This section covers the configuration of the firewall, ssh, and creating user accounts. The final part will cover the install of MySQL, PHP, and Pure-ftp.

Now this part is all command line baby!!!  So I'm not going to provide any screen shots since you shouldn't need them.  If you think you need screen shots for this section just stop reading now.  Seriously leave!  Okay so first I'm going to setup ssh.  It should already be installed so all we need to do is configure it.

I'm kind of a security freak so I'm going to walk you through how to do public-key authentication, and how to change the port of the ssh server so you aren't logging in on the standard port 22.  But before we do that I'm going to show you how to setup the firewall.  This is a basic setup but should be pretty secure. If you want to know more about configuring the firewall check out this tutorial.

cd ~
mkdir scripts
vim ./myfirewall


Just paste in this script (make modifications where you see fit):
#!/bin/bash
#
# iptables firewall configuration script

# flush all current rules from iptables
iptables -F

# allow ssh connections on tcp port 8768 <-- this is just random pick anything over 6000
iptables -A INPUT -p tcp --dport 8768 -j ACCEPT
# allow ftp connections on tcp port 21 <-- for more security you can change this
iptables -A INPUT -p tcp --dport 21 -j ACCEPT

# set default policies for INPUT, FORWARD and OUTPUT chains
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT ACCEPT

# set access for localhost
iptables -A INPUT -i lo -j ACCEPT

# accept packets belonging to esablished and related connections
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

# save settings
/sbin/service iptables save

# list the rules
iptables -L -v

Finally make this file executable and you have a script:
chmod +x myfirewall

To run it you just type (you must be logged in as root):
~/scripts/myfirewall

This will make it easier when you want to add rules. It flushes all the rules, rebuilds the rules, saves them, and lists all the rules at the end. Once this is done we should reboot to let the firewall settings take effect.
shutdown -r now

Another thing we want to do before we configure ssh is to create a user. We aren't going to allow root access to ssh so we need someone to login as. Once it's restarted we are going to login as root and create a user. (just replace username and password with your desired username and password)
useradd username
passwd username password

Now when you login to that username you can always switch to the root user by typing:
su -
Then it will prompt you for the root password. To switch back:
logout

Rule of thumb is to never login to root unless you absolutely have to in order to change something. It can be really dangerous to login as root all the time because if you make a mistake there is most likely no way of going back. Now that I gave you that warning we are going to login as root because we need to setup the ssh server.

First let's create a backup of the sshd_config file so we can go back if we make a mistake.
mv /etc/ssh/sshd_config /etc/ssh/sshd_config.bak

Now let's edit the original file.
vim /etc/ssh/sshd_config

And just copy this configuration and paste it into the window. Or you can type it in manually, just make sure to double check everything at the end.

After you have done that all you need to do is to create the .ssh folder with the authorized keys file.  Make sure you are logged in as a user other than root and do this.

mkdir ~/.ssh
chmod 700 ~/.ssh

Now all you have to do is to upload your public key to the server. If you do not have one it's pretty easy to make.

Okay so I didn't plan on having a part 3 to this tutorial, but there is a lot more than I thought there would be. So now that we have ssh setup properly and have the firewall configured then we are good to move on to the next part.

It will then prompt you with something like this:

Generating public/private rsa key pair.
Enter file in which to save the key (/home/user/.ssh/id_rsa): <-- I just press enter here
Enter passphrase (empty for no passphrase): <-- I usually put in a password
Enter same passphrase again:
Your identification has been saved in /home/user/.ssh/id_rsa.
Your public key has been saved in /home/user/.ssh/id_rsa.pub.
The key finger print is:
9d:27:2f:d5:6f:31:a3:fc:8f:f2:10:76:6e:bc:aa:88 user@localhost.localdomain

Now that you have a public and private key pair you need to upload your public key to the server you want to connect to.

scp ~/.ssh/id_rsa.pub user@host:.

