few issues as well.

Warning! Don’t do this if you can’t support eventual breakage and/or your system is critical!

If you wish to keep up with the latest updates to the packages, even if they are not released to the public at large, go to System -> Administration -> Software Source and on the Updates page check Pre-released updates. This allowed me to get Firefox 3 (instead of b5) for example. However be ready to drop down to the terminal and do some apt-get update / apt-get upgrade / dpkg-reconfigure.

Small Qemu tips

gpanther — Sun, 13 Apr 2008 19:29:00 +0000

It’s official: Ubuntu has the best documentation out there. There is almost no problem for it you can’t fix by typing "Ubuntu [description of the problem]" or "Ubuntu [error message]" in your favorite search engine.

For example, here you can find a very exhaustive documentation on installing Qemu and Kqemu (the Kqemu part is the really interesting one).

One interesting part it doesn’t explain is the "-localtime" switch (although it is correctly used in the examples). This switch tells Qemu to set the clock of the virtual machine to the local time rather than the UTC (also known as GMT) time. This is important because Windows and Linux have two different philosophies regarding the meaning of the BIOS (battery powered) clock: Linux thinks that it represents the UTC/GMT time and uses the specified time-zone to calculate the local time from it whenever needed, while Windows (and DOS) thinks that it should represent the local time and uses the time-zone to calculate the GMT time whenever needed (this is why dual-booting is problematic unless both OS’s use a network service to synchronize their time and/or you tweak Linux to set the BIOS clock to the local time). In conclusion: if you are running a Windows/DOS guest with Qemu from Linux, don’t forget to specify the "-localtime" switch.

And the last tip: Qemu recently moved from CVS to SVN. The new checkout command to obtain the source code is:

svn checkout http://svn.savannah.gnu.org/svn/qemu/

or if you are interested just in the trunk (not the branches and tags:

svn checkout http://svn.savannah.gnu.org/svn/qemu/trunk/

In case you don’t have Subversion installed (which is the case by default on Ubuntu) and you are running a Debian based system, it can be resolved with:

sudo apt-get install subversion

Update: changed sv to savannah to be correct (sv seems to deliver a 301 which svn doesn’t seem to handle)

Power management for Ubuntu

gpanther — Wed, 29 Aug 2007 16:04:00 +0000

I was praising Ubuntu earlier for its great hardware support. One thing it didn’t have out of the box however (which is a very nice feature of modern hardware) was dynamic frequency scaling. There is a detailed description over at the Ubuntu Guide wiki which worked nicely (yes, you actually need to remove packages – the instructions are correct). You can also add a widget (just search for CPU in the widget list) which shows the current frequency. I would recommend the conservative power scheme which Sets the CPU depending on the current usage. It differs in behaviour in that it gracefully increases and decreases the CPU speed rather than jumping to max speed the moment there is any load on the CPU. This behaviour more suitable in a battery powered environment..

Setting up Xming or RDP equivalent for Linux

gpanther — Wed, 29 Aug 2007 09:27:00 +0000

To give a little background: the GUI under Linux (and Unix) is usually distributed the following way:

X (the short term commonly used for X Windows System or X11) – this knowns how to draw some primitive elements (like boxes, text, etc) and to get input (from keyboard, mouse, etc) and also has the primitive notion of windows (rectangular, possibly overlapping areas of the screen), but doesn’t know much more than that (it doesn’t know for example about title bars, how to move windows around, etc)
The window manager (like Gnome, KDE or XFCE just to name a few) which uses these primitives to draw more advanced widgets (like icon lists for example), provide additional functionality (moving around the windows, minimizing / maximizing them, etc) and other graphical elements (panel elements – aka gadgets – for example)

The communication between these two components is done through sockets with a well defined protocol. Isn’t this inefficient? – one could ask. The answer is – not really, because most of the time (more specifically, when X is running on the same machine as the the window manager, a special kind of socket is used called Unix domain socket. These look like normal sockets in the sense that data I/O is represented by a stream of bytes and it has similar guarantees to TCP (guaranteed, in-order delivery), but is optimized so that the data doesn’t have to flow through the TCP/IP stack twice (once at the sending and once at the receiving end) as it would if you would to use a TCP/IP connection to localhost. Windows has a similar architecture where the GDI functions (which are at a similar abstraction level to X – they only know about lines, rectangles, etc) use an IPC (Intre-Process Communication) mechanism to communicate with the Windows subsystem which in turn calls the display drivers.

