API tools faq
paste
Advertisement
Guest User

bi0os

a guest
Apr 5th, 2009
973
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
Bash 121.51 KB | None | 0 0
raw download clone embed print report
  1. Running kernel and system information
  2.  
  3. # uname -a                           # Get the kernel version (and BSD version)
  4. # cat /etc/SuSE-release              # Get SuSE version
  5. # cat /etc/debian_version            # Get Debian version
  6.  
  7.  
  8. Use /etc/DISTR-release with DISTR= lsb (Ubuntu), redhat, gentoo, mandrake, sun (Solaris), and so on.
  9.  
  10. # uptime                             # Show how long the system has been running + load
  11. # hostname                           # system's host name
  12. # hostname -i                        # Display the IP address of the host.
  13. # man hier                           # Description of the file system hierarchy
  14. # last reboot                        # Show system reboot history
  15.  
  16.  
  17. Hardware Informations
  18.  
  19. Kernel detected hardware
  20.  
  21. # dmesg                              # Detected hardware and boot messages
  22. # lsdev                              # information about installed hardware
  23. # dd if=/dev/mem bs=1k skip=768 count=256 2>/dev/null | strings -n 8 # Read BIOS
  24.  
  25.  
  26. Linux
  27.  
  28. # cat /proc/cpuinfo                  # CPU model
  29. # cat /proc/meminfo                  # Hardware memory
  30. # grep MemTotal /proc/meminfo        # Display the physical memory
  31. # watch -n1 'cat /proc/interrupts'   # Watch changeable interrupts continuously
  32. # free -m                            # Used and free memory (-m for MB)
  33. # cat /proc/devices                  # Configured devices
  34. # lspci -tv                          # Show PCI devices
  35. # lsusb -tv                          # Show USB devices
  36. # lshal                              # Show a list of all devices with their properties
  37. # dmidecode                          # Show DMI/SMBIOS: hw info from the BIOS
  38.  
  39.  
  40. FreeBSD
  41.  
  42. # sysctl hw.model                    # CPU model
  43. # sysctl hw                          # Gives a lot of hardware information
  44. # sysctl vm                          # Memory usage
  45. # dmesg | grep "real mem"            # Hardware memory
  46. # sysctl -a | grep mem               # Kernel memory settings and info
  47. # sysctl dev                         # Configured devices
  48. # pciconf -l -cv                     # Show PCI devices
  49. # usbdevs -v                         # Show USB devices
  50. # atacontrol list                    # Show ATA devices
  51.  
  52.  
  53. Load, statistics and messages
  54.  
  55. The following commands are useful to find out what is going on on the system.
  56.  
  57. # top                                # display and update the top cpu processes
  58. # mpstat 1                           # display processors related statistics
  59. # vmstat 2                           # display virtual memory statistics
  60. # iostat 2                           # display I/O statistics (2 s intervals)
  61. # systat -vmstat 1                   # BSD summary of system statistics (1 s intervals)
  62. # systat -tcp 1                      # BSD tcp connections (try also -ip)
  63. # systat -netstat 1                  # BSD active network connections
  64. # systat -ifstat 1                   # BSD network traffic through active interfaces
  65. # systat -iostat 1                   # BSD CPU and and disk throughput
  66. # tail -n 500 /var/log/messages      # Last 500 kernel/syslog messages
  67. # tail /var/log/warn                 # System warnings messages see syslog.conf
  68.  
  69.  
  70. Users
  71.  
  72. # id                                 # Show the active user id with login and group
  73. # last                               # Show last logins on the system
  74. # who                                # Show who is logged on the system
  75. # groupadd admin                     # Add group "admin" and user colin (Linux/Solaris)
  76. # useradd -c "Colin Barschel" -g admin -m colin
  77. # userdel colin                      # Delete user colin (Linux/Solaris)
  78. # adduser joe                        # FreeBSD add user joe (interactive)
  79. # rmuser joe                         # FreeBSD delete user joe (interactive)
  80. # pw groupadd admin                  # Use pw on FreeBSD
  81. # pw groupmod admin -m newmember     # Add a new member to a group
  82. # pw useradd colin -c "Colin Barschel" -g admin -m -s /bin/tcsh
  83. # pw userdel colin; pw groupdel admin
  84.  
  85.  
  86. Encrypted passwords are stored in /etc/shadow for Linux and Solaris and /etc/master.passwd on FreeBSD. If the master.passwd is modified manually (say to delete a password), run # pwd_mkdb -p master.passwd to rebuild the database.
  87.  
  88.  
  89. To temporarily prevent logins system wide (for all users but root) use nologin. The message in nologin will be displayed.
  90.  
  91. # echo "Sorry no login now" > /etc/nologin       # (Linux)
  92. # echo "Sorry no login now" > /var/run/nologin   # (FreeBSD)
  93.  
  94.  
  95.  
  96. Limits
  97.  
  98. Some application require higher limits on open files and sockets (like a proxy
  99. web server, database). The default limits are usually too low.
  100. Linux
  101.  
  102. Per shell/script
  103.  
  104. The shell limits are governed by ulimit. The status is checked
  105. with ulimit -a. For example to change the open files limit from
  106. 1024 to 10240 do:
  107.  
  108. # ulimit -n 10240                    # This is only valid within the shell
  109.  
  110.  
  111. The ulimit command can be used in a script to change the limits for the script only.
  112.  
  113. Per user/process
  114.  
  115. Login users and applications can be configured in /etc/security/limits.conf. For example:
  116.  
  117. # cat /etc/security/limits.conf
  118. *   hard    nproc   250              # Limit user processes
  119. asterisk hard nofile 409600          # Limit application open files
  120.  
  121.  
  122. System wide
  123.  
  124. Kernel limits are set with sysctl. Permanent limits are set in /etc/sysctl.conf.
  125.  
  126. # sysctl -a                          # View all system limits
  127. # sysctl fs.file-max                 # View max open files limit
  128. # sysctl fs.file-max=102400          # Change max open files limit
  129. # cat /etc/sysctl.conf
  130. fs.file-max=102400                   # Permanent entry in sysctl.conf
  131. # cat /proc/sys/fs/file-nr           # How many file descriptors are in use
  132.  
  133.  
  134.  
  135. FreeBSD
  136.  
  137. Per shell/script
  138.  
  139. Use the command limits in csh or tcsh or as in Linux, use ulimit in an sh or bash shell.
  140. Per user/process
  141.  
  142. The default limits on login are set in /etc/login.conf. An unlimited value is still limited by the system maximal value.
  143. System wide
  144.  
  145. Kernel limits are also set with sysctl. Permanent limits are set in /etc/sysctl.conf or /boot/loader.conf. The syntax is the same as Linux but the keys are different.
  146.  
  147. # sysctl -a                          # View all system limits
  148. # sysctl kern.maxfiles=XXXX          # maximum number of file descriptors
  149. kern.ipc.nmbclusters=32768           # Permanent entry in /etc/sysctl.conf
  150. kern.maxfiles=65536                  # Typical values for Squid
  151. kern.maxfilesperproc=32768
  152. kern.ipc.somaxconn=8192              # TCP queue. Better for apache/sendmail
  153. # sysctl kern.openfiles              # How many file descriptors are in use
  154. # sysctl kern.ipc.numopensockets     # How many open sockets are in use
  155.  
  156.  
  157. See The FreeBSD handbook Chapter 11http://www.freebsd.org/handbook/configtuning-kernel-limits.html for details.
  158.  
  159. Solaris
  160.  
  161. The following values in /etc/system will increase the maximum file descriptors per proc:
  162.  
  163. set rlim_fd_max = 4096               # Hard limit on file descriptors for a single proc
  164. set rlim_fd_cur = 1024               # Soft limit on file descriptors for a single proc
  165.  
  166.  
  167.  
  168. Runlevels
  169.  
  170. Linux
  171.  
  172. Once booted, the kernel starts init which then starts rc which starts all scripts belonging to a runlevel. The scripts are stored in /etc/init.d and are linked into /etc/rc.d/rcN.d with N the runlevel number.
  173.  
  174. The default runlevel is configured in /etc/inittab. It is usually 3 or 5:
  175.  
  176. # grep default: /etc/inittab                                        
  177. id:3:initdefault:
  178.  
  179.  
  180. The actual runlevel (the list is shown below) can be changed with init. For example to go from 3 to 5:
  181.  
  182. # init 5                             # Enters runlevel 5
  183.  
  184.  
  185.  
  186.     *   0       Shutdown and halt
  187.  
  188.     *   1       Single-User mode (also S)
  189.  
  190.     *   2       Multi-user without network
  191.  
  192.     *   3       Multi-user with network
  193.  
  194.     *   5       Multi-user with X
  195.  
  196.     *   6       Reboot
  197.  
  198.  
  199. Use chkconfig to configure the programs that will be started at boot in a runlevel.
  200.  
  201. # chkconfig --list                   # List all init scripts
  202. # chkconfig --list sshd              # Report the status of sshd
  203. # chkconfig sshd --level 35 on       # Configure sshd for levels 3 and 5
  204. # chkconfig sshd off                 # Disable sshd for all runlevels
  205.  
  206.  
  207. Debian and Debian based distributions like Ubuntu or Knoppix use the command update-rc.d to manage the runlevels scripts. Default is to start in 2,3,4 and 5 and shutdown in 0,1 and 6.
  208.  
  209. # update-rc.d sshd defaults          # Activate sshd with the default runlevels
  210. # update-rc.d sshd start 20 2 3 4 5 . stop 20 0 1 6 .  # With explicit arguments
  211. # update-rc.d -f sshd remove         # Disable sshd for all runlevels
  212. # shutdown -h now (or # poweroff)    # Shutdown and halt the system
  213.  
  214.  
  215.  
  216. FreeBSD
  217.  
  218. The BSD boot approach is different from the SysV, there are no runlevels. The final boot state (single user, with or without X) is configured in /etc/ttys. All OS scripts are located in /etc/rc.d/ and in /usr/local/etc/rc.d/ for third-party applications. The activation of the service is configured in /etc/rc.conf and /etc/rc.conf.local. The default behavior is configured in /etc/defaults/rc.conf. The scripts responds at least to start|stop|status.
  219.  
  220. # /etc/rc.d/sshd status
  221. sshd is running as pid 552.
  222. # shutdown now                       # Go into single-user mode
  223. # exit                               # Go back to multi-user mode
  224. # shutdown -p now                    # Shutdown and halt the system
  225. # shutdown -r now                    # Reboot
  226.  
  227.  
  228. The process init can also be used to reach one of the following states level. For example # init 6 for reboot.
  229.  
  230.  
  231.     *   0       Halt and turn the power off (signal USR2)
  232.  
  233.     *   1       Go to single-user mode (signal TERM)
  234.  
  235.     *   6       Reboot the machine (signal INT)
  236.  
  237.     *   c       Block further logins (signal TSTP)
  238.  
  239.     *   q       Rescan the ttys(5) file (signal HUP)
  240.  
  241.  
  242.  
  243. Reset root password
  244.  
  245. Linux method 1
  246.  
  247. At the boot loader (lilo or grub), enter the following boot option:
  248.  
  249. init=/bin/sh
  250.  
  251.  
  252. The kernel will mount the root partition and init will start the bourne shell
  253. instead of rc and then a runlevel. Use the command passwd at the prompt to change the password and then reboot. Forget the single user mode as you need the password for that.
  254.  
  255. If, after booting, the root partition is mounted read only, remount it rw:
  256.  
  257. # mount -o remount,rw /
  258. # passwd                             # or delete the root password (/etc/shadow)
  259. # sync; mount -o remount,ro /        # sync before to remount read only
  260. # reboot
  261.  
  262.  
  263.  
  264. FreeBSD and Linux method 2
  265.  
  266. FreeBSD won't let you go away with the simple init trick. The solution is to mount the root partition from an other OS (like a rescue CD) and change the password on the disk.
  267.  
  268.  
  269.    *   Boot a live CD or installation CD into a rescue mode which will give you a shell.
  270.  
  271.    *   Find the root partition with fdisk e.g. fdisk /dev/sda
  272.  
  273.    *   Mount it and use chroot:
  274.  
  275.  
  276. # mount -o rw /dev/ad4s3a /mnt
  277. # chroot /mnt                        # chroot into /mnt
  278. # passwd
  279. # reboot
  280.  
  281.  
  282. Alternatively on FreeBSD, boot in single user mode, remount / rw and use passwd.
  283.  
  284. # mount -u /; mount -a               # will mount / rw
  285. # passwd
  286. # reboot
  287.  
  288.  
  289.  
  290. Kernel modules
  291.  
  292. Linux
  293.  
  294. # lsmod                              # List all modules loaded in the kernel
  295. # modprobe isdn                      # To load a module (here isdn)
  296.  
  297.  
  298. FreeBSD
  299.  
  300. # kldstat                            # List all modules loaded in the kernel
  301. # kldload crypto                     # To load a module (here crypto)
  302.  
  303.  
  304. Compile Kernel
  305.  
  306. Linux
  307.  
  308. # cd /usr/src/linux
  309. # make mrproper                      # Clean everything, including config files
  310. # make oldconfig                     # Create a new config file from the current kernel
  311. # make menuconfig                    # or xconfig (Qt) or gconfig (GTK)
  312. # make                               # Create a compressed kernel image
  313. # make modules                       # Compile the modules
  314. # make modules_install               # Install the modules
  315. # make install                       # Install the kernel
  316. # reboot
  317.  
  318.  
  319. FreeBSD
  320.  
  321. To modify and rebuild the kernel, copy the generic configuration file to a new name and edit it as needed. It is however also possible to edit the file GENERIC directly.
  322.  