Once you do that you need to login to the remote machine and copy the contents of your public key to the users authorized_keys file.

cat ~/id_rsa.pub >> .ssh/authorized_keys

if there is no .ssh directory:

mkdir .ssh
chmod 700 .ssh

if there wasn't an authorized_keys file before, make sure to modify the permissions (this only needs to be done if you are using strict permissions in the /etc/ssh/sshd_config):
chmod 600 .ssh/authorized_keys

That is all you have to do from the client side on a Linux/Unix/Mac Os X machine. Now lets look at the Windows way of doing things. I have done this with both XP and Vista before so it should work the same way, that is as well as I can remember it works the same.

Windows doesn't come with an ssh client, unlike the other operating systems, so you must download a client in order to use ssh. Luckily there is PuTTY! If you click on the very top download it should only take a minute since it is a very lightweight application. While you are there you are going to need PuTTYgen as well.

Now for the part that sucks for me... having to take screen shots, optimize the images, upload them and paste them. All the while supplying you with step by step instructions. Seriously I give props to the people that do this more than I do, this takes a long time to make a tutorial.

So lets open up PuTTYgen and see what it looks like.

Just click on the "Generate" button.  And you will get this screen.

This part is kind of fun because you get to move your mouse around in that area to generate the key.  The only time it sucks is when you set the number of bits to higher than 1024, I would normally go with 2048 but you always have the choice of 4084 as well.  If you choose the last one I hope you have some stamina because it takes a while.

Now you just need to type in the information you want.  If you don't want to put a password for the private key that is your choice.  If you want to make a password you can always use pageant to make it so you don't have to type a password everytime.  MAKE SURE YOU SAVE BOTH THE PRIVATE AND PUBLIC KEYS!  And put them in a location you can find.

Now we insert that private key into PuTTY.  So lets configure our PuTTY session.

First we are going to open up PuTTY and go to the Auth section under SSH.  Leave the defaults and browse for where you saved your private key.  Now go back up to Sessions.

Fill out the connection information, create a session name and save the configuration.  Now we have to upload the public key to the server.

Hopefully the ssh server is using password authentication right now, or you have some means to ssh into the server.  Because this is now command line via ssh.  Let's upload the public key to the server.

scp /path/to/file/publickey.pub user@host:.

Now connect via ssh to the server, we are going to add the public key to the authorized_keys file.  Since we used PuTTYgen to create the public key we need to convert it to the openssh format. And in that same command we append it to the end of the authorized_keys file.

ssh-keygen -if publickey.pub >> .ssh/authorized_keys

and that's all folks!  Now you should be able to connect to your server using public key authentication.  Hope you made it through this okay.

Filelight se encuentra en los repos.

Slash or no Slash, figuring out the source and destination

The best way to show how a trailing slash will effect a copy, lets look at some examples:

Source: 
/src/.
/src/directory1
/src/file1
/src/file2
/src/file3

Example 1 : without the trailing slash in the src and dst ( rsync -ar /src /dst)
/dst will now look like this
/dst/src/directory1
/dst/src/file1
/dst/src/file2
/dst/src/file3

Example 2 : with the trailing slash on the src ( rsync -ar /src/ /dst)
/dst will now look like this
/dst/directory1
/dst/file1
/dst/file2
/dst/file3

So the tailing slash on the src tells the rsync program to copy the contents of the directory, while just specifing the directory with no slash tells rsync to just copy the entire directory.

