I haven't gotten to play with it yet, since I'm still downloading it. I plan on doing a snapshot and upgrading my OpenBSD Parallels VM tomorrow.
Highlights:
We switched locations this month to the downtown Central Library at 10th and Wyandotte. The meeting rooms are a lot nicer. Remember, the meetings are the second Wednesday of each month.
We discussed a smorgasbord of topics, most of which at least somehow related to BSD in one way or another. This included (but was not limited to):
Most sysadmins are familiar with the concept of file ownership and permissions. Read, Write, and Execute are ingrained in our memories from the start. Sometimes, though, that's not enough. Here are some extended attributes for files in Linux and *BSD:
BSD:
To set file flags in BSD, use chflags. To view them, use ls -lO. Flags are as follows (from the chflags(1) man page):
schg and sappnd are particularly useful. As described, they place files in an append-only or immutable state, where nothing, not even root can break the rules without first going into single-user mode and disabling the flag. uchg will keep you from accidentally clobbering an important file as well, but can still be un-set by you.
arch, archived
set the archived flag (super-user only)
opaque set the opaque flag (owner or super-user only). [Directory
is opaque when viewed through a union mount]
nodump set the nodump flag (owner or super-user only)
sappnd, sappend
set the system append-only flag (super-user only)
schg, schange, simmutable
set the system immutable flag (super-user only)
uappnd, uappend
set the user append-only flag (owner or super-user only)
uchg, uchange, uimmutable
set the user immutable flag (owner or super-user only)
hidden set the hidden flag [Hide item from GUI]
As discussed in chflags(2), the sappnd and schg flags may only be unset
when the system is in single-user mode.
Putting the letters ``no'' before or removing the letters ``no'' from a
keyword causes the flag to be cleared. For example:
nouchg clear the user immutable flag (owner or super-user only)
dump clear the nodump flag (owner or super-user only)
The format of a symbolic mode is +-=[ASacDdIijsTtu].
The operator ‘+’ causes the selected attributes to be added to the
existing attributes of the files; ‘-’ causes them to be removed; and
‘=’ causes them to be the only attributes that the files have.
The letters ‘acdijsuADST’ select the new attributes for the files:
append only (a), compressed (c), no dump (d), immutable (i), data jour‐
nalling (j), secure deletion (s), no tail-merging (t), undeletable (u),
no atime updates (A), synchronous directory updates (D), synchronous
updates (S), and top of directory hierarchy (T).
Thanks to a tip from a jlime forum denizen, I found out that an older kernel would work better on my Jornada 720. Suspend works, WiFi works, even the Torsmo status app works better. Minimo didn't like Blogger, but the Dillo browser seems to be working albeit in a really minimalistic way like you'd expect in a phone's browser.
In short, this is actually a completely functional networked Linux PDA right now. I'll keep this around and do some periodic reviews as I further use this platform.
We covered this a bit at the 2600 meeting last night. I don't have a lot of time to go into detail, but here's a quick breakdown.
Asmodian X got me hooked on Windows CE Palmtops back in late 1997. I picked up a floor model HP 300LX for cheap, and actually used it as my main computer (including Dialup BBS, Telnet, Mail, and web browsing) for quite a while. It was more than sufficient for typing my papers for class and interfacing with the UNIX servers. Asmo also had a Casio Cassiopeia running CE, so we tinkered with this stuff a LOT back in the day.
Later, at DefCon 6, we'd run into a guy with an HP 620LX. That thing had a full color screen and a significant boost in memory, not to mention sound recording ability. This all sounds cheesy now, but it blew away the devices we had with their four or 16-color greyscale screens.
As time has progressed, I've also acquired an HP 320LX (same as 300LX but with a backlit screen and more RAM), a Jornada 680e (Refurbished Dutch Railways model) and a Jornada 720.
The HP300's are currently packed away somewhere, but the Jornadas are alive and well.
I was considering NetBSD and Linux for this project, but I found out that the NetBSD project for these pretty much died once they could say "it boots!" You have to use a serial cable for the console. In other words, it's useless until someone ports wscons and some device drivers. So, I chose JLime Linux, which is still in active development -- the kernel build on my 720 (Mongo branch) is less than two weeks old!