  323. # cd /usr/src/sys/i386/conf/
  324. # cp GENERIC MYKERNEL
  325. # cd /usr/src
  326. # make buildkernel KERNCONF=MYKERNEL
  327. # make installkernel KERNCONF=MYKERNEL
  328.  
  329.  
  330. To rebuild the full OS:
  331.  
  332. # make buildworld                    # Build the full OS but not the kernel
  333. # make buildkernel                   # Use KERNCONF as above if appropriate
  334. # make installkernel
  335. # reboot
  336. # mergemaster -p                     # Compares only files known to be essential
  337. # make installworld
  338. # mergemaster                        # Update all configuration and other files
  339. # reboot
  340.  
  341.  
  342. For small changes in the source, sometimes the short version is enough:
  343.  
  344. # make kernel world                  # Compile and install both kernel and OS
  345. # mergemaster
  346. # reboot
  347.  
  348.  
  349.  
  350.  
  351. Processes
  352.  
  353. Listing | Priority | Background/Foreground | Top | Kill
  354.  
  355. Listing and PIDs
  356.  
  357. Each process has a unique number, the PID. A list of all running process is retrieved with ps.
  358.  
  359. # ps -auxefw                         # Extensive list of all running process
  360.  
  361.  
  362. However more typical usage is with a pipe or with pgrep:
  363.  
  364. # ps axww | grep cron
  365.  586  ??  Is     0:01.48 /usr/sbin/cron -s
  366. # pgrep -l sshd                      # Find the PIDs of processes by (part of) name
  367. # fuser -va 22/tcp                   # List processes using port 22
  368. # fuser -va /home                    # List processes accessing the /home partiton
  369. # strace df                          # Trace system calls and signals
  370. # truss df                           # same as above on FreeBSD/Solaris/Unixware
  371. # history | tail -50                 # Display the last 50 used commands
  372.  
  373.  
  374.  
  375. Priority
  376.  
  377. Change the priority of a running process with renice. Negative numbers have a higher priority, the lowest is -20 and "nice" have a positive value.
  378.  
  379. # renice -5 586                      # Stronger priority
  380. 586: old priority 0, new priority -5
  381.  
  382.  
  383. Start the process with a defined priority with nice. Positive is "nice" or weak, negative is strong scheduling priority. Make sure you know if /usr/bin/nice or the shell built-in is used (check with # which nice).
  384.  
  385. # nice -n -5 top                     # Stronger priority (/usr/bin/nice)
  386. # nice -n 5 top                      # Weaker priority (/usr/bin/nice)
  387. # nice +5 top                        # tcsh builtin nice (same as above!)
  388.  
  389.  
  390.  
  391. Background/Foreground
  392.  
  393. When started from a shell, processes can be brought in the background and back to the foreground with [Ctrl]-[Z] (^Z), bg and fg. For example start two processes, bring them in the background, list the processes with jobs and bring one in the foreground.
  394.  
  395. # ping cb.vu > ping.log
  396. ^Z                                   # ping is suspended (stopped) with [Ctrl]-[Z]
  397. # bg                                 # put in background and continues running
  398. # jobs -l                            # List processes in background
  399. [1]  - 36232 Running                       ping cb.vu > ping.log
  400. [2]  + 36233 Suspended (tty output)        top
  401. # fg %2                              # Bring process 2 back in foreground
  402.  
  403.  
  404. Use nohup to start a process which has to keep running when the shell is closed (immune to hangups).
  405.  
  406. # nohup ping -i 60 > ping.log &
  407.  
  408.  
  409.  
  410. Top
  411.  
  412. The program top displays running information of processes.
  413.  
  414. # top
  415.  
  416.  
  417. While top is running press the key h for a help overview. Useful keys are:
  418.  
  419.  
  420.    *   u [user name] To display only the processes belonging to the user. Use + or blank to see all users
  421.  
  422.    *   k [pid] Kill the process with pid.
  423.  
  424.    *   1 To display all processors statistics (Linux only)
  425.  
  426.    *    R Toggle normal/reverse sort.
  427.  
  428.  
  429. Signals/Kill
  430.  
  431. Terminate or send a signal with kill or killall.
  432.  
  433. # ping -i 60 cb.vu > ping.log &
  434. [1] 4712
  435. # kill -s TERM 4712                  # same as kill -15 4712
  436. # killall -1 httpd                   # Kill HUP processes by exact name
  437. # pkill -9 http                      # Kill TERM processes by (part of) name
  438. # pkill -TERM -u www                 # Kill TERM processes owned by www
  439. # fuser -k -TERM -m /home            # Kill every process accessing /home (to umount)
  440.  
  441.  
  442. Important signals are:
  443.  
  444.  
  445.    *   1       HUP (hang up)
  446.  
  447.    *   2       INT (interrupt)
  448.  
  449.    *   3       QUIT (quit)
  450.  
  451.    *   9       KILL (non-catchable, non-ignorable kill)
  452.  
  453.    *   15     TERM (software termination signal)
  454.  
  455.  
  456.  
  457.  
  458.  
  459. File System
  460.  
  461. Disk info | Boot | Disk usage | Opened files | Mount/remount | Mount SMB | Mount image | Burn ISO | Create image | Memory disk | Disk performance
  462.  
  463. Permissions
  464.  
  465. Change permission and ownership with chmod and chown. The default umask can be changed for all users in /etc/profile for Linux or /etc/login.conf for FreeBSD. The default umask is usually 022. The umsak is subtracted from 777, thus umask 022 results in a permission 0f 755.
  466.  
  467. 1 --x execute                        # Mode 764 = exec/read/write | read/write | read
  468. 2 -w- write                          # For:       |--  Owner  --|   |- Group-|   |Oth|
  469. 4 r-- read
  470.  ugo=a                              u=user, g=group, o=others, a=everyone
  471.  
  472.  
  473. # chmod [OPTION] MODE[,MODE] FILE    # MODE is of the form [ugoa]*([-+=]([rwxXst]))
  474. # chmod 640 /var/log/maillog         # Restrict the log -rw-r-----
  475. # chmod u=rw,g=r,o= /var/log/maillog # Same as above
  476. # chmod -R o-r /home/*               # Recursive remove other readable for all users
  477. # chmod u+s /path/to/prog            # Set SUID bit on executable (know what you do!)
  478. # find / -perm -u+s -print           # Find all programs with the SUID bit
  479. # chown user:group /path/to/file     # Change the user and group ownership of a file
  480. # chgrp group /path/to/file          # Change the group ownership of a file
  481.  
  482.  
  483. Disk information
  484.  
  485. # diskinfo -v /dev/ad2               # information about disk (sector/size) FreeBSD
  486. # hdparm -I /dev/sda                 # information about the IDE/ATA disk (Linux)
  487. # fdisk /dev/ad2                     # Display and manipulate the partition table
  488. # smartctl -a /dev/ad2               # Display the disk SMART info
  489.  
  490.  
  491. Boot
  492.  
  493. FreeBSD
  494.  
  495. To boot an old kernel if the new kernel doesn't boot, stop the boot at during the count down.
  496.  
  497. # unload
  498. # load kernel.old
  499. # boot
  500.  
  501.  
  502.  
  503. System mount points/Disk usage
  504.  
  505. # mount | column -t                  # Show mounted file-systems on the system
  506. # df                                 # display free disk space and mounted devices
  507. # cat /proc/partitions               # Show all registered partitions (Linux)
  508.  
  509.  
  510.  
  511. Disk usage
  512.  
  513. # du -sh *                           # Directory sizes as listing
  514. # du -csh                            # Total directory size of the current directory
  515. # du -ks * | sort -n -r              # Sort everything by size in kilobytes
  516. # ls -lSr                            # Show files, biggest last
  517.  
  518.  
  519.  
  520. Who has which files opened
  521.  
  522. This is useful to find out which file is blocking a partition which has to be unmounted and gives a typical error of:
  523.  
  524. # umount /home/
  525. umount: unmount of /home             # umount impossible because a file is locking home
  526.    failed: Device busy
  527.  
  528.  
  529. FreeBSD and most Unixes
  530.  
  531. # fstat -f /home                     # for a mount point
  532. # fstat -p PID                       # for an application with PID
  533. # fstat -u user                      # for a user name
  534.  
  535.  
  536.  
  537. Find opened log file (or other opened files), say for Xorg:
  538.  
  539. # ps ax | grep Xorg | awk '{print $1}'
  540. 1252
  541. # fstat -p 1252
  542. USER     CMD          PID   FD MOUNT      INUM MODE         SZ|DV R/W
  543. root     Xorg        1252 root /             2 drwxr-xr-x     512  r
  544. root     Xorg        1252 text /usr     216016 -rws--x--x  1679848 r
  545. root     Xorg        1252    0 /var     212042 -rw-r--r--   56987  w
  546.  
  547.  
  548. The file with inum 212042 is the only file in /var:
  549.  
  550. # find -x /var -inum 212042
  551. /var/log/Xorg.0.log
  552.  
  553.  
  554.  
  555. Linux
  556.  
  557. Find opened files on a mount point with fuser or lsof:
  558.  
  559. # fuser -m /home                     # List processes accessing /home
  560. # lsof /home
  561. COMMAND   PID    USER   FD   TYPE DEVICE    SIZE     NODE NAME
  562. tcsh    29029 eedcoba  cwd    DIR   0,18   12288  1048587 /home/eedcoba (guam:/home)
  563. lsof    29140 eedcoba  cwd    DIR   0,18   12288  1048587 /home/eedcoba (guam:/home)
  564.  
  565.  
  566. About an application:
  567.  
  568. ps ax | grep Xorg | awk '{print $1}'
  569. 3324
  570. # lsof -p 3324
  571. COMMAND   PID    USER   FD   TYPE DEVICE    SIZE    NODE NAME
  572. Xorg    3324 root    0w   REG        8,6   56296      12492 /var/log/Xorg.0.log
  573.  
  574.  
  575.  
  576. About a single file:
  577.  
  578. # lsof /var/log/Xorg.0.log
  579. COMMAND  PID USER   FD   TYPE DEVICE  SIZE  NODE NAME
  580. Xorg    3324 root    0w   REG    8,6 56296 12492 /var/log/Xorg.0.log
  581.  
  582.  
  583.  
  584. Mount/remount a file system
  585.  
  586. For example the cdrom. If listed in /etc/fstab:
  587.  
  588. # mount /cdrom
  589.  
  590.  
  591. Or find the device in /dev/ or with dmesg
  592. FreeBSD
  593.  
  594. # mount -v -t cd9660 /dev/cd0c /mnt  # cdrom
  595. # mount_cd9660 /dev/wcd0c /cdrom     # other method
  596. # mount -v -t msdos /dev/fd0c /mnt   # floppy
  597.  
  598.  
  599. Entry in /etc/fstab:
  600.  
  601. # Device                Mountpoint      FStype  Options         Dump    Pass#
  602. /dev/acd0               /cdrom          cd9660  ro,noauto       0       0
  603.  
  604.  
  605. To let users do it:
  606.  
  607. # sysctl vfs.usermount=1  # Or insert the line "vfs.usermount=1" in /etc/sysctl.conf
  608.  
  609.  
  610.  
  611. Linux
  612.  
  613. # mount -t auto /dev/cdrom /mnt/cdrom   # typical cdrom mount command
  614. # mount /dev/hdc -t iso9660 -r /cdrom   # typical IDE
  615. # mount /dev/sdc0 -t iso9660 -r /cdrom  # typical SCSI
  616.  
  617.  
  618. Entry in /etc/fstab:
  619.  
  620. /dev/cdrom   /media/cdrom  subfs noauto,fs=cdfss,ro,procuid,nosuid,nodev,exec 0 0
  621.  
  622.  
  623. Mount a FreeBSD partition with Linux
  624.  
  625. Find the partition number containing with fdisk, this is usually the root partition, but it could be an other BSD slice too. If the FreeBSD has many slices, they are the one not listed in the fdisk table, but visible in /dev/sda* or /dev/hda*.
  626.  
  627. # fdisk /dev/sda                     # Find the FreeBSD partition
  628. /dev/sda3   *        5357        7905    20474842+  a5  FreeBSD
  629. # mount -t ufs -o ufstype=ufs2,ro /dev/sda3 /mnt
  630. /dev/sda10 = /tmp; /dev/sda11 /usr   # The other slices
  631.  
  632.  
  633. Remount
  634.  
  635. Remount a device without unmounting it. Necessary for fsck for example
  636.  
  637. # mount -o remount,ro /              # Linux
  638. # mount -o ro /                      # FreeBSD
  639.  
  640.  
  641. Copy the raw data from a cdrom into an iso image:
  642.  
  643. # dd if=/dev/cd0c of=file.iso
  644.  
  645.  
  646.  
  647. Mount an SMB share
  648.  
  649. Suppose we want to access the SMB share myshare on the computer smbserver, the address as typed on a Windows PC is \\smbserver\myshare\. We mount on /mnt/smbshare. Warning> cifs wants an IP or DNS name, not a Windows name.
  650. Linux
  651.  
  652. # smbclient -U user -I 192.168.16.229 -L //smbshare/    # List the shares
  653. # mount -t smbfs -o username=winuser //smbserver/myshare /mnt/smbshare
  654. # mount -t cifs -o username=winuser,password=winpwd //192.168.16.229/myshare /mnt/share
  655.  
  656.  
  657. Additionally with the package mount.cifs it is possible to store the credentials in a file, for example /home/user/.smb:
  658.  
  659. username=winuser
  660. password=winpwd
  661.  
  662.  
  663. And mount as follow:
  664.  
  665. # mount -t cifs -o credentials=/home/user/.smb //192.168.16.229/myshare /mnt/smbshare
  666.  
  667.  
  668.  
  669. FreeBSD
  670.  
  671. Use -I to give the IP (or DNS name); smbserver is the Windows name.
  672.  
