Inhaltsverzeichnis für Volume 3 in Linux & Open Source Annual

Free and Open Source Software (FOSS) has become an international phenomenon in recent years. The FOSS philosophy of protecting user freedoms is key to the pioneering movement that is always changing and evolving. By constantly updating and improving, it pushes the boundaries of what can be achieved with software. Whether this takes the form of updates to the many operating systems out there, awesome hacks that make life or computing easier than ever, or exciting hardware like the MintBox, there’s always something ground-breaking on the horizon. We have crammed as much of the year’s exciting new information as we possibly can into this annual, from news about the world of open source, reviews of the latest distros and open source software, to the many practical tutorials that can help you…

The primary configuration file where we can enter values for all the directives and customise Kippo is called kippo.cfg.dist (kippo.cfg). This includes, listening ports for incoming SSH connections and the location for files uploaded by an attacker: • ssh_addr: Shows the network interface where Kippo will be listening for all the requests. • ssh_port: Kippo’s listening port. The preference would be to set this to port 22, although you should run Kippo as root or sudoer. • hostname: Shows the computer’s name the attacker will see once they gain access. Try using appealing names such as PayrollPC. • log_path: The path where the log file will be stored for recording all actions and events taking place on the computer. This info will be stored in the kippo.log file; a folder…

As a part of the post-attack analysis, we need to look at the dl folder and find possible files uploaded by the attackers. Most of these files will have some type of malware or tools to exploit system vulnerabilities. This info will help us to understand the type of the attack made against the honeypot and to learn how to protect our real infrastructure. The first part of the analysis should be to send files through an online analysis service – for example, VirusTotal (www.virustotal.com). This service can detect viruses, worms, Trojans and other malware by just uploading the file to the website or pasting the URL (or IP if we want to check an internet location). VirusTotal has 56 different types of antivirus and 61 engines, as well as…

The Linux kernel is one of the largest open source projects in the world, with over 13 million lines of code – and it underpins everything your Linux machine does. Generally speaking, most Linux users don’t think about the kernel too much; it just sits there, doing its thing. The kernel becomes most important and interesting to users when a forthcoming release adds support for a new piece of hardware that is in a machine or fixes some issues in existing hardware. Typically, a specific kernel version is tied to a specific distribution release. For example, Ubuntu Xenial Xerus includes kernel 4.4, while Ubuntu Yakkety Yak includes kernel 4.8. Although this is the case, there is nothing to stop you installing a new version of the kernel on your system…

Although GNOME itself has had an at-times troubled and somewhat controversial history, it has grown and matured to such a point now that a number of distributions offer it as their default environment – an approach that is certain to become more popular going forward, too. The beauty of Linux is that you can drop GNOME on top of virtually any distribution you choose, as you’re certain to find it in the appropriate repositories. What you won’t always get, however, is a fully integrated experience – some distros go the extra mile to ensure that the distribution is fully integrated with the desktop environment, and the extra level of care shows. When choosing a distro that uses GNOME, it’s also worth checking exactly which version is included. Some distros are…

The UK’s fastest computer, which occupies the number 11 slot in the Top 500 list, is a Cray XC40. Based on the 2.1GHz Intel Xeon E5-2695v4 processor and 1.6 petabytes (1.6 million gigabytes) of memory, its 241,920 cores achieve a throughput of 6.7 PFOPS. And if you like mind-boggling statistics, you’ll be intrigued to learn that, at 110 tonnes, the computer weighs as much as 11 double-decker buses. Although it cost £97 million, the Met Office believes that it will pay for itself many times over. It’s been suggested that the supercomputer, which became operational in April 2016, will enable the UK to lead the world in weather forecasting, as well as climate and environmental sciences. But, more tangibly, from 2016 to 2020, it will deliver £2 billion worth of…

There are many local, complementary currencies in operation around the world. Some recent, some decades old but they all face the same problem – how to trade with people in another local currency or easily allow someone to convert their money to a new currency. Community Forge developer Matthew Slater – currently working with 250 local currencies in Switzerland, France and Belgium – is looking for help to coordinate and develop a new platform to meet the present and future needs of local currencies for interoperation. Many of the building blocks are there, but there’s plenty of work to do – if you’re interested in helping, head to: http://creditcommons.net.…

01 Enable the firewall Gufw is the graphical front-end for UFW, the uncomplicated firewall, which is one of the simplest front-ends for iptables. Fire up Gufw and change the Status toggle to On to enable the firewall. Gufw includes three profiles: public, office and home. The default is the home profile that denies all incoming traffic and allows all outgoing traffic. This will let you surf the internet without any issues. 02 Define policies You can alter the incoming and outgoing policies by selecting one of the three options in their respcetive dropdowns. The Allow option will allow traffic without asking any questions. The Deny option will silently discard packets, while the Reject option also sends an error packet to the sender. A good idea is to deny all incoming…

01 Encrypt individual files Head to zC > Encrypt A File. In the dialog box that pops up, click the button adjacent to the Source field and navigate to the file that you wish to encrypt. Then enter a password in the text box labelled Key. zuluCrypt will use this information to create a file with the same name, with the.zC extension at the end. Once a file has been encrypted, make sure you delete its original version. 02 Decrypt the file Head to zC > Decrypt A File. Point to the encrypted file in the Source field and alter the location of the unlocked file in the Destination field. Now enter the password with which you encrypted the file and click the 'Create' button. When it’s done, the decrypted…

One of the key improvements in UEFI is Secure Boot. This is designed to prevent malware, such as rootkits, intercepting your normal operating system boot sequence without you realising, something that was a real problem in BIOS. Windows PCs now ship with Microsoft’s certificate stored in UEFI – the firmware can then check the bootloader signature before launching, to ensure it hasn’t been tampered with. Of course, this can cause an issue for Linux – Secure Boot needs to be either disabled or a distro used where the distro developer has submitted its bootloader for signing by Microsoft. It is also possible to create your own keys and enrol them as ‘MOKs’ (Machine Owner Keys), to allow you to maintain Secure Boot together with your own custom bootloaders.…