The only difference between *nix and Windows is that in Windows this modularization was never made explicit and/or documented. This system means that we can execute the drawing instructions on a remote computer (simply by using a TCP/IP socket instead of a Unix domain socket) and we get a very responsive remote deskop for free. It is responsive because instead of transmitting the bitmap that has to be drawn pixel by pixel, it only transmits the primitive instruction needed to draw it (of course there are corner cases, for example if you’re doing image editing with GIMP).

The simplest to use X for Windows is Xming. To set it up you first need to have SSH access to the computer which will be the target (the one actually running the applications). Again, you can observe the modularity present in *nix systems – reuse existing components, which means faster development (because you don’t have to write it from scratch), better quality (because you don’t have to write something which isn’t your core competency) and easier use (because the user can reuse her/his knowledge of the components when configuring different parts of the system). Also, in the case of a vulnerability a central patch can secure multiple systems (there is reverse of this coin of course: sometimes the user isn’t aware of all the dependencies of such systems, which means that s/he can follow the relevant forums for all of them to stay informed about the needed updates).

There is a nice tutorial over at terminal23.net about setting up the SSH daemon under Ubuntu, complete with advice on how to block brute-force attempts and how to restrict access to a certain subset of IP addresses. I would like to add a couple more things:

You can (and should – defense in depth is a good thing) restrict the access to your SSH daemon from the firewall too. While the temptation is big to leave it wide open because one never knows when I need to access it from an other network, my experience has been that the number of places where one needs access from is very limited. Give /24 (or /16) subnets access if you’re worried that your IP may change (for example cable providers usually have static IP, but they don’t make this explicit, which means that they can change the IP whenever they wish, but it is very unlikely that they will change it outside of the current /24 range). If you don’t want to play around with iptables, you can use Firestarter to do it graphically (sudo apt-get install firestarter).
If you have multiple interfaces on your computer (which is not as rare as it was some time ago – for example you could have a wired and a wireless interface. Also you can have VPN pseudo-interfaces) make sure to instruct the SSH daemon to listen only on the interfaces where it’s truly needed. You can do this by editing the /etc/ssh/sshd_config file and specifying the correct ListenAddress directives. You could instruct it to listen on a different port (as an additional security measure). If you do so, do not forget to alter your firewall configuration. Also take into consideration what ports will likely be blocked / allowed in the environments you need access from.
Do not forget to check if there exists a Protocol 2 directive in your /etc/ssh/sshd_config file and no Protocol 1 or Protocol 1,2. The SSH protocol has two versions: version 1 and version 2. Version 1 was found to have some serious security issues and should not be used unless absolutely necessary (legacy equipment for example). Version 2 of the protocol is well supported by all the mainstream platforms and utilities.

When you finish changing the configuration file of the SSH daemon, don’t forget to issue a sudo /etc/init.d/ssh restart from the command line so that it loads the new configuration file.

Now that SSH is in place, go to the client machine and install Xming. The different install files have the following meaning:

Current vs Superseeded releases – the model of Xming is to make the latest versions available only to donors. The superseeded releases are a couple of minor versions behind (for example the current version is 6.9.0.40 and the superseeded is 6.9.0.28 as of the moment of writing this) but are accessible to everyone. You can check the releases page to see the difference between the versions, but in practice the superseeded version always worked for me.
Xming vs. Xming-mesa – Xming uses OpenGL acceleration while Xming-mesa uses a software-only method for drawing. Use Xming unless you have specific problems with it.
Xming-fonts – when instructions are sent to draw text, it includes just the font names, not the actual font definitions. They are contained in this package. An alternative mentioned on the Xming page is to make the originating computer serve up the fonts through a font-server, however I have no experience doing this.

Now that you have everything installed, use XLaunch to create a new session. If your SSH daemon is listening on a different port, as suggested before, you should specify -P [port number] in the additional parameters for PuTTY or SSH field (these parameters are passed to plink, so you can use any parameter understood by it). If you specify a program to run on startup, I would recommend gnome-terminal if the given system is running Gnome. Once it started, you can launch other programs from it. If you launch GUI programs and are not concerned with their output, append a & after the command (for example firefox-bin &) or launch them in a different tab (you can open multiple tabs in gnome-terminal by pressing Ctrl+Alt+T)

Update: On the netnerds I found the following two alternatives to Xming: X-Win32 (download it for here from here) and Cygwin/X. I haven’t played with them though…

Which password?

gpanther — Sat, 25 Aug 2007 07:34:00 +0000

A little note about mounting Truecrypt volumes:

When you issue a command like this:


sudo truecrypt [truecrypt volume] [where to mount it]

You will be greated with the following prompts:


Password: [your password to elevate privileges]
Enter password for '[truecrypt-volume]': [the password to the truecrypt volume]

Now in hindsight it’s clear which password goes where, but I got quite a scare when I thought that I forgot the password to my Truecrypt volume

PS. Some people still claim that the the hardware support from Linux is weak. I can only say to this: I’ve installed on a laptop Windows XP and Ubuntu 7.04. For Windows I’ve had to download drivers on a different computer and install the separately (thank God it knew at least about the USB hub, so that I didn’t had to burn CD’s) while with Ubuntu it recognized everything, including screen at native resolution, network card, special media buttons on the keyboard, etc. Also, when I plugged a cable mode in Ubuntu through USB it recognized it without asking anything!