  673. # smbutil view -I 192.168.16.229 //winuser@smbserver    # List the shares
  674. # mount_smbfs -I 192.168.16.229 //winuser@smbserver/myshare /mnt/smbshare
  675.  
  676.  
  677.  
  678. Mount an image
  679.  
  680. Linux loop-back
  681.  
  682. # mount -t iso9660 -o loop file.iso /mnt                # Mount a CD image
  683. # mount -t ext3 -o loop file.img /mnt                   # Mount an image with ext3 fs
  684.  
  685.  
  686.  
  687. FreeBSD
  688.  
  689. With memory device (do # kldload md.ko if necessary):
  690.  
  691. # mdconfig -a -t vnode -f file.iso -u 0
  692. # mount -t cd9660 /dev/md0 /mnt
  693. # umount /mnt; mdconfig -d -u 0                         # Cleanup the md device
  694.  
  695.  
  696. Or with virtual node:
  697.  
  698. # vnconfig /dev/vn0c file.iso; mount -t cd9660 /dev/vn0c /mnt
  699. # umount /mnt; vnconfig -u /dev/vn0c                    # Cleanup the vn device
  700.  
  701.  
  702.  
  703. Solaris and FreeBSD
  704.  
  705. with loop-back file interface or lofi:
  706.  
  707. # lofiadm -a file.iso
  708. # mount -F hsfs -o ro /dev/lofi/1 /mnt
  709. # umount /mnt; lofiadm -d /dev/lofi/1                   # Cleanup the lofi device
  710.  
  711.  
  712. Create and burn an ISO image
  713.  
  714. This will copy the cd or DVD sector for sector. Without conv=notrunc, the image will be smaller if there is less content on the cd. See below and the dd examples.
  715.  
  716. # dd if=/dev/hdc of=/tmp/mycd.iso bs=2048 conv=notrunc
  717.  
  718.  
  719. Use mkisofs to create a CD/DVD image from files in a directory. To overcome the file names restrictions: -r enables the Rock Ridge extensions common to UNIX systems, -J enables Joliet extensions used by Microsoft systems. -L allows ISO9660 filenames to begin with a period.
  720.  
  721. # mkisofs -J -L -r -V TITLE -o imagefile.iso /path/to/dir
  722.  
  723.  
  724. On FreeBSD, mkisofs is found in the ports in sysutils/cdrtools.
  725. Burn a CD/DVD ISO image
  726.  
  727. FreeBSD
  728.  
  729. FreeBSD does not enable DMA on ATAPI drives by default. DMA is enabled with the sysctl command and the arguments below, or with /boot/loader.conf with the following entries:
  730.  
  731. hw.ata.ata_dma="1"
  732. hw.ata.atapi_dma="1"
  733.  
  734.  
  735. Use burncd with an ATAPI device (burncd is part of the base system) and cdrecord (in sysutils/cdrtools) with a SCSI drive.
  736.  
  737. # burncd -f /dev/acd0 data imagefile.iso fixate      # For ATAPI drive
  738. # cdrecord -scanbus                  # To find the burner device (like 1,0,0)
  739. # cdrecord dev=1,0,0 imagefile.iso
  740.  
  741.  
  742. Linux
  743.  
  744. Also use cdrecord with Linux as described above. Additionally it is possible to use the native ATAPI interface which is found with:
  745.  
  746. # cdrecord dev=ATAPI -scanbus
  747.  
  748.  
  749. And burn the CD/DVD as above.
  750. Convert a Nero .nrg file to .iso
  751.  
  752. Nero simply adds a 300Kb header to a normal iso image. This can be trimmed with dd.
  753.  
  754. # dd bs=1k if=imagefile.nrg of=imagefile.iso skip=300
  755.  
  756.  
  757. Convert a bin/cue image to .iso
  758.  
  759. The little bchunk programhttp://freshmeat.net/projects/bchunk/ can do this. It is in the FreeBSD ports in sysutils/bchunk.
  760.  
  761. # bchunk imagefile.bin imagefile.cue imagefile.iso
  762.  
  763.  
  764.  
  765. Create a file based image
  766.  
  767. For example a partition of 1GB using the file /usr/vdisk.img.
  768. FreeBSD
  769.  
  770. # dd if=/dev/random of=/usr/vdisk.img bs=1K count=1M
  771. # mdconfig -a -t vnode -f /usr/vdisk.img -u 1         # Creates device /dev/md1
  772. # bsdlabel -w /dev/md1
  773. # newfs /dev/md1c
  774. # mount /dev/md1c /mnt
  775. # umount /mnt; mdconfig -d -u 1; rm /usr/vdisk.img    # Cleanup the md device
  776.  
  777.  
  778. Linux
  779.  
  780.  
  781. # dd if=/dev/zero of=/usr/vdisk.img bs=1024k count=1024
  782. # mkfs.ext3 /usr/vdisk.img
  783. # mount -o loop /usr/vdisk.img /mnt
  784. # umount /mnt; rm /usr/vdisk.img                      # Cleanup
  785.  
  786.  
  787. Linux with losetup
  788.  
  789. /dev/zero is much faster than urandom, but less secure for encryption.
  790.  
  791. # dd if=/dev/urandom of=/usr/vdisk.img bs=1024k count=1024
  792. # losetup /dev/loop0 /usr/vdisk.img                   # Creates and associates /dev/loop0
  793. # mkfs.ext3 /dev/loop0
  794. # mount /dev/loop0 /mnt
  795. # losetup -a                                          # Check used loops
  796. # umount /mnt
  797. # losetup -d /dev/loop0                               # Detach
  798. # rm /usr/vdisk.img
  799.  
  800.  
  801.  
  802. Create a memory file system
  803.  
  804. A memory based file system is very fast for heavy IO application. How to create a 64 MB partition mounted on /memdisk:
  805. FreeBSD
  806.  
  807. # mount_mfs -o rw -s 64M md /memdisk
  808. # umount /memdisk; mdconfig -d -u 0                   # Cleanup the md device
  809. md     /memdisk     mfs     rw,-s64M    0   0         # /etc/fstab entry
  810.  
  811.  
  812. Linux
  813.  
  814. # mount -t tmpfs -osize=64m tmpfs /memdisk
  815.  
  816.  
  817.  
  818. Disk performance
  819.  
  820. Read and write a 1 GB file on partition ad4s3c (/home)
  821.  
  822. # time dd if=/dev/ad4s3c of=/dev/null bs=1024k count=1000
  823. # time dd if=/dev/zero bs=1024k count=1000 of=/home/1Gb.file
  824. # hdparm -tT /dev/hda      # Linux only
  825.  
  826.  
  827.  
  828.  
  829. Network
  830.  
  831. Routing | Additional IP | Change MAC | Ports | Firewall | IP Forward | NAT | DNS | DHCP | Traffic | QoS | NIS
  832.  
  833. Debugging (See also Traffic analysis)
  834.  
  835. # mii-diag eth0             # Show the link status (Linux)
  836. # ifconfig fxp0             # Check the "media" field on FreeBSD
  837. # arp -a                    # Check the router (or host) ARP entry (all OS)
  838. # ping cb.vu                # The first thing to try...
  839. # traceroute cb.vu          # Print the route path to destination
  840. # mii-diag -F 100baseTx-FD eth0  # Force 100Mbit Full duplex (Linux)
  841. # ifconfig fxp0 media 100baseTX mediaopt full-duplex  # Same for FreeBSD
  842. # netstat -s                # System-wide statistics for each network protocol
  843.  
  844.  
  845.  
  846. Routing
  847.  
  848. Print routing table
  849.  
  850. # route -n                 # Linux
  851. # netstat -rn              # Linux, BSD and UNIX
  852. # route print              # Windows
  853.  
  854.  
  855. Add and delete a route
  856.  
  857. FreeBSD
  858.  
  859. # route add 212.117.0.0/16 192.168.1.1
  860. # route delete 212.117.0.0/16
  861. # route add default 192.168.1.1
  862.  
  863.  
  864. Add the route permanently in /etc/rc.conf
  865.  
  866. static_routes="myroute"
  867. route_myroute="-net 212.117.0.0/16 192.168.1.1"
  868.  
  869.  
  870. Linux
  871.  
  872. # route add -net 192.168.20.0 netmask 255.255.255.0 gw 192.168.16.254
  873. # ip route add 192.168.20.0/24 via 192.168.16.254       # same as above with ip route
  874. # route add -net 192.168.20.0 netmask 255.255.255.0 dev eth0
  875. # route add default gw 192.168.51.254
  876. # ip route add default via 192.168.51.254               # same as above with ip route
  877. # route delete -net 192.168.20.0 netmask 255.255.255.0
  878.  
  879.  
  880. Windows
  881.  
  882. # Route add 192.168.50.0 mask 255.255.255.0 192.168.51.253
  883. # Route add 0.0.0.0 mask 0.0.0.0 192.168.51.254
  884.  
  885.  
  886. Use add -p to make the route persistent.
  887.  
  888. Configure additional IP addresses
  889.  
  890. Linux
  891.  
  892. # ifconfig eth0 192.168.50.254 netmask 255.255.255.0       # First IP
  893. # ifconfig eth0:0 192.168.51.254 netmask 255.255.255.0     # Second IP
  894.  
  895.  
  896. FreeBSD
  897.  
  898. # ifconfig fxp0 inet 192.168.50.254/24                     # First IP
  899. # ifconfig fxp0 alias 192.168.51.254 netmask 255.255.255.0 # Second IP
  900.  
  901. Permanent entries in /etc/rc.conf                  
  902.  
  903. ifconfig_fxp0="inet 192.168.50.254  netmask 255.255.255.0"
  904. ifconfig_fxp0_alias0="192.168.51.254 netmask 255.255.255.0"
  905.  
  906.  
  907. Change MAC address
  908.  
  909. # ifconfig eth0 hw ether 00:01:02:03:04:05      # Linux
  910. # ifconfig fxp0 link 00:01:02:03:04:05          # FreeBSD
  911.  
  912.  
  913.  
  914. Ports in use
  915.  
  916. Listening open ports:
  917.  
  918. # netstat -an | grep LISTEN
  919. # lsof -i                  # Linux list all Internet connections
  920. # socklist                 # Linux display list of open sockets
  921. # sockstat -4              # FreeBSD application listing
  922. # netstat -anp --udp --tcp | grep LISTEN        # Linux
  923. # netstat -tup             # List active connections to/from system (Linux)
  924. # netstat -tupl            # List listening ports from system (Linux)
  925. # netstat -ano             # Windows
  926.  
  927.  
  928.  
  929. Firewall
  930.  
  931. Check if a firewall is running (typical configuration only):
  932. Linux
  933.  
  934. # iptables -L -n -v                  # For status
  935. Open the iptables firewall
  936. # iptables -Z                        # Zero the packet and byte counters in all chains
  937. # iptables -F                        # Flush all chains
  938. # iptables -X                        # Delete all chains
  939. # iptables -P INPUT       ACCEPT     # Open everything
  940. # iptables -P FORWARD     ACCEPT
  941. # iptables -P OUTPUT      ACCEPT
  942.  
  943.  
  944. FreeBSD
  945.  
  946. # ipfw show                          # For status
  947. # ipfw list 65535 # if answer is "65535 deny ip from any to any" the fw is disabled
  948. # sysctl net.inet.ip.fw.enable=0     # Disable
  949. # sysctl net.inet.ip.fw.enable=1     # Enable
  950.  
  951.  
  952. IP Forward for routing
  953.  
  954. Linux
  955.  
  956. Check and then enable IP forward with:
  957.  
  958. # cat /proc/sys/net/ipv4/ip_forward  # Check IP forward 0=off, 1=on
  959. # echo 1 > /proc/sys/net/ipv4/ip_forward
  960.  
  961.  
  962. or edit /etc/sysctl.conf with:
  963.  
  964. net.ipv4.ip_forward = 1
  965.  
  966.  
  967.  
  968. FreeBSD
  969.  
  970. Check and enable with:
  971.  
  972. # sysctl net.inet.ip.forwarding      # Check IP forward 0=off, 1=on
  973. # sysctl net.inet.ip.forwarding=1
  974. # sysctl net.inet.ip.fastforwarding=1   # For dedicated router or firewall
  975. Permanent with entry in /etc/rc.conf:
  976. gateway_enable="YES"                 # Set to YES if this host will be a gateway.
  977.  
  978.  
  979. NAT Network Address Translation
  980.  
  981. Linux
  982.  
  983. # iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE  # to activate NAT
  984. # iptables -t nat -A PREROUTING -p tcp -d 78.31.70.238 --dport 20022 -j DNAT \
  985. --to 192.168.16.44:22           # Port forward 20022 to internal IP port ssh
  986. # iptables -t nat -A PREROUTING -p tcp -d 78.31.70.238 --dport 993:995 -j DNAT \
  987. --to 192.168.16.254:993:995     # Port forward of range 993-995
  988. # ip route flush cache
  989. # iptables -L -t nat            # Check NAT status
  990.  
  991.  
  992. Delete the port forward with -D instead of -A.
  993.  
  994. FreeBSD
  995.  
  996. # natd -s -m -u -dynamic -f /etc/natd.conf -n fxp0
  997. Or edit /etc/rc.conf with:
  998. firewall_enable="YES"           # Set to YES to enable firewall functionality
  999. firewall_type="open"            # Firewall type (see /etc/rc.firewall)
  1000. natd_enable="YES"               # Enable natd (if firewall_enable == YES).
  1001. natd_interface="tun0"           # Public interface or IP address to use.
  1002. natd_flags="-s -m -u -dynamic -f /etc/natd.conf"
  1003.  
  1004.  
  1005. Port forward with:
  1006.  
  1007. # cat /etc/natd.conf
  1008. same_ports yes
  1009. use_sockets yes
  1010. unregistered_only
  1011. # redirect_port tcp insideIP:2300-2399 3300-3399  # port range
  1012. redirect_port udp 192.168.51.103:7777 7777
  1013.  