HIGHEST QUALITY OFF THE SHELF If quality is more important than price, then an off-the-shelf server from a respected vendor such as HP or Dell is likely to be the best option. One of the main reasons for this is aftersales support – if your server goes down with a hardware fault, having a guaranteed on-site warranty can be important. Enterprise-class servers also have impressive offerings around server management, with tools such as HP’s iLO that allow you to work on a server remotely even if its OS is having problems – something that’s not unheard of on Linux boxes! BEST VALUE BUILD IT YOURSELF As well as pure value, there’s a certain satisfaction that comes from specifying server components yourself and building something that exactly fits your needs. Whether it’s a…

When deploying a server at home or in the office, by far the most common use is for file backup and storage. While cloud storage has its place, for performance reasons it just makes sense to have a local copy of data, particularly when it’s large and you might want to manipulate it, the main example being photos. Building a file server – also often referred to as NAS (network-attached storage) – is a great way to start, giving you the ability to expand the functionality later on. Building a file server can also be relatively cheap, as a powerful machine isn’t needed. Choosing your hardware There are two key hardware aspects to a file server: the disks, as you’d doubtless expect, and the network connectivity. Start by determining how…

Tam Hanna knows that the best way to defeat hackers is to beat them at their own game. Let him be your guide through the murky depths of SSH configuration to ensure your system and data stay secure. One of the biggest problems in the world of computing is the presence of significant others: whenever you are involved in some kind of long-running or interesting task, you can be sure that someone will arrive to distract you. One nice way to address this problem involves the use of remote access technologies. While VNC and similar graphical access systems exist, this story looks at the most classic of tools known to UNIX administrators. SSH – the name stands for Secure Shell – is an advanced version of the basic Telnet protocol…

Toni Castillo Girona holds a bachelor's degree in software engineering and works as an ICT research support expert in a public university sited in Catalonia (Spain). He writes regularly about GNU/Linux in his blog: disbauxes.upc.es Resources OWASP Top 10 2013 bit.ly/1a3Ytvg CMS usage statistics bit.ly/2bJIbmI Wappalyzer wappalyzer.com CMSmap bit.ly/2jq2Zjc TurnKey Joomla bit.ly/2iejPnr TurnKey WordPress bit.ly/2jyHIbp WPScan wpscan.org Joomscan bit.ly/2j3jCEU Joomla VEL vel.joomla.org Ethical hacking The information in this tutorial is for security testing purposes only. It is illegal to use these techniques on any computer, server or domain that you do not own or have admin responsibility for! WordPress, Joomla! and Drupal are among the most popular content management systems (CMSs) around the world. Because CMSs are web applications, they share the complete spectrum of vulnerabilities affecting web apps: SQL-i, XSS,…

Jason Cannon started his career as a Unix and Linux system engineer in 1999. Since then he’s used his skills at such companies as Xerox, UPS, Hewlett-Packard and Amazon. When shell scripting, it’s handy to perform an action on a list of items. We can do this using a for loop: ITEM_1 … ITEM_N is a space-separated list of items. The commands between do and done are executed for each item. The first item in the list is assigned to the variable, then the code block is executed. The next list item is then assigned to the variable and the commands are executed again, and so on until we reach the end of the list. Here’s an example script which shows how a for loop works. To run this, save it…

Using VirtualBox’s graphical interface is certainly convenient, especially for desktop users that use virtualisation occasionally. It’d be hard to build a case for them to invest the time it takes to master VBoxManage. But the return on investment for an experienced sysadmin who manages virtual infrastructure as part of their day job is immense. While you can write your own scripts to create VMs, a better option is to adapt the scripts shared by a Toronto-based software developer on Github (https://github.com/gregr/vbox). The scripts were originally written to ease the installation of Ubuntu 14.04, but if you’ve read through this article you’ll have no trouble deciphering and modifying the scripts as per your requirements. Once you get the hang of this, you’ll never look to the graphical interface for rolling out…

Best Distro for Everyday page 136 When using Linux daily for work and play, you need a versatile everyday distribution Best Distro for Development page 137 The developer toolset is a more advanced choice, but there’s a distro for that Best Distro for Enterprise page 138 Linux is still a growing Enterprise choiceand distros come with support Best Distro for Security page 139 The security specialist's choice with a range of testing tools integrated Best Distro for Privacy page 140 Maintaining privacy on the internet is an important concern in today’s environment. Best Distro for Repair page 141 Keeping a repair distro close at hand can help you recover a non-booting machine Best Distro for Rolling Release page 142 If you want the latest Linux software at your fingertips, a…

Red Hat Enterprise Linux Choosing a Linux distribution for enterprise is less about features and more about support. Linux is already a powerhouse in the enterprise server market and has a steadily growing footprint on the desktop, but an operating system powering your business has to be utterly dependable in all kinds of scenarios – few firms in the Linux space are better placed to deliver that reassurance than Red Hat. Products from the company are used by over 90 per cent of Fortune 500 companies. The Red Hat Enterprise Linux (RHEL) life-cycle is quite different to other distros – version 7 was first released in 2014 while 7.4 (also known as 7 update 4) was released in August 2017. Minor version updates are typically released every 18 to 36…

SystemRescueCD With great power comes great responsibility. And great potential for things going wrong. Now and again, even the most experienced of Linux users comes unstuck, ending up with a system that goes wrong, won’t boot, has an issue and needs some urgent repair. More often than not it’s Windows doing something nasty to GRUB, but when that situation happens, you need something in your armoury to get you out of trouble. That’s where repair distros come in. Typically launched from USB or DVD but also installable to a dedicated partition of your hard drive, repair distros are designed to have all the tools to hand that you need to get back up and running in a crisis. One great example of the genre is SystemRescueCD – a onestop distro…