To install JLime, you need a CF card that's at least 128MB. You create 3 partitions:
jlime Linux on the HP Jornada 720 Handheld/PC
This and a bunch of other stuff at the KC 2600 meeting.
Tonight (Friday, April 4 2008)
Oak Park Mall Food Court (Northeast entrance)
SE Corner of 95th and Quivira in Overland Park, KS
Starts at 5:00PM. Look for geeks with laptops.
Files that start with a dash can cause problems if you don't know how to deal with them. Let's take a look:
Chimera:Documents axon$ ls -1The file "-file.doc" will cause problems with most command-line tools because they think -file.doc is an argument, not a file name.
-file.doc
2008-03-30.mp3
BitPIM.dmg
H-i-R.xcf
Parts.odt
vCards
Chimera:Documents axon$ cat -file.docSee what I mean?
cat: illegal option -- f
usage: cat [-benstuv] [file ...]
Chimera:Documents axon$ rm -file.doc
rm: illegal option -- l
usage: rm [-f | -i] [-dPRrvW] file ...
unlink file
Chimera:Documents axon$ mv -file.doc file.doc
mv: illegal option -- l
usage: mv [-f | -i | -n] [-v] source target
mv [-f | -i | -n] [-v] source ... directory
Chimera:Documents axon$ cat -- -file.docFor clarity, I used ls -1 (the number one not the lowercase letter "L" ) to force output to one filename per line.
this is a test file.
Chimera:Documents axon$ mv -- -file.doc file.doc
Chimera:Documents axon$ ls -1
2008-03-30.mp3
BitPIM.dmg
H-i-R.xcf
Parts.odt
file.doc
vCards
Sorry for the recent lack of Sysadmin Sunday posts. I don't always have good Sysadmin content thought up. Sometimes I do, but I don't have time to actually set up an environment to demonstrate it. Sometimes I don't even have time to get around to writing much of anything.
So, we're back this week with a tutorial on setting up Subversion, a revision control system that, in my opinion, is much better and user-friendly than other revision control systems (such as CVS). You'll see me (and many others) casually use "SVN" when referencing Subversion. You can use subversion to synchronize directories (folders) across different workstations, to collaborate changes on large documentation or programming projects, or to simply have a revision control and change rollback system for your files. It works with binary and text, but can take up a lot of hard drive space on the server for large or frequently-changing data sets.
Installation
Initially installing Subversion varies on the platform and package management system available. I am installing subversion on Ubuntu Gutsy Gibbon Server Edition. Here, it's as simple as:
$ sudo apt-get install subversion
On FreeBSD 6.3, I got it installed using pkg_add as well, with no problems.
$ sudo pkg_add -r subversion
Subversion packages are available for many platforms, but if you wish to build it from source, the documentation is quite good.
HiR Reading Room
Of particular note is the O'Reilly and Associates book: Version Control with Subversion. It is free and open source, so it's also available to read in its entirety on the web. I personally liked it enough that I bought the paperback book, as I dealt with subversion on a daily basis at my last full-time job. If you'll be doing a lot with Subversion, this is a great book to have around as a reference guide.
Please note that I'm not dealing with any encryption whatsoever, so you should probably make sure that your svn server isn't accessible from the Internet. Being behind a private firewall or cheap router will work for testing this at home. Read the book for information on securing SVN with ssh or using better authentication options. There's even a web-based SVN Server, which allows your users to browse the repository with a browser while using all of the flexibility and authentication modules at Apache web server's disposal. All of that and plenty more is covered in this book.
Starting svnserve
First, make a directory to keep the repositories in. A repository is simply a directory on the SVN server where data is stored. I chose /var/svn/repositories.
$ sudo mkdir -p /var/svn/repositories
Then, we need to start our svnserve daemon. As I mentioned before, there are several ways to run SVN. Just starting a vanilla svnserve daemon is the easiest way but not always the best way. For the purposes of this demonstration, I will keep it simple.