  1014.  
  1015.  
  1016. DNS
  1017.  
  1018. On Unix the DNS entries are valid for all interfaces and are stored in /etc/resolv.conf. The domain to which the host belongs is also stored in this file. A minimal configuration is:
  1019.  
  1020. nameserver 78.31.70.238
  1021. search sleepyowl.net intern.lab
  1022. domain sleepyowl.net
  1023.  
  1024.  
  1025. Check the system domain name with:
  1026.  
  1027. # hostname -d                        # Same as dnsdomainname
  1028.  
  1029.  
  1030. Windows
  1031.  
  1032. On Windows the DNS are configured per interface. To display the configured DNS and to flush the DNS cache use:
  1033.  
  1034. # ipconfig /?                        # Display help
  1035. # ipconfig /all                      # See all information including DNS
  1036. # ipconfig /flushdns                 # Flush the DNS cache
  1037.  
  1038.  
  1039.  
  1040. Forward queries
  1041.  
  1042. Dig is you friend to test the DNS settings. For example the public DNS server 213.133.105.2 ns.second-ns.de can be used for testing. See from which server the client receives the answer (simplified answer).
  1043.  
  1044. # dig sleepyowl.net
  1045. sleepyowl.net.          600     IN      A       78.31.70.238
  1046. ;; SERVER: 192.168.51.254#53(192.168.51.254)
  1047.  
  1048.  
  1049. The router 192.168.51.254 answered and the response is the A entry. Any entry can be queried and the DNS server can be selected with @:
  1050.  
  1051. # dig MX google.com
  1052. # dig @127.0.0.1 NS sun.com          # To test the local server
  1053. # dig @204.97.212.10 NS MX heise.de  # Query an external server
  1054. # dig AXFR @ns1.xname.org cb.vu      # Get the full zone (zone transfer)
  1055.  
  1056.  
  1057. The program host is also powerful.
  1058.  
  1059. # host -t MX cb.vu                   # Get the mail MX entry
  1060. # host -t NS -T sun.com              # Get the NS record over a TCP connection
  1061. # host -a sleepyowl.net              # Get everything
  1062.  
  1063.  
  1064.  
  1065. Reverse queries
  1066.  
  1067. Find the name belonging to an IP address (in-addr.arpa.). This can be done with dig, host and nslookup:
  1068.  
  1069. # dig -x 78.31.70.238
  1070. # host 78.31.70.238
  1071. # nslookup 78.31.70.238
  1072.  
  1073.  
  1074.  
  1075. /etc/hosts
  1076.  
  1077. Single hosts can be configured in the file /etc/hosts instead of running named locally to resolve the hostname queries. The format is simple, for example:
  1078.  
  1079. 78.31.70.238   sleepyowl.net   sleepyowl
  1080.  
  1081.  
  1082. The priority between hosts and a dns query, that is the name resolution order, can be configured in /etc/nsswitch.conf AND /etc/host.conf. The file also exists on Windows, it is usually in:
  1083.  
  1084. C:\WINDOWS\SYSTEM32\DRIVERS\ETC
  1085.  
  1086.  
  1087.  
  1088. DHCP
  1089.  
  1090. Linux
  1091.  
  1092. Some distributions (SuSE) use dhcpcd as client. The default interface is eth0.
  1093.  
  1094. # dhcpcd -n eth0           # Trigger a renew
  1095. # dhcpcd -k eth0           # release and shutdown
  1096.  
  1097.  
  1098. The lease with the full information is stored in:
  1099.  
  1100. /var/lib/dhcpcd/dhcpcd-eth0.info
  1101.  
  1102.  
  1103.  
  1104. FreeBSD
  1105.  
  1106. FreeBSD (and Debian) uses dhclient. To configure an interface (for example bge0) run:
  1107.  
  1108. # dhclient bge0
  1109.  
  1110.  
  1111. The lease with the full information is stored in:
  1112.  
  1113. /var/db/dhclient.leases.bge0
  1114.  
  1115.  
  1116. Use
  1117.  
  1118. /etc/dhclient.conf
  1119.  
  1120.  to prepend options or force different options:
  1121.  
  1122. # cat /etc/dhclient.conf
  1123. interface "rl0" {
  1124.     prepend domain-name-servers 127.0.0.1;
  1125.     default domain-name "sleepyowl.net";
  1126.     supersede domain-name "sleepyowl.net";
  1127. }
  1128.  
  1129.  
  1130.  
  1131. Windows
  1132.  
  1133. The dhcp lease can be renewed with ipconfig:
  1134.  
  1135. # ipconfig /renew          # renew all adapters
  1136. # ipconfig /renew LAN      # renew the adapter named "LAN"
  1137. # ipconfig /release WLAN   # release the adapter named "WLAN"
  1138.  
  1139.  
  1140. Yes it is a good idea to rename you adapter with simple names!
  1141.  
  1142.  
  1143. Traffic analysis
  1144.  
  1145. Bmonhttp://people.suug.ch/~tgr/bmon/ is a small console bandwidth monitor and can display the flow on different interfaces.
  1146. Sniff with tcpdump
  1147.  
  1148. # tcpdump -nl -i bge0 not port ssh and src \(192.168.16.121 or 192.168.16.54\)
  1149. # tcpdump -l > dump && tail -f dump               # Buffered output
  1150. # tcpdump -i rl0 -w traffic.rl0                   # Write traffic in binary file
  1151. # tcpdump -r traffic.rl0                          # Read from file (also for ethereal
  1152. # tcpdump port 80                                 # The two classic commands
  1153. # tcpdump host google.com
  1154. # tcpdump -i eth0 -X port \(110 or 143\)          # Check if pop or imap is secure
  1155. # tcpdump -n -i eth0 icmp                         # Only catch pings
  1156. # tcpdump -i eth0 -s 0 -A port 80 | grep GET      # -s 0 for full packet -A for ASCII
  1157.  
  1158.  
  1159. Additional important options:
  1160.  
  1161.  
  1162.     *   -A     Print each packets in clear text (without header)
  1163.  
  1164.     *   -X     Print packets in hex and ASCII
  1165.  
  1166.     *   -l     Make stdout line buffered
  1167.  
  1168.     *   -D     Print all interfaces available
  1169.  
  1170.  
  1171.  
  1172. On Windows use windump from www.winpcap.org. Use windump -D to list the interfaces.
  1173. Scan with nmap
  1174.  
  1175. Nmaphttp://insecure.org/nmap/ is a port scanner with OS detection, it is usually installed on most distributions and is also available for Windows. If you don't scan your servers, hackers do it for you...
  1176.  
  1177. # nmap cb.vu               # scans all reserved TCP ports on the host
  1178. # nmap -sP 192.168.16.0/24 # Find out which IP are used and by which host on 0/24
  1179. # nmap -sS -sV -O cb.vu    # Do a stealth SYN scan with version and OS detection
  1180. PORT      STATE  SERVICE             VERSION
  1181. 22/tcp    open   ssh                 OpenSSH 3.8.1p1 FreeBSD-20060930 (protocol 2.0)
  1182. 25/tcp    open   smtp                Sendmail smtpd 8.13.6/8.13.6
  1183. 80/tcp    open   http                Apache httpd 2.0.59 ((FreeBSD) DAV/2 PHP/4.
  1184. [...]
  1185. Running: FreeBSD 5.X
  1186. Uptime 33.120 days (since Fri Aug 31 11:41:04 2007)
  1187.  
  1188.  
  1189.  
  1190. Traffic control (QoS)
  1191.  
  1192. Traffic control manages the queuing, policing, scheduling, and other traffic parameters for a network. The following examples are simple practical uses of the Linux and FreeBSD capabilities to better use the available bandwidth.
  1193. Limit upload
  1194.  
  1195. DSL or cable modems have a long queue to improve the upload throughput. However filling the queue with a fast device (e.g. ethernet) will dramatically decrease the interactivity. It is therefore useful to limit the device upload rate to match the physical capacity of the modem, this should greatly improve the interactivity. Set to about 90% of the modem maximal (cable) speed.
  1196. Linux
  1197.  
  1198. For a 512 Kbit upload modem.
  1199.  
  1200. # tc qdisc add dev eth0 root tbf rate 480kbit latency 50ms burst 1540
  1201. # tc -s qdisc ls dev eth0                         # Status
  1202. # tc qdisc del dev eth0 root                      # Delete the queue
  1203. # tc qdisc change dev eth0 root tbf rate 220kbit latency 50ms burst 1540
  1204.  
  1205.  
  1206. FreeBSD
  1207.  
  1208. FreeBSD uses the dummynet traffic shaper which is configured with ipfw. Pipes are used to set limits the bandwidth in units of [K|M]{bit/s|Byte/s}, 0 means unlimited bandwidth. Using the same pipe number will reconfigure it. For example limit the upload bandwidth to 500 Kbit.
  1209.  
  1210.  
  1211. # kldload dummynet                                # load the module if necessary
  1212. # ipfw pipe 1 config bw 500Kbit/s                 # create a pipe with limited bandwidth
  1213. # ipfw add pipe 1 ip from me to any               # divert the full upload into the pipe
  1214.  
  1215.  
  1216. Quality of service
  1217.  
  1218. Linux
  1219.  
  1220. Priority queuing with tc to optimize VoIP. See the full example on voip-info.org or www.howtoforge.com. Suppose VoIP uses udp on ports 10000:11024 and device eth0 (could also be ppp0 or so). The following commands define the QoS to three queues and force the VoIP traffic to queue 1 with QoS 0x1e (all bits set). The default traffic flows into queue 3 and QoS Minimize-Delay flows into queue 2.
  1221.  
  1222. # tc qdisc add dev eth0 root handle 1: prio priomap 2 2 2 2 2 2 2 2 1 1 1 1 1 1 1 0
  1223. # tc qdisc add dev eth0 parent 1:1 handle 10: sfq
  1224. # tc qdisc add dev eth0 parent 1:2 handle 20: sfq
  1225. # tc qdisc add dev eth0 parent 1:3 handle 30: sfq
  1226. # tc filter add dev eth0 protocol ip parent 1: prio 1 u32 \
  1227.  match ip dport 10000 0x3C00 flowid 1:1          # use server port range
  1228.  match ip dst 123.23.0.1 flowid 1:1              # or/and use server IP
  1229.  
  1230.  
  1231. Status and remove with
  1232.  
  1233. # tc -s qdisc ls dev eth0                         # queue status
  1234. # tc qdisc del dev eth0 root                      # delete all QoS
  1235.  
  1236.  
  1237. Calculate port range and mask
  1238.  
  1239. The tc filter defines the port range with port and mask which you have to calculate. Find the 2^N ending of the port range, deduce the range and convert to HEX. This is your mask. Example for 10000 -> 11024, the range is 1024.
  1240.  
  1241. # 2^13 (8192) < 10000 < 2^14 (16384)              # ending is 2^14 = 16384
  1242. # echo "obase=16;(2^14)-1024" | bc                # mask is 0x3C00
  1243.  
  1244.  
  1245.  
  1246. FreeBSD
  1247.  
  1248. The max link bandwidth is 500Kbit/s and we define 3 queues with priority 100:10:1 for VoIP:ssh:all the rest.
  1249.  
  1250. # ipfw pipe 1 config bw 500Kbit/s
  1251. # ipfw queue 1 config pipe 1 weight 100
  1252. # ipfw queue 2 config pipe 1 weight 10
  1253. # ipfw queue 3 config pipe 1 weight 1
  1254. # ipfw add 10 queue 1 proto udp dst-port 10000-11024
  1255. # ipfw add 11 queue 1 proto udp dst-ip 123.23.0.1 # or/and use server IP
  1256. # ipfw add 20 queue 2 dsp-port ssh
  1257. # ipfw add 30 queue 3 from me to any              # all the rest
  1258.  
  1259.  
  1260. Status and remove with
  1261.  
  1262. # ipfw list                                       # rules status
  1263. # ipfw pipe list                                  # pipe status
  1264. # ipfw flush                                      # deletes all rules but default
  1265.  
  1266.  
  1267. NIS Debugging
  1268.  
  1269. Some commands which should work on a well configured NIS client:
  1270.  
  1271. # ypwhich                  # get the connected NIS server name
  1272. # domainname               # The NIS domain name as configured
  1273. # ypcat group              # should display the group from the NIS server
  1274. # cd /var/yp && make       # Rebuild the yp database
  1275.  
  1276.  
  1277. Is ypbind running?
  1278.  
  1279. # ps auxww | grep ypbind
  1280. /usr/sbin/ypbind -s -m -S servername1,servername2   # FreeBSD
  1281. /usr/sbin/ypbind           # Linux
  1282. # yppoll passwd.byname
  1283. Map passwd.byname has order number 1190635041. Mon Sep 24 13:57:21 2007
  1284. The master server is servername.domain.net.
  1285.  
  1286.  
  1287. Linux
  1288.  
  1289. # cat /etc/yp.conf
  1290. ypserver servername
  1291. domain domain.net broadcast
  1292.  
  1293.  
  1294.  
  1295.  
  1296. SSH SCP
  1297.  
  1298. Public key | Fingerprint | SCP | Tunneling
  1299.  
  1300. Public key authentication
  1301.  
  1302. Connect to a host without password using public key authentication. The idea is to append your public key to the authorized_keys2 file on the remote host. For this example let's connect host-client to host-server, the key is generated on the client.
  1303.  
  1304.  
  1305.     *   Use ssh-keygen to generate a key pair. ~/.ssh/id_dsa is the private key, ~/.ssh/id_dsa.pub is the public key.
  1306.  
  1307.     *   Copy only the public key to the server and append it to the file ~/.ssh/authorized_keys2 on your home on the server.