We all know Linux best from our desktop and server experiences, but the OS is also in use across the world tailored for very specific tasks. This approach can be applied in your home too, by using the excellent OpenELEC distro for your home entertainment needs. OpenELEC is designed to turn your blank PC into a fully featured media machine in less than 15 minutes. Enjoyed by over 450,000 regular users, the award-winning platform runs well on a wide variety of hardware (including the Raspberry Pi and a number of other ARM-based platforms), uses barely 100MB of disk space and can run from hard disks, SSDs, CompactFlash or SD cards. 32-bit builds were deprecated last year, however, which slightly limits the machines that can support the distribution. Media content is…

Porteus’s cheatcodes can be used to persist storage and change a number of settings in your installation. This functionality becomes particularly useful if you end up with a non-booting system. As well as removing the option to use your saved storage, the base_only cheatcode prevents the system from loading any modules at startup other than the ‘base’ modules included with the default ISO. This is useful in debugging to see if problems you are having are associated with some module you’ve added to the system. • cliexec=my_script allows you to run a script before the graphical interface is loaded. • debug will start the shell several times during the boot to perform debugging actions. • from=/dev/device loads Porteus from the specified device, folder or ISO. • fsck runs a filesystem…

As well as live-boot distros to cover operations such as system rescue, privacy and security, other distros are available to serve more creative purposes. An example of this is AV Linux, a Debian-based disto that includes a large collection of audio and video production software. It also includes a custom kernel with IR Q threading enabled for low-latency audio performance and the JACK audio connection kit. The hardwareefficient Xfce4 desktop is in place to save your machine’s processing power for the tasks at hand. AV Linux’s goal is to bring together the raft of highquality, open source products in the media space to showcase exactly what’s available.…

01 Use Z shell One of the key features of Grml is Zsh (Z shell), the default interactive shell when using the distribution. If you are a seasoned Bash user, don’t be concerned – 99% of what you know about Bash works the same way in Zsh. There are some great additional features, though. How about Tab completion on cd? What a time-saver! 02 Type partial commands You probably already use Ctrl+R to do a recursive search of your history in Bash. This is a great way to reuse commands, but Zsh is even smarter. You can type part of a command, then press the up arrow to find the last command that started with the character you typed, also continuing back in the history with further presses if required.…

Nitish Tiwari is a software developer by profession, with a huge interest in free and open source software. As well as serving as community moderator and author for leading FOSS publications, he helps organisations adopt open source software for their business needs. The internet is the biggest source of knowledge out there and is widely used to share information, but it is also the biggest source of malware, spyware and several other types of viruses. This makes the internet a very interesting, yet difficult place to be in. You need to be careful of unverified (and sometimes even verified) software that you download from the internet, the sites you visit, the email attachments you open and so on. This can be difficult to do for anyone, whether they are from…

• Better Bluetooth Bluetooth support is much improved in 18.2 with the addition of the Blueberry UI. • New display manager Mint 18.2 ditches MDM and uses LightDM as the display manager with support for X, Wayland and more. • Slick greeter 18.2 includes the LightDM-powered, HiDPIready ‘Slick’ greeter, a fork of Unity greeter. • Mint-Y polish Mint 18 introduced the new Mint-Y, Arcbased theme; 18.2 adds further visual polish and new backgrounds. • Updated environments Cinnamon is updated to version 3.4, MATE to 1.18, KDE to Plasma 5.8.7, Xfce to 4.12. • Linux kernel options Kernel versions 4.6, 4.8 and 4.10 are available directly from the Mint Update kernel management utility.…

A close partnership between Compulab and the Linux Mint team has produced a line of miniature PCs that come ready to use with Mint pre-installed. Based on Compulab’s fitlet mini-PCs, three different Mintbox variants are available – the high-end Intel i5-powered MintBox 2, the mid-range AMD A10-powered MintBox Mini Pro and the lower-end AMD A4-based MintBox Mini. Although sold at a relatively high prices, the machines have been well received due to their pocketable size, completely fanless running, good performance and – of course – excellent hardware compatibility with Linux Mint.…

To access FileSilo, please visit www.filesilo.co.uk/bks-1576 01 Follow the on-screen instructions to create an account with our secure FileSilo system, log in and unlock the bookazine by answering a simple question about it. You can then access the content for free at any time, and download it to your desktop. 02 Once you have logged in, you are free to explore the wealth of content available on FileSilo, from great video tutorials and exclusive online guides to superb downloadable resources. And the more bookazines you purchase, the more your instantly accessible collection of digital content will grow. 03 You can access FileSilo on any desktop, tablet or smartphone device using any popular browser (such as Safari, Firefox or Google Chrome). However, we recommend that you use a desktop to download…

Ethical hacking This guide must be deployed for investigation or to protect an organisation only Organisations are always innovating to maintain a proactive defence against internet threats. To achieve this they create real structures for potential attackers in the hope of fooling them into thinking that their attack is being carried out against a real infrastructure. In this feature we look at honeypots, which are either software or a set of assets that tries to ‘seduce’ attackers by pretending to be a vulnerable system and once attackers are lured in, the honeypot studies the attack behaviour to learn the latest techniques that need to be countered. Honeypots date back to the 1960s but gained prominence when Clifford Stoll, who managed computers at Lawrence Berkeley National Laboratory in California in the…

There is some controversy around the ethics and legal implications of using honeypots. Some experts believe honeypots don’t help security, since they can help attackers practise and learn new techniques and generally hone their skills for attacking any site. Some even consider honeypots as illegal, if the honeypot infrastructure is built intentionally as an ‘entrapment’ to catch attackers. This concern involves some issues related to privacy, because somebody accessing your honeypot could have legal rights (depending on the country where you place the honeypot) and this can limit the information that you can harvest from the attackers. It’s important to distinguish between two types of information when collecting data: content and transaction. The content data is the most important because it involves personal information such as emails, chats and even…