Place "svnserve -d -r /var/svn/repositories" (or whatever repository root you chose) in the startup scripts, usually in /etc/rc.local. Either reboot, or run "[sudo] svnserve -d -r /var/svn/repositories" from the command line to start it. This restricts svn to exporting only the contents of /var/svn/repositories.
Your first repository
Let's set up our first repository. On the SVN Server, run the following. You may choose whatever you wish for the repository name, but it has to be under the repository root you defined when you started svnserve.
$ sudo svnadmin create /var/svn/repositories/hir-test/
You should create a username and a password by editing the "svnserve" and "passwd" files in the "conf" directory under the repository you just created. Keep in mind that passwords are all in plaintext for this example. It's not really the best way to do things, but it is the simplest.
$ vi /var/svn/repositories/hir-test/conf/svnserve.conf
un-comment the following lines:
anon-access = read
auth-access = write
password-db = passwd
$ vi /var/svn/repositories/hir-test/conf/passwd
Add a line like the following to the end of the file to define your username and password:
axon = setecastronomy
Now, go to a client computer (or simply access it locally but through the svn:// url scheme) and use SVN to check out the repository:
[axon@floaty-fbsd ~]$ svn checkout svn://axon@192.168.0.108/hir-test/
[axon@floaty-fbsd ~]$ cd hir-test
[axon@floaty-fbsd ~/hir-test]$ ls -la
total 8
drwxr-xr-x 3 axon axon 512 Mar 29 21:37 .
drwxr-xr-x 20 axon axon 2560 Mar 29 21:38 ..
drwxr-xr-x 6 axon axon 512 Mar 29 21:37 .svn
total 12Back on the client machine where we added the file, though, use "svn commit" to update the central repository on the SVN server. You should always commit with a message saying what changes were made. use --message for that. It should then prompt for your password.
drwxr-xr-x 3 axon axon 4096 2008-03-29 16:52 .
drwxr-xr-x 5 axon axon 4096 2008-03-29 16:52 ..
drwxr-xr-x 6 axon axon 4096 2008-03-29 16:52 .svn
bc is "an arbitrary-precision calculator language" which so happens to be nearly ubiquitous across all UNIX platforms that I've ever run across.
I've been using LogCheck in its various incarnations for quite a while. When I started using it (it feels like a decade ago but it may have been a little less) it was called LogSentry. While it's still pretty simple, it gets the job done. LogCheck's been passed around many times, and I'm relatively sure that the package I downloaded has remained for the most part unchanged for at least 5 years. For a small group of servers you wish to keep tabs on, this tool is great. For an enterprise, you might want something more heavy duty such as a database-driven centralized logging server.
Note that by itself, LogCheck only does two things:
$ sudo pkg_add -r logcheckConfiguration:
Fetching ftp://ftp.freebsd.org/pub/FreeBSD/ports/i386/packages-6.3-release/Latest/logcheck.tbz... Done.
# Person to send log activity to.Look at the other variables, too. By default, the log files and configuration will likely be workable, but it's a good idea to make sure.
SYSADMIN=root
While AIX 6.1 is the new hotness, it's mostly feature additions. If you know AIX 5, you can get around AIX 6 without a problem -- you just might be missing out on cool things like enhanced RBAC and workload partitions.
The writing, grammar and editing of this book leaves a little bit to be desired, but the concepts covered in AIX 5L Administration are vitally important for any AIX sysadmin to be familiar with. This book is great for people who have a casual working knowledge of the UNIX command line (linux, solaris or BSD) who want to expand their horizons all the way up to seasoned intermediate AIX users, who will find new things and helpful tips within these pages.
I personally bought this book while I was job hunting. I had some rusty familiarity with AIX 4, but was looking at the prospect of landing a job that required working, functional knowledge of Solaris 8, Solaris 10, and AIX 5.3. It was a great refresher course for AIX, and gave me the information I needed to confidently blaze through a pre-employment AIX knowledge test. Now, more than a year later, this book sits next to my desk and is occasionally referenced when I need to do something on AIX that I'm not too familiar with.
Whether for reference, for job advancement, or for the fun of tinkering around with something new, this book comes highly recommended for anyone dealing with AIX, either daily or occasionally.