  1308.  
  1309.  
  1310. # ssh-keygen -t dsa -N ''
  1311. # cat ~/.ssh/id_dsa.pub | ssh you@host-server "cat - >> ~/.ssh/authorized_keys2"
  1312.  
  1313.  
  1314.  
  1315. Using the Windows client from ssh.com
  1316.  
  1317. The non commercial version of the ssh.com client can be downloaded the main ftp site: ftp.ssh.com/pub/ssh/. Keys generated by the ssh.com client need to be converted for the OpenSSH server. This can be done with the ssh-keygen command.
  1318.  
  1319.  
  1320.     *   Create a key pair with the ssh.com client: Settings - User Authentication - Generate New....
  1321.  
  1322.     *   I use Key type DSA; key length 2048.
  1323.  
  1324.     *   Copy the public key generated by the ssh.com client to the server into the ~/.ssh folder.
  1325.  
  1326.     *   The keys are in C:\Documents and Settings\%USERNAME%\Application Data\SSH\UserKeys.
  1327.  
  1328.     *   Use the ssh-keygen command on the server to convert the key:
  1329.  
  1330.       # cd ~/.ssh
  1331.       # ssh-keygen -i -f keyfilename.pub >> authorized_keys2
  1332.  
  1333.  
  1334.  
  1335.  
  1336. Notice: We used a DSA key, RSA is also possible. The key is not protected by a password.
  1337. Using putty for Windows
  1338.  
  1339. Puttyhttp://www.chiark.greenend.org.uk/~sgtatham/putty/download.html is a simple and free ssh client for Windows.
  1340.  
  1341.  
  1342.     *   Create a key pair with the puTTYgen program.
  1343.  
  1344.     *   Save the public and private keys (for example into C:\Documents and Settings\%USERNAME%\.ssh).
  1345.  
  1346.     *   Copy the public key to the server into the ~/.ssh folder:
  1347.          
  1348.  
  1349.       # scp .ssh/puttykey.pub root@192.168.51.254:.ssh/
  1350.  
  1351.  
  1352.     *   Use the ssh-keygen command on the server to convert the key for OpenSSH:
  1353.  
  1354.       # cd ~/.ssh
  1355.       # ssh-keygen -i -f puttykey.pub >> authorized_keys2
  1356.  
  1357.  
  1358.     * Point the private key location in the putty settings: Connection - SSH - Auth
  1359.  
  1360.  
  1361.  
  1362. Check fingerprint
  1363.  
  1364. At the first login, ssh will ask if the unknown host with the fingerprint has to be stored in the known hosts. To avoid a man-in-the-middle attack the administrator of the server can send you the server fingerprint which is then compared on the first login. Use ssh-keygen -l to get the fingerprint (on the server):
  1365.  
  1366. # ssh-keygen -l -f /etc/ssh/ssh_host_rsa_key.pub      # For RSA key
  1367. 2048 61:33:be:9b:ae:6c:36:31:fd:83:98:b7:99:2d:9f:cd /etc/ssh/ssh_host_rsa_key.pub
  1368. # ssh-keygen -l -f /etc/ssh/ssh_host_dsa_key.pub      # For DSA key (default)
  1369. 2048 14:4a:aa:d9:73:25:46:6d:0a:48:35:c7:f4:16:d4:ee /etc/ssh/ssh_host_dsa_key.pub
  1370.  
  1371.  
  1372. Now the client connecting to this server can verify that he is connecting to the right server:
  1373.  
  1374.  
  1375. # ssh linda
  1376. The authenticity of host 'linda (192.168.16.54)' can't be established.
  1377. DSA key fingerprint is 14:4a:aa:d9:73:25:46:6d:0a:48:35:c7:f4:16:d4:ee.
  1378. Are you sure you want to continue connecting (yes/no)? yes
  1379.  
  1380.  
  1381. Secure file transfer
  1382.  
  1383. Some simple commands:
  1384.  
  1385. # scp file.txt host-two:/tmp
  1386. # scp joe@host-two:/www/*.html /www/tmp
  1387. # scp -r joe@host-two:/www /www/tmp
  1388.  
  1389.  
  1390. In Konqueror or Midnight Commander it is possible to access a remote file system with the address fish://user@gate. However the implementation is very slow.
  1391.  
  1392. Furthermore it is possible to mount a remote folder with sshfs a file system client based on SCP. See fuse sshfshttp://fuse.sourceforge.net/sshfs.html.
  1393.  
  1394. Tunneling
  1395.  
  1396. SSH tunneling allows to forward or reverse forward a port over the SSH connection, thus securing the traffic and accessing ports which would otherwise be blocked. This only works with TCP. The general nomenclature for forward and reverse is (see also ssh and NAT example):
  1397.  
  1398. # ssh -L localport:desthost:destport user@gate  # desthost as seen from the gate
  1399. # ssh -R destport:desthost:localport user@gate  # forwards your localport to destination
  1400. # ssh -X user@gate   # To force X forwarding
  1401.  
  1402.  
  1403. This will connect to gate and forward the local port to the host desthost:destport. Note desthost is the destination host as seen by the gate, so if the connection is to the gate, then desthost is localhost. More than one port forward is possible.
  1404. Direct forward on the gate
  1405.  
  1406. Let say we want to access the CVS (port 2401) and http (port 80) which are running on the gate. This is the simplest example, desthost is thus localhost, and we use the port 8080 locally instead of 80 so we don't need to be root. Once the ssh session is open, both services are accessible on the local ports.
  1407.  
  1408. # ssh -L 2401:localhost:2401 -L 8080:localhost:80 user@gate
  1409.  
  1410.  
  1411. Netbios and remote desktop forward to a second server
  1412.  
  1413. Let say a Windows smb server is behind the gate and is not running ssh. We need access to the smb share and also remote desktop to the server.
  1414.  
  1415. # ssh -L 139:smbserver:139 -L 3388:smbserver:3389 user@gate
  1416.  
  1417.  
  1418. The smb share can now be accessed with \\127.0.0.1\, but only if the local share is disabled, because the local share is listening on port 139.
  1419.  
  1420. It is possible to keep the local share enabled, for this we need to create a new virtual device with a new IP address for the tunnel, the smb share will be connected over this address. Furthermore the local RDP is already listening on 3389, so we choose 3388. For this example let's use a virtual IP of 10.1.1.1.
  1421.  
  1422.  
  1423.    * With putty use Source port=10.1.1.1:139. It is possible to create multiple loop devices and tunnel. On Windows 2000, only putty worked for me.
  1424.  
  1425.    * With the ssh.com client, disable "Allow local connections only". Since ssh.com will bind to all addresses, only a single share can be connected.
  1426.  
  1427.  
  1428. Now create the loopback interface with IP 10.1.1.1:
  1429.  
  1430.  
  1431.    * # System->Control Panel->Add Hardware # Yes, Hardware is already connected
  1432.      # Add a new hardware device (at bottom).
  1433.  
  1434.    * # Install the hardware that I manually select # Network adapters # Microsoft , Microsoft Loopback Adapter.
  1435.  
  1436.    * Configure the IP address of the fake device to 10.1.1.1 mask 255.255.255.0, no gateway.
  1437.  
  1438.    * advanced->WINS, Enable LMHosts Lookup; Disable NetBIOS over TCP/IP.
  1439.  
  1440.    * # Enable Client for Microsoft Networks. # Disable File and Printer Sharing for Microsoft Networks.
  1441.  
  1442.  
  1443. I HAD to reboot for this to work. Now connect to the smb share with \\10.1.1.1 and remote desktop to 10.1.1.1:3388.
  1444. Debug
  1445.  
  1446. If it is not working:
  1447.  
  1448.  
  1449.    * Are the ports forwarded: netstat -an? Look at 0.0.0.0:139 or 10.1.1.1:139
  1450.  
  1451.    * Does telnet 10.1.1.1 139 connect?
  1452.  
  1453.    * You need the checkbox "Local ports accept connections from other hosts".
  1454.  
  1455.    * Is "File and Printer Sharing for Microsoft Networks" disabled on the loopback interface?
  1456.  
  1457.  
  1458.  
  1459. Connect two clients behind NAT
  1460.  
  1461. Suppose two clients are behind a NAT gateway and client cliadmin has to connect to client cliuser (the destination), both can login to the gate with ssh and are running Linux with sshd. You don't need root access anywhere as long as the ports on gate are above 1024. We use 2022 on gate. Also since the gate is used locally, the option GatewayPorts is not necessary.
  1462.  
  1463. On client cliuser (from destination to gate):
  1464.  
  1465. # ssh -R 2022:localhost:22 user@gate            # forwards client 22 to gate:2022
  1466.  
  1467.  
  1468. On client cliadmin (from host to gate):
  1469.  
  1470. # ssh -L 3022:localhost:2022 admin@gate         # forwards client 3022 to gate:2022
  1471.  
  1472.  
  1473. Now the admin can connect directly to the client cliuser with:
  1474.  
  1475. # ssh -p 3022 admin@localhost                   # local:3022 -> gate:2022 -> client:22
  1476.  
  1477.  
  1478.  
  1479. Connect to VNC behind NAT
  1480.  
  1481. Suppose a Windows client with VNC listening on port 5900 has to be accessed from behind NAT.
  1482. On client cliwin to gate:
  1483.  
  1484. # ssh -R 15900:localhost:5900 user@gate
  1485.  
  1486.  
  1487. On client cliadmin (from host to gate):
  1488.  
  1489. # ssh -L 5900:localhost:15900 admin@gate
  1490.  
  1491.  
  1492. Now the admin can connect directly to the client VNC with:
  1493.  
  1494. # vncconnect -display :0 localhost
  1495.  
  1496.  
  1497.  
  1498.  
  1499. VPN with SSH
  1500.  
  1501. As of version 4.3, OpenSSH can use the tun/tap device to encrypt a tunnel. This is very similar to other TLS based VPN solutions like OpenVPN. One advantage with SSH is that there is no need to install and configure additional software. Additionally the tunnel uses the SSH authentication like pre shared keys. The drawback is that the encapsulation is done over TCP which might result in poor performance on a slow link. Also the tunnel is relying on a single (fragile) TCP connection.  This technique is very useful for a quick IP based VPN setup. There is no limitation as with the single TCP port forward, all layer 3/4 protocols like ICMP, TCP/UDP, etc. are forwarded over the VPN. In any case, the following options are needed in the sshd_conf file:
  1502.  
  1503. PermitRootLogin yes
  1504. PermitTunnel yes
  1505.  
  1506.  
  1507.  
  1508. Single P2P connection
  1509.  
  1510. Here we are connecting two hosts, hclient and hserver with a peer to peer tunnel. The connection is started from hclient to hserver and is done as root. The tunnel end points are 10.0.1.1 (server) and 10.0.1.2 (client) and we create a device tun5 (this could also be an other number). The procedure is very simple:
  1511.  
  1512.  
  1513.     *   Connect with SSH using the tunnel option -w
  1514.  
  1515.     *   Configure the IP addresses of the tunnel. Once on the server and once on the client.
  1516.  
  1517.  
  1518. Connect to the server
  1519.  
  1520. Connection started on the client and commands are executed on the server.
  1521. Server is on Linux
  1522.  
  1523. cli># ssh -w5:5 root@hserver
  1524. srv># ifconfig tun5 10.0.1.1 netmask 255.255.255.252   # Executed on the server shell
  1525.  
  1526.  
  1527. Server is on FreeBSD
  1528.  
  1529. cli># ssh -w5:5 root@hserver
  1530. srv># ifconfig tun5 10.0.1.1 10.0.1.2                  # Executed on the server shell
  1531.  
  1532.  
  1533.  
  1534. Configure the client
  1535.  
  1536. Commands executed on the client:
  1537.  
  1538. cli># ifconfig tun5 10.0.1.2 netmask 255.255.255.252   # Client is on Linux
  1539. cli># ifconfig tun5 10.0.1.2 10.0.1.1                  # Client is on FreeBSD
  1540.  
  1541.  
  1542. The two hosts are now connected and can transparently communicate with any layer 3/4 protocol using the tunnel IP addresses.
  1543.  
  1544. Connect two networks
  1545.  
  1546. In addition to the p2p setup above, it is more useful to connect two private networks with an SSH VPN using two gates. Suppose for the example, netA is 192.168.51.0/24 and netB 192.168.16.0/24. The procedure is similar as above, we only need to add the routing. NAT must be activated on the private interface only if the gates are not the same as the default gateway of their network.
  1547.  
  1548. 192.168.51.0/24 (netA)|gateA <-> gateB|192.168.16.0/24 (netB)
  1549.  
  1550.  
  1551.     *   Connect with SSH using the tunnel option -w.
  1552.  
  1553.     *   Configure the IP addresses of the tunnel. Once on the server and once on the client.
  1554.  
  1555.     *   Add the routing for the two networks.
  1556.  
  1557.     *   If necessary, activate NAT on the private interface of the gate.
  1558.  
  1559.  
  1560. The setup is started from gateA in netA.
  1561. Connect from gateA to gateB
  1562.  
  1563. Connection is started from gateA and commands are executed on gateB.
  1564. gateB is on Linux
  1565.  
  1566. gateA># ssh -w5:5 root@gateB
  1567. gateB># ifconfig tun5 10.0.1.1 netmask 255.255.255.252 # Executed on the gateB shell
  1568. gateB># route add -net 192.168.51.0 netmask 255.255.255.0 dev tun5
  1569. gateB># echo 1 > /proc/sys/net/ipv4/ip_forward        # Only needed if not default gw
  1570. gateB># iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
  1571.  
  1572.  
  1573. gateB is on FreeBSD
  1574.  