01 Introducing T-Pot T-Pot combines honeypots Conpot, Cowrie, Dionaea, ElasticPot, eMobility, Glastopf and honeytrap with Suricata (a networkmonitoring security engine). It visualises the collected data with ELK stack (Elasticsearch, Logstash and Kibana), which has a beautiful visualisation engine. T-Pot runs every daemon in a Docker container for good insolation. 02 Requirements and installation T-Pot can be installed on a physical computer or in a VM using different setups. To avoid any issues during installation make sure your system meets the following spec: 4GB RAM (8GB recommended), 64GB hard disk (128GB recommended) and a working internet connection. Installing T-Pot is easy: just download the ISO file from http://community-honeypot.de/tpot.iso and run it in your designated setup. 03 Running T-Pot The install takes about 30 minutes and will reboot. The user is tsec…

GNOME is now 20 years old, with development first announced in 1997. But what has the journey been like? After the initial announcement, it took a year and a half for the first major release to take place, with version 1.0 dropping in March 1999. Announcing it at the Linux World Conference, Miguel de Icaza waxed lyrical about what GNOME would mean for the future of Linux computing. He wasn’t wrong. Version 1.2 "Bongo" arrived in May 2000 and had the confidence to describe itself as a “dramatic step forward in the usability, attractiveness, and stability of the GNOME desktop.” End users would apparently be able to “impress their grandparents and younger siblings.” The last 1.x release, 1.4 "Tranquility" landed in April 2001, promising to "take free software to a…

Given that the fastest supercomputers have millions of cores in thousands of processors, it might come as a surprise to learn that the first supercomputers had just a single processor. Those weren’t just any old processors, but so-called vector processors, usually designed specifically for a particular supercomputer. Vector processors achieved their performance advantage by allowing a particular operation to be carried out on a whole string of data values as a single operation. Indeed, proprietary CPUs, designed for lightning speed, were commonplace in the world of supercomputing until well into the 1990s. The decline in vector processors was brought about by the availability of high-performance RISC processors. Designed for use in engineering workstations and servers, these processor families included the DEC Alpha, IBM POWER, Sun SPARC, HP PA-RISC and MIPS.…

In all the hype around Bitcoin, the real story – blockchain technology – has struggled to be heard outside of tech circles. There are a number of interesting open source blockchain projects (see Opening the Blockchain box, below), but the fastest growing is Hyperledger. Under the watchful care of the Linux Foundation and with strong backing from IBM, it’s built for real business use. Hyperledger enables the same anonymity, trackability and security as Bitcoin, but allows the construction of private blockchains with membership services and assigned roles. Fabric is the first Hyperledger implementation to be released from incubator status. We caught up with IBM’s Chris Ferris – who sits on the project’s governing board, as well as helping to manage the release process for v1.0 of Fabric – about the…

Fintech has had a boom in the past decade, but these post-crash years have also seen a growing awareness of fundamental flaws in the system of banking, and indeed the nature of money – that we take for granted – that stretches way beyond acquisitive speculation in Bitcoin. Innovative groups such as Positive Money (http://positivemoney.org) work to educate parliamentarians and the public on why the way money is generated (since 1694) works against the wider economy. As it stands, we have a system where 97% of money is created by 46 banks (as debt), and 3% by the government (as cash). Meanwhile, interest in local currencies and complementary systems, such as time banks, continues to grow. Cumbria University’s Institute for Leadership & Sustainability (IFLAS) runs a Money & Society MOOC…

Formerly known as rkhunter, Lynis is one of the most popular security auditing tools for Linux. Although favoured by sysadmins, it's a must-have tool if you’re running a server or allow remote access through SSH while its ease of use and simplicity of operation can also help home users. Lynis will study the config files of the installed applications, report user accounts without passwords, check firewall rules, identify expired SSL certificates, and much more. In all, the tool will run hundreds of tests on the host machine, but it doesn’t require any extra software. Rather than automatically addressing problems, it generates a report listing all the identified issues and provides tips on how to harden the system more effectively. You can grab the latest version of Lynis with git clone…

Security hardening involves poorly configured systems, from a security point of view, being identified and made to conform to security standards. This applies to the different layers of a system such as the network, where it’ll enable the firewall. On the software level, hardening involves removing packages with known issues, allowing only signed packages to be installed and so on. Ansible is a popular hardening tool that does all of the above and more. Note, however, that you’ll still need to update packages and install security updates manually. To install Ansible and run:…

01 Check disk settings When you first run your Linux distro, you may find that the installer is unable to see the main disk in your machine. This is normally because your disk mode is set to RAID rather than AHCI. This can be configured in the UEFI setup, but be aware that you’ll need to manage the change on the Windows side too (see the main text for further details), or you won’t be able to boot. 02 Create space You can free up space for your new distros either using the partitioning options in the installer or by booting up a dedicated partitioning tool such as GParted. We advise the latter, as it gives you more visual configuration and leaves you less susceptible to making an error. You…

sudo update-grub After modifying the GRUB config file (in /etc/default/ grub), you must write the changes to the main config. C + boot To access the GRUB command line, press C when GRUB is on screen. Type boot to continue booting. C + configfile filename.cfg To load an alternative config file for GRUB, use configfile then the file page (e.g. configfile (hd0,4)/boot/grub/grub.cfg). C + set + ls Use the set command to verify the boot paths GRUB is using are valid, a common cause of issues.…

If you already have a Linux server running in your home and/or business, what’s the easiest way to upgrade? One of the best things about Linux is that this process is nowhere near as painful as if you are running Windows! If you are upgrading components in an existing Linux server, typically things will ‘just work’ provided they are supported within the Linux release you are using. On the Windows platform, drivers, reactivation and blue screens are often an issue. If you are switching to a completely new box, you can quickly get started on new hardware by cloning the old OS to a new disk. If you have decided to upgrade to a better server, there’s a wealth of tools out there that will help you to benchmark the…