New research shows that cold boot attacks can compromise encryption by giving you access to the RAM's contents. This even applies to full-disk encryption that encrypts swap space and whatnot. We'll probably talk more about that in our podcast.
Physical access almost always means that a total compromise of security is somehow possible. Sensitive data could be at risk long after the data in RAM decays into oblivion. Encryption keys, large documents, and other files containing data you don't want falling into the wrong hands will almost certainly see their fair share of time in virtual memory. That means pages of RAM will be written, for better or worse, to the hard drive.
Encrypting just your swap space can be easier than switching to full-disk encryption and makes it more difficult for an attacker to obtain sensitive data as it gets shuffled in and out of RAM.
OpenBSD encrypts swap by default without any further action. To the best of my knowledge it's alone in that fact. I can't outline how to encrypt swap space in every operating system, but since FreeBSD's the flavor-du-jour, I'll show you how easy it can be.
First, disable swap:
[axon@floaty-fbsd ~]$ sudo swapoff -aWhoops! If there's too much stuff running to fit in RAM without swap, you'll need to cut back. Close your applications, stop the X Window system or whatever you have to do. Let's try that again.
swapoff: /dev/ad0s1b: Cannot allocate memory
[axon@floaty-fbsd ~]$ sudo swapoff -aNow, find the swap partition and over-write it using dd(1) to stream /dev/urandom to it. It could take a while depending on the size of the swap partition. Yes, this is a paranoia countermeasure and nothing more. Keep in mind that only freshly-used parts of swap will be encrypted once we're finished. Right now, there could be (ab)usable data out there. Not for long!
[axon@floaty-fbsd ~]$ grep swap /etc/fstabTo enable GEOM ELI on your swap partition, edit /etc/fstab and add ".eli" to the end of the swap device.
/dev/ad0s1b none swap sw 0 0
[axon@floaty-fbsd ~]$ sudo dd if=/dev/urandom of=/dev/ad0s1b
dd: /dev/ad0s1b: end of device
464657+0 records in
464656+0 records out
237903872 bytes transferred in 88.835558 secs (2678025 bytes/sec)
[axon@floaty-fbsd ~]$ sudo vi /etc/fstabYou have to reboot for this to take effect. Once it comes back online, use kldstat and swapinfo to verify that the geom_eli.ko module is loaded and that the new swap device is being used.
change this line:
/dev/ad0s1b none swap sw 0 0
to this:
/dev/ad0s1b.eli none swap sw 0 0
[axon@floaty-fbsd ~]$ kldstatVoila!
Id Refs Address Size Name
1 10 0xc0400000 7b2d2c kernel
2 1 0xc0bb3000 6974 snd_ich.ko
3 2 0xc0bba000 239a8 sound.ko
4 1 0xc0bde000 5c304 acpi.ko
5 1 0xc1f19000 e000 geom_eli.ko
6 1 0xc1f27000 19000 crypto.ko
7 1 0xc1f40000 a000 zlib.ko
8 1 0xc21ec000 2000 warp_saver.ko
[axon@floaty-fbsd ~]$ swapinfo
Device 1K-blocks Used Avail Capacity
/dev/ad0s1b.eli 232328 0 232328 0%
Lukas got it working on Parallels 3.0 under OS X Tiger, but two different HiR guys failed to get networking to work on OpenSolaris Indiana DP2 on parallels 2.5, 3.0 and VMWare Fusion when running Mac OS X Leopard.
Oh well. Like I said, maybe I'll give it a crack on a real computer when I have a lab machine ready to use.
Have I mentioned lately how I really like IBM's developerWorks site? I don't think I have.
I already know all of these tricks, but I still catch myself in bad habits on occasion -- for instance, I rarely using grep to count matches and I sometimes pipe things with cat when I don't need to.
The 10 good habits in the article are as follows:
For the past 7 years or so, I've been doing fun things with XScreensaver to make custom screen savers that display useful information. My favorite XScreensaver mode is Phosphor, which renders olde-school green text on your screen. By default, it just displays information about your system such as system load and host name. While that's fun and all, it's pretty boring for a desktop system.