Setting up a PPTP VPN (client) with Ubuntu

gpanther — Mon, 13 Aug 2007 17:48:00 +0000

This applies to the latest release (7.04), because from what I understand older versions had more (complicated) steps to follow. My solution is based on this blog posting combined with some advice from here. The steps are:

Install the network-manager-pptp package (either by doing sudo apt-get install network-manager-pptp, by using Synaptic or any other way you like)
Click on the networking icon and set up your VPN
Issue the following commands (the package installation seems to issue at least some of these commands, however I couldn’t get my VPN to connect until I re-issued them):
sudo /etc/dbus-1/event.d/25NetworkManager restart sudo /etc/dbus-1/event.d/26NetworkManagerDispatcher restart
Profit err – I mean happy VPN-ing

Finding a Windows computer based on its NetBios name

gpanther — Mon, 09 Jul 2007 11:37:00 +0000

A short tip: when working in hybrid environments (that is where both Windows and Linux machines are present), it is useful to be able to lookup a machine IP based on its NetBios name. You can do this by writing nmblookup [the name of the computer]. This will do a broadcast on all the interfaces querying the directly attached subnets for machines which match the given name and will output their IP addresses.

Offline updating of Debian systems

gpanther — Sun, 08 Jul 2007 18:47:00 +0000

It has been my experience that a Linux system is much more usable if it’s connected to the Internet, because then the package management system can be used to resolve the dependencies of the programs. From what I’ve seen (and please bear in mind that I’m fairly new to it), in Linux it is much more common to reuse programs / libraries and there is much less reinventing the wheel going on than in the Windows world. I can only theoretize as to what the reason may be for this, but I think that the clear-cut licenses may be the main reason (basically almost everything is under the GPL – meaning that a programmer knows that s/he can reuse all the other pieces of code).

While this makes for a much more pleasurable experience for the developer, it makes the software harder to install, because you have to have all its dependencies (the libraries/programs it relies on) and their dependencies and so on. A package management system makes it seamless if you are connected to the internet.

However if you have no access to the internet, under Ubuntu you can export the download instructions to a file, which you can take to a computer connected to the internet and execute it. If the given computer runs Windows, you can still use this file to download the packages, just get WGET for Windows, rename the file such that its name ends with .bat (for example download.bat) and remove the first line (the one which begins with #!)

An alternative to this is hyperget, a new project which aims to make this process even more simple.

Installing and using Truecrypt on Ubuntu

gpanther — Mon, 23 Apr 2007 05:20:00 +0000

Update: while truecrypt still doesn’t offer native packages (ie. .deb / .rpm) for Linux distributions, their shellscript installer works just fine. So the simplified version of the installation procedure is:

Download the correct package from Truecrypt (either 32 or 64 bit – you can find out which you need by typing uname -a – if it says i686 you need 32, if it says x86_64 you need 32 bit)
In the directory where you downloaded: tar xvf truecrypt-7.0a-linux-x86.tar.gz
sudo ./truecrypt-7.0a-setup-x86
Click “Install Truecrypt”
Launch it from Application -> Accessories or by typing truecrypt
If you later want to uninstall truecrypt: sudo /usr/bin/truecrypt-uninstall.sh/code>



While I was upgrading my storage subsystem (I bought two new hard-drives :)) I thought that this might be a good time to go full encrypted for privacy reasons. The solution I selected was Truecrypt since it seemed the only one to offer cross platform support. However the Linux part of it is not complete and you may have to employ a few tricks which I describe below:
Truecrypt does not have packages (yet) for Ubuntu 7.04 (Feisty Fawn), so you have to go with the source distribution. My installation experience was pretty flawless, but others had problem with it, so you might need to google around a bit. What you need:

The build-essentials package (sudo apt-get install build-essential)
The source files which correspond to your kernel version. You can find out which kernel version you have by typing uname -r at the console. For example I have 2.6.20-15-generic, and the corresponding source package for it is linux-source-2.6.20 (observe that the patch version is not important)
The latest Linux kernel is compiled with gcc4, however if you have an older version, you should check the gcc version it was compiled with, since you need to use the same version when compiling Truecrypt. You can do this by typing cat /proc/version at the console. For example the output on my system was Linux version 2.6.20-15-generic (root@palmer) (gcc version 4.1.2 (Ubuntu 4.1.2-0ubuntu4)) #2 SMP Sun Apr 15 07:36:31 UTC 2007. The important part of this is the gcc version ... part. If it says something like 3.4 there, you should install the respective version of gcc (sudo apt-get install gcc-3.4 - the subversion is not important) and make sure that the building process uses the respective version by typing at the console which you will be using to launch the building process the following: export CC=gcc-3.4

Now for the building process (taken from howtogeek and the ubuntu forums):

Download the source code (by going to the download page and selecting Other (source code))
Extract the archive using either the GUI (with Archive Manager) or by typing at the command line tar xvfz truecrypt-4.3-source-code.tar.gz (if you downloaded a different version of truecrypt, you should replace the archive name with the name of the archive you downloaded)
Do the following on the terminal (the same terminal you done the export... step if it was needed - otherwise it doesn't matter):


cd /usr/src/
sudo tar xvfj linux-source-2.6.20.tar.bz2 
sudo make -d -C linux-source-2.6.20 modules_prepare



Warning! The last step can take a considerable amount of time (up to an hour), so be prepared with some fun games

Now you are ready to install truecrypt:


cd truecrypt-4.3-source-code/Linux/
sudo ./build.sh
sudo ./install.sh




After installing you can create and mount Truecrypt volumes (including ones created under Windows). Here are some gotcha's to watch out for:
When creating a Truecrypt volume (under Linux), you have to specify FAT for the filesystem. This is needed because Truecrypt does not have an option (as far as I know) to mount the volume as a block device and refuses to mount it if it can't recognize the file system. If you wish to use a more sane file-system (like ext3, reiserfs or ntfs even), do the following:

Create the volume with a FAT filesystem
Mount the volume
Now unmount the filesystem part using umount (not truecrypt -d). For example on my system I would do sudo umount /media/large. To find out the exact parameter you need to pass to umount, do a sudo mount and look for a line which begins with /dev/mapper/truecrypt and use that part after on (for example on my system it say: /dev/mapper/truecrypt0 on /media/large type fuseblk (rw,nosuid,nodev,noatime,allow_other,default_permissions,blksize=4096) and thus I need to use /media/large). If you have multiple such lines, do a truecrypt -l to find out which you need to use.
Use the mkfs to create the filesystem you wish. For example to create an NTFS filesystem, I would do sudo mkfs -V -t ntfs /dev/mapper/truecrypt0 
Now re-mount it.

If you wish to mount an NTFS formatted volume in read/write mode, you need to have the ntfs-3g driver installed, and when mounting specify it by saying --filesystem ntfs-3g because the autodetect mode will result in the usage of the read-only ntfs driver. Also the user mount option doesn't seem to work for me, so instead you can use the --mount-options gid=100,uid=1000,umask=000 parameter to make it accessible to all the user. You can find out the number you need to type for gid (GroupID) and uid (UserID) by doing a cat /etc/group|grep user and cat /etc/passwd|grep [your user name] respectively.
Finally be aware that truecrypt gives you the option to specify sensitive data (keyfiles, passwords) at the command line. While this is convenient, doing so will give huge clues to any decent attacker, because the command line is stored in the ~/.bash_history file, effectively giving away your passwords. Now you can clear you history file by doing a history -c, however the strings are still on your hard-drive in the slack space. The best thing is not never specify these things at the command line and let truecrypt prompt you for them.
Update: if you don't want to move around your mouse when creating a new volume (to generate random numbers), just put --random-source /dev/urandom on the command line. While this reduces the theoretical strength of your encryption, in practical terms it doesn't affect you.
Update: as a reader pointed out in the comments, there is a simpler way to use a file system different from FAT: after creating the volume, the first time you mount it, don't specify the directory where it should be mounted. This will mount it as a block-device, but will not attempt to use any file-system on it. Then issue the truecrypt -l command to see where it got mounted and use mkfs family of commands to create a filesystem of your desire.



Linux tips
gpanther — Fri, 06 Apr 2007 06:28:00 +0000
Via the All About Linux blog: bash completion – if you type ls -- in your terminal and you tap the tab key twice, it will list all the available options. This works only of the most important commands (like ls, rm, …) but it’s still a nice add-on. And best of all – it comes preinstalled with Ubuntu (on other distros you might need to install the bash-completion package with the corresponding package manager.