  1575. gateA># ssh -w5:5 root@gateB                          # Creates the tun5 devices
  1576. gateB># ifconfig tun5 10.0.1.1 10.0.1.2               # Executed on the gateB shell
  1577. gateB># route add 192.168.51.0/24 10.0.1.2
  1578. gateB># sysctl net.inet.ip.forwarding=1               # Only needed if not default gw
  1579. gateB># natd -s -m -u -dynamic -n fxp0                # see NAT
  1580. gateA># sysctl net.inet.ip.fw.enable=1
  1581.  
  1582.  
  1583.  
  1584. Configure gateA
  1585.  
  1586. Commands executed on gateA:
  1587. gateA is on Linux
  1588.  
  1589. gateA># ifconfig tun5 10.0.1.2 netmask 255.255.255.252
  1590. gateA># route add -net 192.168.16.0 netmask 255.255.255.0 dev tun5
  1591. gateA># echo 1 > /proc/sys/net/ipv4/ip_forward
  1592. gateA># iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
  1593.  
  1594.  
  1595. gateA is on FreeBSD
  1596.  
  1597. gateA># ifconfig tun5 10.0.1.2 10.0.1.1
  1598. gateA># route add 192.168.16.0/24 10.0.1.2
  1599. gateA># sysctl net.inet.ip.forwarding=1
  1600. gateA># natd -s -m -u -dynamic -n fxp0                # see NAT
  1601. gateA># sysctl net.inet.ip.fw.enable=1
  1602.  
  1603.  
  1604. The two private networks are now transparently connected via the SSH VPN. The IP forward and NAT settings are only necessary if the gates are not the default gateways. In this case the clients would not know where to forward the response, and nat must be activated.
  1605.  
  1606.  
  1607. RSYNC
  1608.  
  1609. Rsync can almost completely replace cp and scp, furthermore interrupted transfers are efficiently restarted. A trailing slash (and the absence thereof) has different meanings, the man page is good... Here some examples:
  1610.  
  1611. Copy the directories with full content:
  1612.  
  1613. # rsync -a /home/colin/ /backup/colin/
  1614. # rsync -a /var/ /var_bak/
  1615. # rsync -aR --delete-during /home/user/ /backup/      # use relative (see below)
  1616.  
  1617.  
  1618. Same as before but over the network and with compression. Rsync uses SSH for the transport per default and will use the ssh key if they are set. Use ":" as with SCP. A typical remote copy:
  1619.  
  1620. # rsync -axSRzv /home/user/ user@server:/backup/user/
  1621.  
  1622.  
  1623. Exclude any directory tmp within /home/user/ and keep the relative folders hierarchy, that is the remote directory will have the structure /backup/home/user/. This is typically used for backups.
  1624.  
  1625. # rsync -azR --exclude /tmp/ /home/user/ user@server:/backup/
  1626.  
  1627.  
  1628.  
  1629. Use port 20022 for the ssh connection:
  1630.  
  1631. # rsync -az -e 'ssh -p 20022' /home/colin/ user@server:/backup/colin/
  1632.  
  1633.  
  1634. Using the rsync daemon (used with "::") is much faster, but not encrypted over ssh. The location of /backup is defined by the configuration in /etc/rsyncd.conf. The variable RSYNC_PASSWORD can be set to avoid the need to enter the password manually.
  1635.  
  1636. # rsync -axSRz /home/ ruser@hostname::rmodule/backup/
  1637. # rsync -axSRz ruser@hostname::rmodule/backup/ /home/    # To copy back
  1638.  
  1639.  
  1640. Some important options:
  1641.  
  1642.  
  1643.     *   -a, --archive       archive mode; same as -rlptgoD (no -H)
  1644.  
  1645.     *   -r, --recursive       recurse into directories
  1646.  
  1647.     *   -R, --relative       use relative path names
  1648.  
  1649.     *   -H, --hard-links       preserve hard links
  1650.  
  1651.     *   -S, --sparse       handle sparse files efficiently
  1652.  
  1653.     *   -x, --one-file-system       don't cross file system boundaries
  1654.  
  1655.    *    --exclude=PATTERN       exclude files matching PATTERN
  1656.  
  1657.    *    --delete-during       receiver deletes during xfer, not before
  1658.  
  1659.    *    --delete-after       receiver deletes after transfer, not before
  1660.  
  1661.  
  1662.  
  1663. Rsync on Windows
  1664.  
  1665. Rsync is available for Windows through cygwin or as stand-alone packaged in cwrsynchttp://sourceforge.net/projects/sereds. This is very convenient for automated backups. Install one of them (not both) and add the path to the Windows system variables: # Control Panel -> System -> tab Advanced, button Environment Variables. Edit the "Path" system variable and add the full path to the installed rsync, e.g. C:\Program Files\cwRsync\bin or C:\cygwin\bin. This way the commands rsync and ssh are available in a Windows command shell.
  1666. Public key authentication
  1667.  
  1668. Rsync is automatically tunneled over SSH and thus uses the SSH authentication on the server. Automatic backups have to avoid a user interaction, for this the SSH public key authentication can be used and the rsync command will run without a password.
  1669.  
  1670. All the following commands are executed within a Windows console. In a console (Start -> Run -> cmd) create and upload the key as described in SSH, change "user" and "server" as appropriate. If the file authorized_keys2 does not exist yet, simply copy id_dsa.pub to authorized_keys2 and upload it.
  1671.  
  1672. # ssh-keygen -t dsa -N ''                   # Creates a public and a private key
  1673. # rsync user@server:.ssh/authorized_keys2 . # Copy the file locally from the server
  1674. # cat id_dsa.pub >> authorized_keys2        # Or use an editor to add the key
  1675. # rsync authorized_keys2 user@server:.ssh/  # Copy the file back to the server
  1676. # del authorized_keys2                      # Remove the local copy
  1677.  
  1678.  
  1679. Now test it with (in one line):
  1680.  
  1681. rsync -rv "/cygdrive/c/Documents and Settings/%USERNAME%/My Documents/" \
  1682. 'user@server:My\ Documents/'
  1683.  
  1684.  
  1685. Automatic backup
  1686.  
  1687. Use a batch file to automate the backup and add the file in the scheduled tasks (Programs -> Accessories -> System Tools -> Scheduled Tasks). For example create the file backup.bat and replace user@server.
  1688.  
  1689. @ECHO OFF
  1690. REM rsync the directory My Documents
  1691. SETLOCAL
  1692. SET CWRSYNCHOME=C:\PROGRAM FILES\CWRSYNC
  1693. SET CYGWIN=nontsec
  1694. SET CWOLDPATH=%PATH%
  1695. REM uncomment the next line when using cygwin
  1696. SET PATH=%CWRSYNCHOME%\BIN;%PATH%
  1697. echo Press Control-C to abort
  1698. rsync -av "/cygdrive/c/Documents and Settings/%USERNAME%/My Documents/" \
  1699. 'user@server:My\ Documents/'
  1700. pause
  1701.  
  1702.  
  1703.  
  1704.  
  1705. SUDO
  1706.  
  1707. Sudo is a standard way to give users some administrative rights without giving out the root password. Sudo is very useful in a multi user environment with a mix of server and workstations. Simply call the command with sudo:
  1708.  
  1709. # sudo /etc/init.d/dhcpd restart            # Run the rc script as root
  1710. # sudo -u sysadmin whoami                   # Run cmd as an other user
  1711.  
  1712.  
  1713. Configuration
  1714.  
  1715. Sudo is configured in /etc/sudoers and must only be edited with visudo. The basic syntax is (the lists are comma separated):
  1716.  
  1717. user hosts = (runas) commands          # In /etc/sudoers
  1718.  
  1719.        
  1720.  
  1721.  
  1722.    *   users one or more users or %group (like %wheel) to gain the rights
  1723.  
  1724.    *   hosts list of hosts (or ALL)
  1725.  
  1726.    *   runas list of users (or ALL) that the command rule can be run as. It is enclosed in ( )!
  1727.  
  1728.    *   commands list of commands (or ALL) that will be run as root or as (runas)
  1729.  
  1730.  
  1731. Additionally those keywords can be defined as alias, they are called User_Alias, Host_Alias, Runas_Alias and Cmnd_Alias. This is useful for larger setups. Here a sudoers example:
  1732.  
  1733. # cat /etc/sudoers
  1734. # Host aliases are subnets or hostnames.
  1735. Host_Alias   DMZ     = 212.118.81.40/28
  1736. Host_Alias   DESKTOP = work1, work2
  1737.  
  1738. # User aliases are a list of users which can have the same rights
  1739. User_Alias   ADMINS  = colin, luca, admin
  1740. User_Alias   DEVEL   = joe, jack, julia
  1741. Runas_Alias  DBA     = oracle,pgsql
  1742.  
  1743. # Command aliases define the full path of a list of commands
  1744. Cmnd_Alias   SYSTEM  = /sbin/reboot,/usr/bin/kill,/sbin/halt,/sbin/shutdown,/etc/init.d/
  1745. Cmnd_Alias   PW      = /usr/bin/passwd [A-z]*, !/usr/bin/passwd root # Not root pwd!
  1746. Cmnd_Alias   DEBUG   = /usr/sbin/tcpdump,/usr/bin/wireshark,/usr/bin/nmap
  1747.  
  1748. # The actual rules
  1749. root,ADMINS  ALL     = (ALL) NOPASSWD: ALL    # ADMINS can do anything w/o a password.
  1750. DEVEL        DESKTOP = (ALL) NOPASSWD: ALL    # Developers have full right on desktops
  1751. DEVEL        DMZ     = (ALL) NOPASSWD: DEBUG  # Developers can debug the DMZ servers.
  1752.  
  1753. # User sysadmin can mess around in the DMZ servers with some commands.
  1754. sysadmin     DMZ     = (ALL) NOPASSWD: SYSTEM,PW,DEBUG
  1755. sysadmin     ALL,!DMZ = (ALL) NOPASSWD: ALL   # Can do anything outside the DMZ.
  1756. %dba         ALL     = (DBA) ALL              # Group dba can run as database user.
  1757.  
  1758. # anyone can mount/unmount a cd-rom on the desktop machines
  1759. ALL          DESKTOP = NOPASSWD: /sbin/mount /cdrom,/sbin/umount /cdrom
  1760.  
  1761.  
  1762.  
  1763.  
  1764.  
  1765. Encrypt Files
  1766.  
  1767. A single file
  1768.  
  1769. Encrypt and decrypt:
  1770.  
  1771. # openssl des -salt -in file -out file.des
  1772. # openssl des -d -salt -in file.des -out file
  1773.  
  1774.  
  1775. Note that the file can of course be a tar archive.
  1776.    
  1777. tar and encrypt a whole directory
  1778.  
  1779. # tar -cf - directory | openssl des -salt -out directory.tar.des      # Encrypt
  1780. # openssl des -d -salt -in directory.tar.des | tar -x                 # Decrypt
  1781.  
  1782.  
  1783.    
  1784. tar zip and encrypt a whole directory
  1785.  
  1786. # tar -zcf - directory | openssl des -salt -out directory.tar.gz.des  # Encrypt
  1787. # openssl des -d -salt -in directory.tar.gz.des | tar -xz             # Decrypt
  1788.  
  1789.  
  1790.  
  1791.  
  1792.    * Use -k mysecretpassword after des to avoid the interactive password request. However note that this is highly insecure.
  1793.  
  1794.    * Use des3 instead of des to get even stronger encryption (Triple-DES Cipher). This uses also more CPU.
  1795.  
  1796.  
  1797.  
  1798.  
  1799. Encrypt Partitions
  1800.  
  1801. Linux with LUKS | Linux dm-crypt only | FreeBSD GELI | FBSD pwd only
  1802.  
  1803. There are (many) other alternative methods to encrypt disks, I only show here the methods I know and use. Keep in mind that the security is only good as long the OS has not been tempered with. An intruder could easily record the password from the keyboard events. Furthermore the data is freely accessible when the partition is attached and will not prevent an intruder to have access to it in this state.
  1804. Linux
  1805.  
  1806. Those instructions use the Linux dm-crypt (device-mapper) facility available on the 2.6 kernel. In this example, lets encrypt the partition /dev/sdc1, it could be however any other partition or disk, or USB or a file based partition created with losetup. In this case we would use /dev/loop0. See file image partition. The device mapper uses labels to identify a partition. We use sdc1 in this example, but it could be any string.
  1807. dm-crypt with LUKS
  1808.  
  1809. LUKS with dm-crypt has better encryption and makes it possible to have multiple passphrase for the same partition or to change the password easily. To test if LUKS is available, simply type # cryptsetup --help, if nothing about LUKS shows up, use the instructions below Without LUKS. First create a partition if necessary: fdisk /dev/sdc.
  1810. Create encrypted partition
  1811.  
  1812. # dd if=/dev/urandom of=/dev/sdc1          # Optional. For paranoids only (takes days)
  1813. # cryptsetup -y luksFormat /dev/sdc1       # This destroys any data on sdc1
  1814. # cryptsetup luksOpen /dev/sdc1 sdc1
  1815. # mkfs.ext3 /dev/mapper/sdc1               # create ext3 file system
  1816. # mount -t ext3 /dev/mapper/sdc1 /mnt
  1817. # umount /mnt
  1818. # cryptsetup luksClose sdc1                # Detach the encrypted partition
  1819.  
  1820.  
  1821. Attach
  1822.  
  1823. # cryptsetup luksOpen /dev/sdc1 sdc1
  1824. # mount -t ext3 /dev/mapper/sdc1 /mnt
  1825.  
  1826.  
  1827. Detach
  1828.  
  1829. # umount /mnt
  1830. # cryptsetup luksClose sdc1
  1831.  
  1832.  
  1833. dm-crypt without LUKS
  1834.  
  1835. # cryptsetup -y create sdc1 /dev/sdc1      # or any other partition like /dev/loop0
  1836. # dmsetup ls                               # check it, will display: sdc1 (254, 0)
  1837. # mkfs.ext3 /dev/mapper/sdc1               # This is done only the first time!