So, I'm a weather geek. Part of the reason is because I like being outdoors, but even when I'm cowering inside on a blustery February morning, I like to know what the weather is doing. On my FreeBSD lab machine, I configured Phosphor to display the hourly National Weather Service data for my area.
Obviously, you need to download and install XScreensaver first. You can do this using whatever means you want, but on FreeBSD, it's as simple as "sudo pkg_add -r xscreensaver".
Then, I put an entry in my crontab that looks like this (all on one line, though):
7 * * * * /usr/local/bin/lynx -dump -nolist "http://www.crh.noaa.gov/product.php?site=EAX&issuedby=EAX&product=RWR&format=txt" | tail +16 | head -n 15 > ~/.wx.txt
This fetches the weather data (without a list of links and stripped of HTML) for the eastern KS/northwest MO region, grabs the lines I want, then puts it in the .wx file in my home directory. This runs 7 minutes after the hour, every hour, every day.
Of course, you could use a similar script to do an hourly scrape of the front page of your favorite news site, or run any program that will generate a text file for Phosphor on a regular basis.
Now that we have the weather data (or whatever else you want) coming to us every hour, it's time to configure xscreensaver. First, make sure "xscreensaver&" is included before the window manager starts up in your .xinitrc or .xsession file, depending on if you're using an X Display manager or just startx to launch X.
Run "xscreensaver-demo" to access the configuration screen, and set it up to use only one screen saver, choose Phospor, then tell it to read the text file ~/.wx, as shown in the screen shots below:
Notice how the display has that cheesy-yet-familiar phosphor persistent delay? I love it!
Sorry this didn't capture very much of the screensaver, I'm trying to figure out why xvidcap keeps crashing on FreeBSD.
I'm working on a fun project for HiR that involves a little bit of CAD (computer aided design/drafting) work. QCAD Community Edition is the GPL version of RibbonSoft's inexpensive QCAD software. It comes without RibbonSoft's technical support and lacks certain features that they reserve for QCAD Professional.
RibbonSoft claims that QCAD is usable right out of the gate even by people who have never used CAD before. I haven't touched CAD since I tinkered with AutoCAD Lite back in 8th grade shop class. I'd like to think I'm technically minded as well. QCAD is NOT easy to get the hang of. Maybe compared to AutoCAD or CADKey, but you can ask my wife and she'll tell you I've spent the better part of three whole days just getting my bearings straight with QCAD. I think I've got it mostly figured out now, though.
By the way, QCAD is available as a binary package or in the Ports tree for both FreeBSD 6.2 and OpenBSD 4.2. I've been using it on both platforms. FreeBSD works really well with QCAD despite my somewhat anemic workstation. My Logitech Revolution VX is a life-saver for precision CAD work. With its smooth-scrolling wheel and high-resolution laser optical tracker, it fits the bill perfectly. I'm really glad that FreeBSD and XOrg play nice with this mouse.
As for the project I'm working on, I'll just say it's mischievous and delightfully fun. I'll release the .DXF file for this project when the time comes.
This is part of an ongoing series of reviews of FreeBSD 6.3 on the desktop.
So, I've been playing with FreeBSD 6.3 for a few days and there are certainly some good things, and definitely some bad things. All in all, though, I like what I've seen. A few days isn't long enough to really get a feel for an operating system on the desktop, so this is the first in a series of reviews I'll be giving FreeBSD 6.3 as I shoe-horn it into my daily life as my main desktop operating system at home. Keep in mind that while I'm on the go, I'm dealing exclusively with Mac OS X on my MacBook, and OpenBSD 4.2 within Parallels when the task at hand calls for something more serious than what OS X can deliver.
The Good:
I know, I should probably fork over the cash for Parallels 3.0. The reasons I have not are as follows:
OpenSolaris Indiana is a project that's creating a binary distribution based on OpenSolaris source code that's both easy to install and use. It's worth checking out. I'm currently installing it within Parallels Desktop on my MacBook, and will also be playing with it some more when I get the free time to do so. Developer Preview 2 was released this week. A Live-CD distro similar to Ubuntu Desktop Edition is available. You can use it from the Live-CD or install it on a hard drive once the interface is up and running.