If you have a basic server up and running (or a file server, as discussed previously), one of the first additional requirements you ask of it is likely to be that it functions as a web server. From a hardware perspective, this task is also relatively low-powered, although if you plan to run a database with a lot of data too, RAM and processor requirements may creep up. A web server is useful for servicing both static content and scripts – work through the steps here via a shell to get started with a full LAMP (Linux, Apache, MySQL, PHP) stack. 01 Start with a full distribution Earlier on in this guide, we talked about the benefits of going with a full distribution of Linux from the off rather than…

Toni Castillo Girona holds a degree in software engineering and an MSc in computer security. He works as an ICT research support expert in a public university in Catalonia, Spain. Read his blog at http://disbauxes.upc.es. Resources EternalBlue patch http://bit.ly/EternalBluepatch Masscan www.python.org Nmap 7.50 http://bit.ly/nmaptarball GNU/Linux Kernel 2017 vulnerabilities http://bit.ly/Linuxsecurity-20177 Koodous https://koodous.com Online malware sandboxes http://bit.ly/malsandboxes Android x86 5.1 http://bit.ly/Androidx88-ISO Android SDK and NDK frameworks Apache2 tuner WannaCry, NoPetya, EternalBlue… We are all now acquainted with these names. They serve as a constant reminder that something is very wrong with our IT infrastructures or the way we manage them. Now it is all about ransomware spreading itself like a worm thanks to an old vulnerability no-one seems to have patched. Whether it is some old system your company is still running (old…

You probably remember this from your schooldays: syntax is the rule book that governs the order we put words in to create flowing, well-formed sentences when writing and speaking. In programming, it’s pretty much the same. The only difference is, poor syntax when you’re writing or speaking to other people may cause some confusion but you’re likely to make yourself understood eventually, whereas in programming you’re likely to break things. Humans can make educated guesses as to what you’re on about; machines can’t – you need to explain what you want them to do in a way that they understand. This means learning and using the correct syntax. Each programming language has its own particular grammar and syntax (just like spoken languages). In addition to this, there are also regular…

Paul O’Brien is a professional crossplatform software developer, with extensive experience of deploying and maintaining Linux systems. Android, built on top of Linux, is also one of Paul’s specialist topics. Resources Ubuntu ubuntu.com Apache apache.org MySQL mysql.com PHP secure.php.net Let’s Encrypt letsencrypt.org certbot-auto github.com/certbot/certbot Cloudflare cloudflare.com phpMyAdmin phpmyadmin.net Webmin webmin.com Webmin Authentic Theme github.com/qooob/authentic-theme MySQL tuner mysqltuner.pl Apache2 tuner apache2buddy.pl Percona percona.com Statistics show that Linux powers around 67 per cent of all web servers, despite having much lower penetration on the desktop. There are lots of reasons for this – for hobbyists the OS is free, for corporations it’s powerful yet lightweight (particularly compared to Windows servers) and there is a vast range of software that’s ready to deploy on the OS. The most common use case for Linux web…

Mayank Sharma is an expert tech journalist specialising in Linux and open source and a former contributing editor of Linux.com. Resources FOG http://bit.ly/FogCloning FOG Wiki http://wiki.fogproject.org Deploy FOG inside a virtual machine http://bit.ly/FogVirtualBox You are about to call it day, smiling to yourself that you still have time to make it to dinner. But just before you log off, the boss asks you to provision five computers on the second and third floors for the interns joining tomorrow. As you drag yourself up the stairs, you nervously twiddle the phone anticipating the unpleasant conversation during the call you are about to make. The life of a system administrator isn’t easy. Managing a network full of computers can sap the energy out of any admin, irrespective of the size of your…

Ubuntu Ubuntu is the undisputed heavyweight in today’s Linux market as the most widely used consumer distro, with a strong and growing presence in enterprise. This market-leading position is justified – for the majority of users, it is simply the best choice. Aside from the fact that the Debian-based distro is stable, frequently updated, polished and an intuitive switch for new Linux users, a key benefit of choosing Ubuntu is the vast amount of community support out there should you have any issues. If you come across a problem, there’s a good chance someone will be able to help you out. U The default Unity desktop environment is intuitive yet powerful and flexible, and early previews of the forthcoming GNOME move (Ubuntu owner Canonical is discontinuing Unity) indicate that this…

Kali Linux A growing number of Linux distros are available that are tailored to a specific purpose. Many are related to information security. This is in part due to the requirement for penetration and security testing devices to be isolated from the internet and parts of their host environment wherever possible, but also because of the large number of specialist tools that are required in this area. Kali Linux is a Debian-based distribution specifically designed for penetration testing and maintained by Offensive Security, a respected penetration-testing training provider with a long history in the industry. As a successor to the similarly well respected Backtrack toolkit which was originally based on Knoppix, the distro contains over 600 pre-installed packages and can be either installed locally or run directly as a live-boot…

openSUSE Tumbleweed The majority of Linux releases work on a fixed release cycle. A version is released, it will receive updates for a set period of time and after a release drops, work will begin on its successor. This works very well for ensuring stability (with beta and release candidates), but it adds an extra overhead for users as updates are applied and delays the speed with which the latest package updates can be delivered to users. A rolling-release distro instead delivers packages to users on a rolling basis, helping them stay up to date much more quickly, albeit potentially at the expense of ultimate stability. One of the most popular rolling-release Linux distros is the aforementioned Arch Linux; however, the rolling-release version of openSUSE – Tumbleweed – potentially brings…

Based on Debian, Whonix is an OS designed for advanced security and privacy that runs directly within Qubes. It addresses potential attacks while still maintaining system usability with pre-installed, preconfigured apps. Whonix makes online anonymity possible via fail-safe, automatic and desktop-wide use of the Tor network. The OS provides a TwoVM split security architecture with isolated ‘Whonix-Gateway’ (ProxyVM) for total Tor traffic routing and ‘Whonix- Workstation’ (AppVM) for user desktop apps, which serves as a tailored OS environment for Tor-based privacy/anonymity. Within Qubes, you can even create multiple ProxyVM and AppVM instances to keep your digital work and personal lives separate.…