Doing the Rsync

To rsync some files you need a source, destination, and options.   Again I'll just use some simple examples to display the functionality:

Simple copy : copy the CONTENTS of src inside the directory dst
rsync -a /src/ dst 

Simple mirror: mirror the data of the CONTENTS of src into dst.  Any file that does not exist in src will be deleted from dst
rsync -a --delete /src/ dst

Simple copy to remote machine : copy the CONTENTS of src into dst on another machine.
rsync -a /src/ HOSTNAME:/dst

Extra Options

-v --stats --progress : Show what is going on during the transfer
--dry-run : Only show what would have been done

Setting up the /etc/rsync.d entry 

[rsynctest]
     path = /dst
     max connections = 5
     lock file = /var/run/rsync.lock.test
     uid = root
     gid = bin
     use chroot = yes
     read only = false
     comment = used to test rsync
     hosts allow = HostToAcceptRsyncFrom

set cons [lindex $argv 0]
set port [lindex $argv 1]
spawn ssh  -e ! -l root:$port $cons
#send "\n"
#expect -re ":"
#expect -re "Login"
send "\r"
send "\r"
expect -re ":"
expect -re "#"
expect -re "$"
sleep 5
send "\r"
send "!.\r"
#expect -re "telnet>"
#send "quit\r"

expect eof

Run this command:

bash$ for cons in cons{1..12}; do for i in {7000..7036}; do echo -n "$cons,$i,"; val=`./cons.exp $cons $i 2>/dev/null |grep login |grep -v closed| sed 's/login://g'`; echo $val;done ; done

Il gruppo di sviluppatori capitanato da Miguel De Icaza ha reso disponibile la versione 2.0 di Mono, l’implementazione a codice aperto della piattaforma .NET disponibile per *nix, Windows e Mac OS.

Tra le API .NET completamente implementate spiccano ADO.NET 2.0, ASP.NET 2.0 e Windows Forms 2.0. La prima si occupa della gestione di connessioni a database, la seconda è dedicata allo sviluppo di applicazioni web mentre la terza è utilizzata per la creazione di interfacce utente.

Mono 2.0 offre inoltre binding alle librerie Gtk+ 2.12, a Cairo ed SQLite. Possiede anche una API (Mono.Posix) per sfruttare le peculiarità dei sistemi *nix.

Maggiori informazioni e link per il download di sorgenti e/o pacchetti binari per le varie piattaforme sono reperibili nelle note di rilascio.

[via: ossblog.it]

The Unix filesystem:
In the Unix file system, the root [/] contains sub-directories viz. bin, boot, home, etc, user, dev and lib. In this system the Kernel resides on top of the hardware which provides the platform for Shell and Unix utilities and Application programs.

The various types of Unix Files are:
1.    Ordinary or Regular Files [contains text, data or program information; not other files]
2.    Directory Files [contains other directories or files; here each line comprises of two parts viz. the item name and the inode number(a pointer)]
3.    Device or Special Files [physical devices as files; categorized into character special and block special files]
4.    Symbolic Links [an indirect pointer to a file; categorized into hard link and soft link]

In Unix, the users can be categorized into various types according to their access control attributes. They are:
1.SuperUser
2.Owner
3.Group
4.Others

The various access attributes assigned to files or folders that provide the user some form of access control over the data are read[r], write[w] and execute[x].

Shells in Unix:
A Shell is nothing more than a command interpreter. In Unix, the shell is designed to be the interface to the user, to receive the user’s input(interpret commands) and act on them. The shell then sends the output to the default or a specialized location, usually the user’s terminal. There are some common Unix shells:

1.    Bourne Shell: Unix shell program by Steve Bourne; “sh” or “/bin/sh”; has  a “$” prompt.
2.    Korn Shell: Newer variation of the shell program by David Korn; “ksh” or “/bin/ksh”.
3.    C Shell: Commonly used shell by Bill Joy; has a “%” prompt; configured by *.rc and *.login files.
4.    TC Shell: Variation of C Shell.
5.    Bourne-Again Shell: Used in Linux; “bash”; has a “$” prompt; configured by *.bashrc file hidden in /home.

“Hemos modificado el núcleo del sistema que monitorea el funcionamiento y seguimiento de los programas instalados en el sistema operativo”, dijo Wool. En esencia, el equipo ha construido un modelo que predice cómo el software se debe comportar en un servidor de trabajo. Si el núcleo detecta una actividad anormal, detiene el funcionamiento del programa antes que se produzcan acciones maliciosas.