  1838. # mount -t ext3 /dev/mapper/sdc1 /mnt
  1839. # umount /mnt/
  1840. # cryptsetup remove sdc1                   # Detach the encrypted partition
  1841.  
  1842.  
  1843. Do exactly the same (without the mkfs part!) to re-attach the partition. If the password is not correct, the mount command will fail. In this case simply remove the map sdc1 (cryptsetup remove sdc1) and create it again.
  1844. FreeBSD
  1845.  
  1846. The two popular FreeBSD disk encryption modules are gbde and geli. I now use geli because it is faster and also uses the crypto device for hardware acceleration. See The FreeBSD handbook Chapter 18.6http://www.freebsd.org/handbook/disks-encrypting.html for all the details. The geli module must be loaded or compiled into the kernel:
  1847.  
  1848. options GEOM_ELI
  1849. device crypto                                       # or as module:
  1850. # echo 'geom_eli_load="YES"' >> /boot/loader.conf   # or do: kldload geom_eli
  1851.  
  1852.  
  1853. Use password and key
  1854.  
  1855. I use those settings for a typical disk encryption, it uses a passphrase AND a key to encrypt the master key. That is you need both the password and the generated key /root/ad1.key to attach the partition. The master key is stored inside the partition and is not visible. See below for typical USB or file based image.
  1856. Create encrypted partition
  1857.  
  1858.  
  1859. # dd if=/dev/random of=/root/ad1.key bs=64 count=1  # this key encrypts the mater key
  1860. # geli init -s 4096 -K /root/ad1.key /dev/ad1       # -s 8192 is also OK for disks
  1861. # geli attach -k /root/ad1.key /dev/ad1             # DO make a backup of /root/ad1.key
  1862. # dd if=/dev/random of=/dev/ad1.eli bs=1m           # Optional and takes a long time
  1863. # newfs /dev/ad1.eli                                # Create file system
  1864. # mount /dev/ad1.eli /mnt
  1865.  
  1866.  
  1867. Attach
  1868.  
  1869. # geli attach -k /root/ad1.key /dev/ad1
  1870. # fsck -ny -t ffs /dev/ad1.eli                      # In doubt check the file system
  1871. # mount /dev/ad1.eli /mnt
  1872.  
  1873.  
  1874. Detach
  1875.  
  1876. The detach procedure is done automatically on shutdown.
  1877.  
  1878. # umount /mnt
  1879. # geli detach /dev/ad1.eli
  1880.  
  1881.  
  1882. /etc/fstab
  1883.  
  1884. The encrypted partition can be configured to be mounted with /etc/fstab. The password will be prompted when booting. The following settings are required for this example:
  1885.  
  1886. # grep geli /etc/rc.conf
  1887. geli_devices="ad1"
  1888. geli_ad1_flags="-k /root/ad1.key"
  1889. # grep geli /etc/fstab
  1890. /dev/ad1.eli         /home/private              ufs             rw      0       0
  1891.  
  1892.  
  1893. Use password only
  1894.  
  1895. It is more convenient to encrypt a USB stick or file based image with a passphrase only and no key. In this case it is not necessary to carry the additional key file around. The procedure is very much the same as above, simply without the key file. Let's encrypt a file based image /cryptedfile of 1 GB.
  1896.  
  1897. # dd if=/dev/zero of=/cryptedfile bs=1M count=1000  # 1 GB file
  1898. # mdconfig -at vnode -f /cryptedfile
  1899. # geli init /dev/md0                                # encrypts with password only
  1900. # geli attach /dev/md0
  1901. # newfs -U -m 0 /dev/md0.eli
  1902. # mount /dev/md0.eli /mnt
  1903. # umount /dev/md0.eli
  1904. # geli detach md0.eli
  1905.  
  1906.  
  1907. It is now possible to mount this image on an other system with the password only.
  1908.  
  1909. # mdconfig -at vnode -f /cryptedfile
  1910. # geli attach /dev/md0
  1911. # mount /dev/md0.eli /mnt
  1912.  
  1913.  
  1914.  
  1915.  
  1916. SSL Certificates
  1917.  
  1918. So called SSL/TLS certificates are cryptographic public key certificates and are composed of a public and a private key. The certificates are used to authenticate the endpoints and encrypt the data. They are used for example on a web server (https) or mail server (imaps).
  1919. Procedure
  1920.  
  1921.  
  1922.     * We need a certificate authority to sign our certificate. This step is
  1923.         usually provided by a vendor like Thawte, Verisign, etc., however we can also create our own.
  1924.  
  1925.     * Create a certificate signing request. This request is like an unsigned certificate (the public part) and already contains all necessary information. The certificate request is normally sent to the authority vendor for signing. This step also creates the private key on the local machine.
  1926.  
  1927.     * Sign the certificate with the certificate authority.
  1928.  
  1929.     * If necessary join the certificate and the key in a single file to be used by the application (web server, mail server etc.).
  1930.  
  1931.  
  1932.  
  1933. Configure OpenSSL
  1934.  
  1935. We use /usr/local/certs as directory for this example check or edit /etc/ssl/openssl.cnf accordingly to your settings so you know where the files will be created. Here are the relevant part of openssl.cnf:
  1936.  
  1937. [ CA_default ]
  1938. dir             = /usr/local/certs/CA       # Where everything is kept
  1939. certs           = $dir/certs                # Where the issued certs are kept
  1940. crl_dir         = $dir/crl                  # Where the issued crl are kept
  1941. database        = $dir/index.txt            # database index file.
  1942.  
  1943.  
  1944. Make sure the directories exist or create them
  1945.  
  1946. # mkdir -p /usr/local/certs/CA
  1947. # cd /usr/local/certs/CA
  1948. # mkdir certs crl newcerts private
  1949. # echo "01" > serial                        # Only if serial does not exist
  1950. # touch index.txt
  1951.  
  1952.  
  1953.  
  1954. Create a certificate authority
  1955.  
  1956.  
  1957. If you do not have a certificate authority from a vendor, you'll have to create your own. This step is not necessary if one intend to use a vendor to sign the request. To make a certificate authority (CA):
  1958.  
  1959. # openssl req -new -x509 -days 730 -config /etc/ssl/openssl.cnf \
  1960. -keyout CA/private/cakey.pem -out CA/cacert.pem
  1961.  
  1962.  
  1963.  
  1964. Create a certificate signing request
  1965.  
  1966. To make a new certificate (for mail server or web server for example), first create a request certificate with its private key. If your application do not support encrypted private key (for example UW-IMAP does not), then disable encryption with -nodes.
  1967.  
  1968. # openssl req -new -keyout newkey.pem -out newreq.pem \
  1969. -config /etc/ssl/openssl.cnf
  1970. # openssl req -nodes -new -keyout newkey.pem -out newreq.pem \
  1971. -config /etc/ssl/openssl.cnf                # No encryption for the key
  1972.  
  1973.  
  1974.  
  1975. Sign the certificate
  1976.  
  1977. The certificate request has to be signed by the CA to be valid, this step is usually done by the vendor. Note: replace "servername" with the name of your server in the next commands.
  1978.  
  1979. # cat newreq.pem newkey.pem > new.pem
  1980. # openssl ca -policy policy_anything -out servernamecert.pem \
  1981. -config /etc/ssl/openssl.cnf -infiles new.pem
  1982. # mv newkey.pem servernamekey.pem
  1983.  
  1984.  
  1985. Now servernamekey.pem is the private key and servernamecert.pem is the server certificate.
  1986.  
  1987. Create united certificate
  1988.  
  1989. The IMAP server wants to have both private key and server certificate in the same file. And in general, this is also easier to handle, but the file has to be kept securely!. Apache also can deal with it well. Create a file servername.pem containing both the certificate and key.
  1990.  
  1991.  
  1992.    *   Open the private key (servernamekey.pem) with a text editor and copy the private key into the "servername.pem" file.
  1993.  
  1994.    *   Do the same with the server certificate (servernamecert.pem).
  1995.  
  1996.  
  1997. The final servername.pem file should look like this:
  1998.  
  1999.  
  2000. -----BEGIN RSA PRIVATE KEY-----
  2001. MIICXQIBAAKBgQDutWy+o/XZ/[...]qK5LqQgT3c9dU6fcR+WuSs6aejdEDDqBRQ
  2002. -----END RSA PRIVATE KEY-----
  2003. -----BEGIN CERTIFICATE-----
  2004. MIIERzCCA7CgAwIBAgIBBDANB[...]iG9w0BAQQFADCBxTELMAkGA1UEBhMCREUx
  2005. -----END CERTIFICATE-----
  2006.  
  2007.  
  2008. What we have now in the directory /usr/local/certs/:
  2009.  
  2010.  
  2011.    *   CA/private/cakey.pem (CA server private key)
  2012.  
  2013.    *   CA/cacert.pem (CA server public key)
  2014.  
  2015.    *   certs/servernamekey.pem (server private key)
  2016.  
  2017.    *   certs/servernamecert.pem (server signed certificate)
  2018.  
  2019.    *   certs/servername.pem (server certificate with private key)
  2020.  
  2021.  
  2022. Keep the private key secure!
  2023.  
  2024. View certificate information
  2025.  
  2026. To view the certificate information simply do:
  2027.  
  2028. # openssl x509 -text -in servernamecert.pem      # View the certificate info
  2029. # openssl req -noout -text -in server.csr        # View the request info
  2030.  
  2031.  
  2032.  
  2033.  
  2034.  
  2035. CVS
  2036.  
  2037. Server setup | CVS test | SSH tunneling | CVS usage
  2038.  
  2039. Server setup
  2040.  
  2041. Initiate the CVS
  2042.  
  2043. Decide where the main repository will rest and create a root cvs. For example /usr/local/cvs (as root):
  2044.  
  2045. # mkdir -p /usr/local/cvs
  2046. # setenv CVSROOT /usr/local/cvs      # Set CVSROOT to the new location (local)
  2047. # cvs init                           # Creates all internal CVS config files
  2048. # cd /root
  2049. # cvs checkout CVSROOT               # Checkout the config files to modify them
  2050. # cd CVSROOT
  2051. edit config ( fine as it is)
  2052. # cvs commit config
  2053. cat >> writers                       # Create a writers file (optionally also readers)
  2054. colin
  2055. ^D                                   # Use [Control][D] to quit the edit
  2056. # cvs add writers                    # Add the file writers into the repository
  2057. # cvs edit checkoutlist
  2058. # cat >> checkoutlist
  2059. writers
  2060. ^D                                   # Use [Control][D] to quit the edit
  2061. # cvs commit                         # Commit all the configuration changes
  2062.  
  2063.  
  2064. Add a readers file if you want to differentiate read and write permissions Note: Do not (ever) edit files directly into the main cvs, but rather checkout the file, modify it and check it in. We did this with the file writers to define the write access.
  2065.  
  2066. There are three popular ways to access the CVS at this point. The first two don't need any further configuration. See the examples on CVSROOT below for how to use them:
  2067.  
  2068.  
  2069.     *   Direct local access to the file system. The user(s) need sufficient file permission to access the CS directly and there is no further authentication in addition to the OS login. However this is only useful if the repository is local.
  2070.  
  2071.     *   Remote access with ssh with the ext protocol. Any use with an ssh shell account and read/write permissions on the CVS server can access the CVS directly with ext over ssh without any additional tunnel. There is no server process running on the CVS for this to work. The ssh login does the authentication.
  2072.  
  2073.     *   Remote access with pserver. This is the preferred use for larger user base as the users are authenticated by the CVS pserver with a dedicated password database, there is therefore no need for local users accounts. This setup is explained below.
  2074.  
  2075.  
  2076.  
  2077. Network setup with inetd
  2078.  
  2079. The CVS can be run locally only if a network access is not needed. For a remote access, the daemon inetd can start the pserver with the following line in /etc/inetd.conf (/etc/xinetd.d/cvs on SuSE):
  2080.  
  2081. cvspserver  stream  tcp  nowait  cvs  /usr/bin/cvs  cvs \
  2082. --allow-root=/usr/local/cvs pserver
  2083.  
  2084.  
  2085. It is a good idea to block the cvs port from the Internet with the firewall and use an ssh tunnel to access the repository remotely.
  2086.  
  2087. Separate authentication
  2088.  
  2089. It is possible to have cvs users which are not part of the OS (no local users). This is actually probably wanted too from the security point of view. Simply add a file named passwd (in the CVSROOT directory) containing the users login and password in the crypt format. This is can be done with the apache htpasswd tool.
  2090.  
  2091. Note: This passwd file is the only file which has to be edited directly in the CVSROOT directory. Also it won't be checked out. More info with htpasswd --help
  2092.  
  2093. # htpasswd -cb passwd user1 password1  # -c creates the file
  2094. # htpasswd -b passwd user2 password2
  2095.  
  2096.  
  2097.  
  2098. Now add :cvs at the end of each line to tell the cvs server to change the user to cvs (or whatever your cvs server is running under). It looks like this:
  2099.  
  2100. # cat passwd
  2101. user1:xsFjhU22u8Fuo:cvs
  2102. user2:vnefJOsnnvToM:cvs
  2103.  
  2104.  
  2105.  
  2106. Test it
  2107.  
  2108. Test the login as normal user (for example here me)
  2109.  
  2110. # cvs -d :pserver:colin@192.168.50.254:/usr/local/cvs login
  2111. Logging in to :pserver:colin@192.168.50.254:2401/usr/local/cvs
  2112. CVS password:
  2113.  
  2114.  
  2115.  
  2116. CVSROOT variable
  2117.  