Nitish Tiwari is a software developer by profession, with a huge interest in free and open source software. As well as serving as community moderator and author for leading FOSS publications, he helps organisations adopt open source software for their business needs. Computers are complex: a seemingly simple operation like opening a file may need thousands of operations taking place internally to succeed. Even if one instruction fails, your file won’t open. If there is a human working with the computer, such failure is not a big deal. Humans can recognise and correct the error that caused an operation to fail. However, if there are several computers working on complex tasks with minimal human interaction, it is critical to make sure you get to know about failures upfront. Monit is…

What’s new in Cinnamon 3.4 Cinnamon 3.4 was released in May this year and has now made its way to the latest Linux Mint release (it can also be installed on other distros). Although primarily a bug fix and performance release, the new version adds a number of new features including a desktop grid; multi-process improvements; wildcard support in file search; desktop actions in panel launcher; additional screensaver config options; better configuration of mice acceleration and sensitivity; and manage-systemdunits and lightdm-settings support in system settings (important as Mint 18.2 moves to LightDM). A new website – https://cinnamon-spices.linuxmint.com is available for Spices: themes, applets, desklets and extensions for Cinnamon. Nearly 300 are currently available, allowing extensive customisation of the Cinnamon experience.…

• Set up a honeypot, p10 Learn how to set up a medium-interaction SSH honeypot, which logs the entire shell interaction and brute-force attacks. What we used: Kippo (https://github.com/desaster/kippo) and its fork called Cowrie. Kippo and Cowrie (www.micheloosterhof.com/cowrie) are easy to install and they are the most popular over the internet honeypots. • Processing the data, p12 Discover how to shape the attack and attacker profile by analysing the data within the kippo.log file and folders such as log and tty. What we used: Python script playlog.py to display a real-time recorded attacker shell interaction. • Visualise the data, p14 How to graphically see all the information collected by Kippo and Cowrie in a web browser. What we used: Kippo-Graph (http://bruteforcelab.com/kippo-graph) a script to visualise statistics and any other data…

01 Get the prerequisites Kippo-Graph is accessed from the web browser, so you need to install an Apache server (sudo apt -get update followed up by sudo apt -get install apache2) and some PHP extra packages for it work properly: 02 Install Kippo-Graph (GitHub) The quickest way to get up and running with Kippo-Graph is by cloning the GitHub repository. Install Git with: …if you don’t have it already, followed by: 03 Install Kippo-Graph (manually) Another way to install Kippo-Graph is to download the latest version with: 04 Preparing Kippo-Graph Copy the folder cloned or copied in Step 2 or 3 to /var/www/html, then change to that folder with cd /var/html/kippograph- 1.5.1/. Next, set up full read, write and execute permissions to the generatedgraphs folder with sudo chmod 777 generated-graphs.…

01 BIOS settings – AHCI vs RAID Installing Linux alongside Windows is usually fairly painless – for many installs, you don’t need to disable Secure Boot now as most distros are signed. However, sometimes, the installer runs but you can’t see your hard disk. This can be resolved by switching the hard disk mode from RAID to AHCI – provided you aren’t specifically using RAID features, this should cause no ill effects. You will need to give Windows a heads-up or you’ll get a blue screen! 02 Prepare Windows for AHCI From a Windows admin privilege command prompt, type bcdedit /set {current} safeboot minimal. Reboot to BIOS and change the mode. Save and reboot to Windows and the operating system will automatically start in Safe Mode. Now, again from a…

New to Linux and not completely convinced by GNOME and maybe even thinking about switching away from Ubuntu? Then take a good look at these three Ubuntu-based alternative distros… Elementary OS Ubuntu-based Elementary OS owes as much to macOS as it does to Windows for its graphical style – it looks stunning. The distro is also extremely intuitive, even for new users. Zorin OS Zorin OS is an Ubuntu-based distro designed to make Windows users feel at home, with themes for Windows XP, 2000 and the ‘modern’ Windows 7 style. Kubuntu If you don’t want to go full-copycat, Kubuntu is a great option with a desktop that is similar in concept. Windows themes for KDE are available too.…

Supercomputers are power-hungry beasts so, because of concerns of the environmental impact of energy generation, attention is turning to efficiency – enter the Green 500 list. Now the important metric is the amount of computing power per unit of electrical power. With a figure of 9.46 gigaflops per watt, the top spot goes to DGX SATURNV, Nvidia’s first petascale in-house supercomputer, which is also ranked at 28th in the Top 500 list. The secret of DGX SATURNV’s success is its extensive use Tesla P100 GPUs, no fewer than 1,000 of them, that work alongside the 60,512 CPU cores provided by Intel Xeon E5-2698v4, 2.2GHz processors and a massive 63,488GB of RAM.…

It’s less than a decade since the blockchain appeared: a list of records (blocks), each timestamped and linked to the previous block. As the design makes them resistant to tampering, a blockchain provides an open, distributed ledger, recording transactions in a way that’s taken them way beyond crypto currency and into supply chains, identity management and records management. Ethereum is an open source, public, blockchain-based distributed computing platform created to provide a more generally scriptable platform than Bitcoin; it provides a Turing-complete virtual machine, and contracts can be scripted in Solidity, an entirely new language created for the purpose. Given the hard limit on Ether, the currency used on the Ethereum platform, there remain similar problems to Bitcoin with attacks and speculation. Ethereum rival Ripple is a consensus ledger and…

1. HTT PS Everywhere Available for Firefox, Chromium, Opera and many other browsers, it ensures all communications with websites are SSL-encrypted. 2. Ghostery This extension disables trackers on websites like Facebook and Google such that data is not collected even after you navigate away from the sites, as is increasingly becoming the norm. 3. NoScript Disables all scripts such as Flash, Java, JavaScript and other executable content on a web page. It enables you to create a whitelist of trusted websites, like your bank, but takes getting used to. 4. WOT Web of Trust maintains a list of trusted websites. For each website you visit, a green icon indicates a trustworthy site, yellow tells you to be cautious and red indicates potential danger. 5. BetterPrivacy LSOs are ‘super-cookies’ that can…