“Cuando vemos una desviación, sabemos con certeza que algo malo esta sucediendo”, explica Wool. Además cita el problema de la costosa protección anti-virus. “Nuestros métodos son mucho más eficientes y no deboran los recursos del equipo”.

Via | susemania
Link | slashdot.org

Descarga
Via | phoronix

Descarga
Enjoy!.

Andy Tung, Director of US Sales for MSI … told Laptop that their experience shows that netbooks with Linux are returned four times more often than those with Windows XP.  This would indicate what others have already noted, many consumers pick up the cheaper systems and then realize that the Linux system is not what they are used to so they return it.

And this is for a product that is targeted at early adopters who are far more technically sophisticated than average; the MSI Wind is a tiny, dirt-cheap portable PC that has been selling like gangbusters to the digital elite and gadget freaks since its launch in June. I would assume that this audience would be more forgiving of rough edges and usability gotchas than more mainstream PC buyers. This comment by MSI’s Andy Tung from the original interview highlights the uphill struggle that PC makers have when dealing with Linux:

Our internal research has shown that … the main cause [of the higher return rates for Linux-based machines] is Linux. People would love to pay $299 or $399 but they don’t know what they get until they open the box. They start playing around with Linux and start realizing that it’s not what they are used to. They don’t want to spend time to learn it so they bring it back to the store.

The interviewers interrupt at this point to note that they “struggled with the Linux version of the Wind U90” as well and ask whether the company plans to customize a Linux OS for the machine instead of using an off-the-shelf distro:

We plan to bring the Linux version to the U.S by the end of the year. But we are working on some of the issues with the SUSE Linux and even continue to explore other flavors of Linux. We have discussed Ubuntu with a Mac OS type of look and feel. We are talking to different suppliers to figure out the best user experience.

Finding software developers to build and support a great user experience that ties hardware and software together isn’t cheap or easy. It’s hard to imagine how that job can get done at all, much less be done well, on a PC that sells for $399 or less.

I have a couple of Linux-based systems here that I use occasionally for testing and just to stay on top of what’s happening in the wide world of computing.  I have been impressed with the way that popular Linux distros like Ubuntu have improved with each new release; these days, Linux is a great choice for technically sophisticated users who don’t mind being far, far out of the mainstream. But for people who don’t have the time or the inclination to make fundamental changes, it’s a nonstarter. If I were to switch to Linux for daily use, I would have to dramatically change my work habits and learn to use a very different set of tools than I use today. The same would be true of any of my home or small business clients.

As someone who writes about Windows for a living, I get a disproportionate amount of feedback from people who argue that open-source software is a panacea and that dumping Windows for Linux is the answer to every problem that affects the Windows ecosystem. The market is doing a pretty good job of proving that they’re wrong, as this example shows.

http://blogs.zdnet.com/Bott/?p=557

Via | tux-planet.fr

Link | tux-planet.fr

Carr hizo hincapié en que, en estos casos, ni siquiera importa cuán bueno o malo es el sistema operativo de Linux. Estos clientes no quieren probar algo nuevo. "Nosotros lo hemos dicho hace mucho tiempo, no queremos hacer un clon de Windows!.Relacionarse con Linux puede tomar tiempo pero deberiamos empezar ya a educarnos sobre esto.

Link | laptopmag
Relacionados | Compradores de portatiles no contentos con Linux.

bash$ (cd /top_level_dir ; tar cpf - source_dir ) | tar xvpf -

source_dir/sql/target_v5_p2e_cpc_new.sql
source_dir/sql/target_v4_cpm_new.sql
source_dir/sql/target_v4_cpm.sql
source_dir/crap.php
source_dir/svnmerge.py
source_dir/nte.out

bash$ ls -l /dest_dir/source_dir/sql

-rw-r--r-- 1 doobie users  725 2007-08-15 20:19 target_v5_p2e_cpc_new.sql
-rw-r--r-- 1 doobie users  739 2007-08-15 20:19 target_v4_cpm_new.sql
-rw-r--r-- 1 doobie users  721 2007-08-15 20:19 target_v4_cpm.sql

- Run with exec ssh-agent $SHELL

- Run ssh-add

Management Packs are available to add extra functionality into SCOM 2007, these can be downloaded or you can create your own.