01 Choose an approach Running multiple distros from one disk may put a squeeze on storage, so sharing a single data store between the different distros can really help. But which approach is right for you? To take advantage of sharing profile scripts, configs and such, consider sharing your home directory. If you only want to share documents, just use an extra data partition. 02 Set up the partition The easiest way to re-partition your disk is to use a live-boot distro with GParted included. Sizing down the free space in your last partition will be the quickest way to gain room, but it may also be a good opportunity to shrink all your partitions (including Windows) to make space for both the new area and any additional distros. You'll…

If you currently run or you’re looking to run a Linux-based server for your home or smallto- medium size enterprise (SME), we’re here to help you choose the right hardware and the right software for your needs. Of course, exactly what your server build will look like will depend largely on which functions you want it to perform, but there are lots of considerations aside from raw performance, such as cost, future scalability, security and support. There are other aspects to consider, too. Is your use case best suited to a single server, or would multiple boxes be better? If, for example, you plan to have a machine doing a particularly CPU-intensive task (such as video transcoding), then you might want to move other functions such as web or file…

While there is plenty of guidance to help you choose the best hardware for an office or gaming PC, there isn’t as much available for server configurations – understandable perhaps, as it is a little bit more niche. The priorities when building a server, though, are very different – aside from having the appropriate performance to carry out the tasks for which it will be needed, there are additional considerations such as power usage, heat, noise, resilience and longevity. It doesn’t make sense to be upgrading a server frequently if you can choose the right components up front. Chassis The chassis (or case) might seem unimportant for a server compared to a desktop machine you’re going to use at home, but that’s not so – you’re just looking for different…

Toni Castillo Girona holds a bachelor's degree in Software Engineering and works as an ICT research support expert in a public university sited in Catalonia (Spain). He writes regularly about GNU/Linux in his blog: disbauxes.upc.es. Resources Censys Engine https://censys.io Gitrob https://github.com/michenriksen/gitrob theHarvester http://bit.ly/1R8DaPr The Google Hacking Database http://bit.ly/1MvODnO Recon-ng http://bit.ly/18Dcs0F WhatWeb http://bit.ly/2dylVdp FOCA http://bit.ly/1eFHHMv Kali Linux https://www.kali.org/ Knowledge is power. Knowledge feeds on information and data, therefore we can increase our knowledge by gathering as much information and data as possible. Once we have all this new knowledge, we can make informed decisions. This is how attackers see our massive interconnected world of computers and networks: as an almost everlasting pool of sensitive information holding data that can be leveraged to gain a foothold on a system. Surprisingly enough, the vast…

Sean Kinzer I’m the lead solutions engineer for SourceClear, helping customers build software safely. When I’m not helping provide better security defence, I play the attack position in lacrosse. Resources Linux or OSX machine with internet access Python 2.7.x and pip installed on the local path Git 1.9.3+ A free SourceClear.com account https://www.sourceclear.com/ The average software project today relies on dozens – sometimes hundreds – of open source libraries. Are those libraries up to date? Are there any security vulnerabilities in the versions you’re using? How would you even know? SourceClear makes it easy to answer these questions and more, automatically. You’ll get complete analysis of your open-source dependencies – security vulnerabilities, out-ofdate libraries, and license reports. To analyse your project, we’ll be using the SourceClear command-line agent. By tapping…

John Gowers is a university tutor in Programming and Computer Science. He likes to install Linux on every device he can get his hands on, and uses terminal commands and shell scripts on a daily basis. Resources Most of the tools we will be using in this tutorial are standard on any Linux distribution, but you might need to install the wget command.u If you’re a Linux user, you’ve probably used the terminal before, even if only once or twice, and you might have dived into the world of shell scripting: the terminal is at the heart of Linux. While we should celebrate the fact that it’s now possible to do so much in a Linux system without touching the terminal, it remains the case that if you master the…

The VBoxManage startvm option helps launch a local instance of a VM. But if you are using the CLI to interact with a remote VirtualBox installation, you’ll want to start a VM in the headless mode and then stream its desktop using the app’s VRDP protocol. First, ensure you’ve installed the guest additions inside the guest OS. Now enable the VRDP server with VBoxManage modifyvm Debian9 --vrde on. Start the remote VM in headlessmode with VBoxHeadless --startvm Debian9 &. By default the VRDP server listens for connections on port 3389. You can now connect to it using a remote desktop client. VirtualBox’s VRDP protocol is backwards compatible with the RDP protocol, so you can use any RDP viewer to connect to the remote VM. On Linux hosts, VirtualBox also installs…

There are no definitive metrics, but anecdotal evidence suggests that Linux users have a tendency to start with a particular distro and stick with it regardless of what they are doing and how the Linux scene progresses. It makes sense: we all get familiar with our chosen environment and the more we use it, the more effective we become at achieving what we set out to do. The same applies when it comes to not just the distro itself, but the open source software we use on top of it. The Linux world offers a wealth of options for distros, desktop environments and applications – with more variety than on any other operating system, there are choices to be made at every turn. Fortunately, we are here to guide you…

Arch Linux Arch Linux is a lightweight and flexible Linux distro that targets more advanced users. Whereas an everyday distribution such as Ubuntu looks to install a broad set of applications from the off to support a range of different use cases, Arch takes a different approach – a minimal system base is installed, which the user can then tailor for their own purpose. Arch is very much aimed at users comfortable with shell usage – in most cases GUI configuration is not provided, configuration instead being managed by directly editing text files. While most distros have regular release cycles, Arch uses a ‘rolling release’ model as it looks to stay on the bleeding edge, negating the need for periodic ‘major release upgrades’. Arch’s repositories will typically always contain the…

Qubes OS Qubes OS is touted by its developers as ‘a reasonably secure operating system’ but in reality, it offers huge benefits over standard distros from a security perspective – if you are willing to put in a little bit of effort. Advocated as ‘the best OS available today’ by none other than whistle-blower Edward Snowden, this level of praise is the norm rather than the exception among privacy experts. Key to the Qubes OS concept is the concept of compartmentalisation. The distro focuses on splitting all of the activities you carry out in your typical use of your Linux machine into securely isolated compartments known as ‘Qubes’. The easiest way to think about each Qube is like a standard virtual machine, which makes sense – the underlying technology is…

LXLE Recommending the best lightweight Linux distro is always a tricky task. First, because Linux itself runs so well on low-end hardware that there are lots of candidates and second, because the low-end desktop environments can also run on a variety of distros. With that said, we’ve picked LXLE as our distro of choice. An obvious option for the best lightweight distro is Lubuntu, the Ubuntu flavour that comes equipped with the LXDE desktop environment. LXDE (Lightweight X11 Desktop Environment) is based on GTK+ 2 (although a Qt port is in development as the future for the product) and is also the default desktop environment for Knoppix, Peppermint and other good low-end distros. LXLE is based on Lubuntu, but it is particularly tuned to be a drop-in and go OS,…

After you’ve created your Porteus disc or USB stick, you’ll find a /boot/docs/cheatcodes.txt file detailing the Porteus ‘cheatcodes’. These are used to affect the booting process of Porteus. You can use them to disable desired kinds of hardware detection, start Porteus from a specific location, load additional modules, and much more. To use the codes, reboot your computer and wait several seconds until the graphical Porteus logo appears with a boot menu. Choose your desired menu entry and hit Tab, which will allow you to edit the command line. Add your desired boot argument to affect booting the way you like. These cheatcodes can also be added to the APPEND line of your /boot/syslinux/porteus.cfg entries (or other bootloader config files) to apply them automatically on every boot. For example, the…

01 Download the ISO The JonDo/Tor-Secure-Live-DVD ISO can be downloaded from http://bit.ly/JonDo. The release itself is about 1.2GB in size, and includes a SHA256 hash on the site. You should verify this before installing to ensure that the file hasn’t been tampered with (this is good practice, but particularly important with security-related distros!). Doing so is as simple as using the sha256sum command, followed by the filename. If the checksum doesn’t match, don’t use the image! An OpenPGP signature is also available on the page for additional security. 02 Select firewall mode Upon booting the ISO, you’ll first be asked to select a firewall mode. Three options are available: the ‘Simple Firewall’ blocks all inbound connections but allows all outbound ones. All installed applications will be able to connect to…

01 Download and burn ISO To get started with SystemRescueCD, download the ISO file for your architecture. Generally speaking, you’ll need the x86 edition that supports both 32- and 64-bit processors. Once the image is downloaded, check the checksum using the md5 command. Next, either burn the image to a CD or use isohybrid to convert to a bootable image and use dd to copy to the appropriate device using dd if=/path/filename of=/ dev/sdx, where sdx is the USB stick. 02 Boot it up With the image ready to go, insert the SystemRescueCd disk or USB stick and boot your system. Press F2/F3/F4/F5/F6 and read the advanced boot instructions or press Enter at the prompt to boot with the default options. There are two parts in the boot command –…

Nitish Tiwari is a software developer by profession, with a huge interest in Free and Open Source software. As well as serving as community moderator and author for leading FOSS publications, he also helps organisations adopt open source software for their business needs. A computer network is not complete without a resourcemonitoring component. While there is no dearth of such monitoring tools, a tried and tested tool is always better than relatively new tools – especially when it comes to network uptime and reliability. In this tutorial we will take a look at one such reliable networked resource monitoring tool called Munin. It lets you easily monitor the performance of not only your computers, but networks, SANs, applications, and various other resources. Written in Perl, Munin is easily extensible and…

27 AUGUST 2006 The first version of Linux Mint is released, based on Kubuntu 6.06. Version 1.0 ‘Ada’ will be the only version of the Mint distribution to offer only a KDE desktop environment option. 8 JUNE 2008 The first ‘LTS ’ (Long Term Support) version of Linux Mint arrives with version 5 ‘Elyssa’. Based on Ubuntu 8.04, the release offers several variations and multiple desktop environments, including Fluxbox. 18 MAY 2010 As quickly as it appeared, the Flubox desktop environment makes its last appearance in a Linux Mint distro with version 9 ‘Isadora’. Xfce remains as the ultra-light environment offering. 7 SEPTEMBER 2010 LMDE is an alternative version of Linux Mint that comes with a Debian base. LMDE is implemented as a rolling release distribution and not tied to…

Pix An image browser, viewer, organiser and editor with support for digital camera importing, slide shows, image renaming, image conversion and duplicate removal. Plus a plug-in system for extensions. Xplayer A powerful media player that can read many file formats. The app supports DVD playback, TV out, full-screen mode, keyboard control, subtitles and, like Pix, an extensible plug-in system. Xed This text editor replaced Gedit and Puma in Mint 18. While a simple editor, Xed has more features than most, including syntax highlighting, remote file editing, file comparison, file history, plug-in customisation and a tab-based UI.…

RAM 1GB Storage 20GB Specs 1GHz processor and HD graphics Available from www.linuxmint.com/download.php Linux Mint, both as a project and a product, continues to mature in stature with every release. In fact, the recent few releases have been so solid that it appears the project puts out beta releases as a mere formality only to honour the software release life cycle policy. This release is no different, which like the previous ones is based on the thoroughly tested Ubuntu 16.04 LTS release, in accordance with Mint’s new policy of sticking with LTS Ubuntu bases. Mint has replaced its MDM display manager with LightDM, which is futureproof as it supports different display servers including Wayland and Mir. LightDM powers Mint’s new greeter called Slick that supports HiDPI resolutions. Also, by default,…