The Distributed Application Designer is a graphical wizard to help IT administrators quickly create health models and MPs (Management Packs) for their IT Services. The Management Pack Authoring Console is a graphical tool used to help IT administrators and developers build MPs for their custom applications and other technology components. The Operations Manager 2007 Software Development Kit (SDK) provides programming interfaces so developers can more deeply integrate with and automate Operations Manager 2007.

SCOM isn't restricted to monitoring Windows environments, it's possible to monitor HP-UX, Solaris, Red Hat & SUSE Linux by using the Cross Platforms Extension beta.

Download a trial of System Center Operations Manager 207 here.

Today I discovered the mkisofs command, a general linux command not specific to Ubuntu. This command enables you to make an ISO disk image of any folder or group of files on your hard drive or external media. I used it today to make an ISO file of a CD which appears to have worked perfectly using the following command

mkisofs -o EPSON.iso /media/cdrom0

As far as i know the -0 paramater signals that we are giving the command an output file (in this case EPSON.iso) followed by the path to the cd drive which contained the CD i wanted to make an ISO from. This command has literally hundreds of paramaters which are explained better than I would even attempt here.

If /export/apps contains bin, lib, var, etc, share and sbin but you only want bin, lib, and one subdirectory of share rsynced, `hostname`-exclude-list.txt then looks like this:

+ /apps/bin/
+ /apps/lib/
+ /apps/share/vim/
- /apps/share/*
- /apps/*

Using this command, you can then sync the directories:

# rsync -avz --delete-excluded --exclude-from=`hostname`-exclude-list.txt /export/apps /local

With the --delete-excluded, if you change the exclude file, newly excluded entries will be removed from the destination. The copy will end up in /local/apps. More usefully, /export/apps could be on a remote server and the destination would be /export.

ท่าง่ายแบบใช้ pkg-config ก็ใช้กับกรณีนี้ไม่ได้ด้วย. พยายามจะใช้ AC_CHECK_LIB แต่ก็ยากเกินไปอ้าง method ของ C++ ไม่รู้ทำไง :-P. แต่ดูไปดูมาก็เจอว่ามี gtest-config พอจะไช้แทน pkg-config ได้ แต่ว่าถ้าใช้แต่ gtest-config ก็ดูท่าจะเขียน configure.in ยาวอีก.

แต่หาไปหามาสักพักก็พบ gtest.m4 เป็นตัวช่วยสำคัญที่ทำสั่ง GTEST_LIB_CHECK ใน configure.in ได้เลย แต่ว่าจะเอา gtest.m4 มาใส่ใน aclocal.m4 ได้อย่างไร ผมก็ลืมไปแล้ว ไม่ได้ใช้นาน หรือว่าผมไม่เคยทำเป็นเลย ไม่ค่อยแน่ใจ. แต่หาไปหามาก็พบว่าสั่ง aclocal -I $HOME/gtest-1.1.0/m4 ได้เลย ^_^ (ผมเอา gtest ไว้ใน $HOME อะนะครับ).

พอเรียก configure แล้วก็ได้ข้อความประมาณนี้ออกมา
...
checking for gtest-config... /home/veer/bin/gtest-config
checking for Google Test... yes
...

น่าจะใช้ได้แล้วมั้ง ต่อไปก็แก้ Makefile.am แล้วก็เขียน test case (ที่จะลองต่อไป)

This code, by the way, is probably in every single deployed Unix system.

What should I do now?