  2118. This is an environment variable used to specify the location of the repository we're doing operations on. For local use, it can be just set to the directory of the repository. For use over the network, the transport protocol must be specified. Set the CVSROOT variable with setenv CVSROOT string on a csh, tcsh shell, or with export CVSROOT=string on a sh, bash shell.
  2119.  
  2120. # setenv CVSROOT :pserver:<username>@<host>:/cvsdirectory
  2121. For example:
  2122. # setenv CVSROOT /usr/local/cvs                               # Used locally only
  2123. # setenv CVSROOT :local:/usr/local/cvs                        # Same as above
  2124. # setenv CVSROOT :ext:user@cvsserver:/usr/local/cvs           # Direct access with SSH
  2125. # setenv CVS_RSH ssh                                          # for the ext access
  2126. # setenv CVSROOT :pserver:user@cvsserver.254:/usr/local/cvs   # network with pserver
  2127.  
  2128.  
  2129. When the login succeeded one can import a new project into the repository:
  2130. cd into your project root directory
  2131.  
  2132. cvs import <module name> <vendor tag> <initial tag>
  2133. cvs -d :pserver:colin@192.168.50.254:/usr/local/cvs import MyProject MyCompany START
  2134.  
  2135.  
  2136.  
  2137. Where MyProject is the name of the new project in the repository (used later to checkout). Cvs will import the current directory content into the new project.
  2138.  
  2139.  
  2140. To checkout:
  2141.  
  2142. # cvs -d :pserver:colin@192.168.50.254:/usr/local/cvs checkout MyProject
  2143. or
  2144. # setenv CVSROOT :pserver:colin@192.168.50.254:/usr/local/cvs
  2145. # cvs checkout MyProject
  2146.  
  2147.  
  2148.  
  2149. SSH tunneling for CVS
  2150.  
  2151. We need 2 shells for this. On the first shell we connect to the cvs server with ssh and port-forward the cvs connection. On the second shell we use the cvs normally as if it where running locally.
  2152.  
  2153.  
  2154. on shell 1:
  2155.  
  2156. # ssh -L2401:localhost:2401 colin@cvs_server   # Connect directly to the CVS server. Or:
  2157. # ssh -L2401:cvs_server:2401 colin@gateway     # Use a gateway to reach the CVS
  2158.  
  2159.  
  2160. on shell 2:
  2161.  
  2162. # setenv CVSROOT :pserver:colin@localhost:/usr/local/cvs
  2163. # cvs login
  2164. Logging in to :pserver:colin@localhost:2401/usr/local/cvs
  2165. CVS password:
  2166. # cvs checkout MyProject/src
  2167.  
  2168.  
  2169. CVS commands and usage
  2170.  
  2171. Import
  2172.  
  2173. The import command is used to add a whole directory, it must be run from within the directory to be imported. Say the directory /devel/ contains all files and subdirectories to be imported. The directory name on the CVS (the module) will be called "myapp".
  2174.  
  2175. # cvs import [options] directory-name vendor-tag release-tag
  2176. # cd /devel                          # Must be inside the project to import it
  2177. # cvs import myapp Company R1_0      # Release tag can be anything in one word
  2178.  
  2179.  
  2180. After a while a new directory "/devel/tools/" was added and it has to be imported too.
  2181.  
  2182. # cd /devel/tools
  2183. # cvs import myapp/tools Company R1_0
  2184.  
  2185.  
  2186. Checkout update add commit
  2187.  
  2188. # cvs co myapp/tools                 # Will only checkout the directory tools
  2189. # cvs co -r R1_1 myapp               # Checkout myapp at release R1_1 (is sticky)
  2190. # cvs -q -d update -P                # A typical CVS update
  2191. # cvs update -A                      # Reset any sticky tag (or date, option)
  2192. # cvs add newfile                    # Add a new file
  2193. # cvs add -kb newfile                # Add a new binary file
  2194. # cvs commit file1 file2             # Commit the two files only
  2195. # cvs commit -m "message"            # Commit all changes done with a message
  2196.  
  2197.  
  2198.  
  2199. Create a patch
  2200.  
  2201. It is best to create and apply a patch from the working development directory related to the project, or from within the source directory.
  2202.  
  2203. # cd /devel/project
  2204. # diff -Naur olddir newdir > patchfile # Create a patch from a directory or a file
  2205. # diff -Naur oldfile newfile > patchfile
  2206.  
  2207.  
  2208. Apply a patch
  2209.  
  2210. Sometimes it is necessary to strip a directory level from the patch, depending how it was created. In case of difficulties, simply look at the first lines of the patch and try -p0, -p1 or -p2.
  2211.  
  2212. # cd /devel/project
  2213. # patch --dry-run -p0 < patchfile    # Test the path without applying it
  2214. # patch -p0 < patchfile
  2215. # patch -p1 < patchfile              # strip off the 1st level from the path
  2216.  
  2217.  
  2218.  
  2219.  
  2220. SVN
  2221.  
  2222. Server setup | SVN+SSH | SVN over http | SVN usage
  2223.  
  2224. Subversion (SVN)http://subversion.tigris.org/ is a version control system designed to be the successor of CVS (Concurrent Versions System). The concept is similar to CVS, but many shortcomings where improved. See also the SVN bookhttp://svnbook.red-bean.com/en/1.4/.
  2225. Server setup
  2226.  
  2227. The initiation of the repository is fairly simple (here for example /home/svn/ must exist):
  2228.  
  2229. # svnadmin create --fs-type fsfs /home/svn/project1
  2230.  
  2231.  
  2232. Now the access to the repository is made possible with:
  2233.  
  2234.  
  2235.     *   file:// Direct file system access with the svn client with. This requires local permissions on the file system.
  2236.  
  2237.     *   svn:// or svn+ssh:// Remote access with the svnserve server (also over SSH). This requires local permissions on the file system.
  2238.  
  2239.     *   http:// Remote access with webdav using apache. No local users are necessary for this method.
  2240.  
  2241.  
  2242. Using the local file system, it is now possible to import and then check out an existing project. Unlike with CVS it is not necessary to cd into the project directory, simply give the full path:
  2243.  
  2244. # svn import /project1/ file:///home/svn/project1/trunk -m 'Initial import'
  2245. # svn checkout file:///home/svn/project1
  2246.  
  2247.  
  2248. The new directory "trunk" is only a convention, this is not required.
  2249. Remote access with ssh
  2250.  
  2251. No special setup is required to access the repository via ssh, simply replace file:// with svn+ssh/hostname. For example:
  2252.  
  2253. # svn checkout svn+ssh://hostname/home/svn/project1
  2254.  
  2255.  
  2256. As with the local file access, every user needs an ssh access to the server (with a local account) and also read/write access. This method might be suitable for a small group. All users could belong to a subversion group which owns the repository, for example:
  2257.  
  2258. # groupadd subversion
  2259. # groupmod -A user1 subversion
  2260. # chown -R root:subversion /home/svn
  2261. # chmod -R 770 /home/svn
  2262.  
  2263.  
  2264. Remote access with http (apache)
  2265.  
  2266. Remote access over http (https) is the only good solution for a larger user group. This method uses the apache authentication, not the local accounts. This is a typical but small apache configuration:
  2267.  
  2268. LoadModule dav_module         modules/mod_dav.so
  2269. LoadModule dav_svn_module     modules/mod_dav_svn.so
  2270. LoadModule authz_svn_module   modules/mod_authz_svn.so    # Only for access control
  2271.  
  2272. <Location /svn>
  2273.   DAV svn
  2274.   # any "/svn/foo" URL will map to a repository /home/svn/foo
  2275.   SVNParentPath /home/svn
  2276.   AuthType Basic
  2277.   AuthName "Subversion repository"
  2278.   AuthzSVNAccessFile /etc/apache2/svn.acl
  2279.   AuthUserFile /etc/apache2/svn-passwd
  2280.   Require valid-user
  2281. </Location>
  2282.  
  2283.  
  2284. The apache server needs full access to the repository:
  2285.  
  2286. # chown -R www:www /home/svn
  2287.  
  2288.  
  2289. Create a user with htpasswd2:
  2290.  
  2291. # htpasswd -c /etc/svn-passwd user1  # -c creates the file
  2292.  
  2293.  
  2294. Access control svn.acl example
  2295.  
  2296. # Default it read access. "* =" would be default no access
  2297. [/]
  2298. * = r
  2299. [groups]
  2300. project1-developers = joe, jack, jane
  2301. # Give write access to the developers
  2302. [project1:]
  2303. @project1-developers = rw
  2304.  
  2305.  
  2306.  
  2307. SVN commands and usage
  2308.  
  2309. See also the Subversion Quick Reference Cardhttp://www.cs.put.poznan.pl/csobaniec/Papers/svn-refcard.pdf. Tortoise SVNhttp://tortoisesvn.tigris.org is a nice Windows interface.
  2310. Import
  2311.  
  2312. A new project, that is a directory with some files, is imported into the repository with the import command. Import is also used to add a directory with its content to an existing project.
  2313.  
  2314. # svn help import                                # Get help for any command
  2315.     # Add a new directory (with content) into the src dir on project1
  2316. # svn import /project1/newdir http://host.url/svn/project1/trunk/src -m 'add newdir'
  2317.  
  2318.  
  2319. Typical SVN commands
  2320.  
  2321. # svn co http://host.url/svn/project1/trunk      # Checkout the most recent version
  2322.     # Tags and branches are created by copying
  2323. # svn mkdir http://host.url/svn/project1/tags/   # Create the tags directory
  2324. # svn copy -m "Tag rc1 rel." http://host.url/svn/project1/trunk \
  2325.                              http://host.url/svn/project1/tags/1.0rc1
  2326. # svn status [--verbose]                         # Check files status into working dir
  2327. # svn add src/file.h src/file.cpp                # Add two files
  2328. # svn commit -m 'Added new class file'           # Commit the changes with a message
  2329. # svn ls http://host.url/svn/project1/tags/      # List all tags
  2330. # svn move foo.c bar.c                           # Move (rename) files
  2331. # svn delete some_old_file                       # Delete files
  2332.  
  2333.  
  2334.  
  2335.  
  2336.  
  2337. Useful Commands
  2338.  
  2339. less | vi | mail | tar | dd | screen | find | Miscellaneous
  2340.  
  2341. less
  2342.  
  2343. The less command displays a text document on the console. It is present on most installation.
  2344.  
  2345. # less unixtoolbox.xhtml
  2346.  
  2347.  
  2348. Some important commands are (^N stands for [control]-[N]):
  2349.  
  2350.  
  2351.     *   h  H       good help on display
  2352.  
  2353.     *   f  ^F  ^V  SPACE       Forward  one window (or N lines).
  2354.  
  2355.     *   b  ^B  ESC-v       Backward one window (or N lines).
  2356.  
  2357.     *   F       Forward forever; like "tail -f".
  2358.  
  2359.     *   /pattern       Search forward for (N-th) matching line.
  2360.  
  2361.     *   ?pattern       Search backward for (N-th) matching line.
  2362.  
  2363.     *   n       Repeat previous search (for N-th occurrence).
  2364.  
  2365.     *   N       Repeat previous search in reverse direction.
  2366.  
  2367.     *   q       quit
  2368.  
  2369.  
  2370.  
  2371.  
  2372. vi
  2373.  
  2374. Vi is present on ANY Linux/Unix installation and it is therefore useful to know some basic commands. There are two modes: command mode and insertion mode. The commands mode is accessed with [ESC], the insertion mode with i.
  2375. Quit
  2376.  
  2377.  
  2378.     *   :w newfilename       save the file to newfilename
  2379.  
  2380.     *   :wq or :x       save and quit
  2381.  
  2382.     *   :q!       quit without saving
  2383.  
  2384.  
  2385. Search and move
  2386.  
  2387.  
  2388.     *   /string       Search forward for string
  2389.  
  2390.     *   ?string       Search back for string
  2391.  
  2392.     *   n       Search for next instance of string
  2393.  
  2394.     *   N       Search for previous instance of string
  2395.  
  2396.     *   {       Move a paragraph back
  2397.  
  2398.     *   }       Move a paragraph forward
  2399.  
  2400.     *   1G       Move to the first line of the file
  2401.  
  2402.     *   nG       Move to the n th line of the file
  2403.  
  2404.     *   G       Move to the last line of the file
  2405.  
  2406.     *   :%s/OLD/NEW/g       Search and replace every occurrence
  2407.  
  2408.  
  2409. Delete text
  2410.  
  2411.  
  2412.     *   dd       delete current line
  2413.  
  2414.     *   D       Delete to the end of the line
  2415.  
  2416.     *   dw       Delete word
  2417.  
  2418.     *   x       Delete character
  2419.  
  2420.     *   u       Undo last
  2421.  
  2422.     *   U       Undo all changes to current line
  2423.  
  2424.  
  2425.  
  2426. mail
  2427.  
  2428. The mail command is a basic application to read and send email, it is usually installed. To send an email simply type "mail user@domain". The first line is the subject, then the mail content. Terminate and send the email with a single dot (.) in a new line. Example:
  2429.  
  2430. # mail c@cb.vu
  2431. Subject: Your text is full of typos
  2432. "For a moment, nothing happened. Then, after a second or so,
  2433. nothing continued to happen."
  2434. .
  2435. EOT
  2436. #
  2437.  
  2438.  
  2439. This is also working with a pipe:
  2440.  
  2441. # echo "This is the mail body" | mail c@cb.vu
  2442.  
  2443.  
  2444. This is also a simple way to test the mail server.
  2445.  
  2446. tar
  2447.  
  2448. The command tar (tape archive) creates and extracts archives of file and directories. The archive .tar is uncompressed, a compressed archive has the extension .tgz or .tar.gz (zip) or .tbz (bzip2). Do not use absolute path when creating an archive, you probably want to unpack it somewhere else. Some typical commands are:
  2449. Create
  2450.  
  2451. # cd /
  2452. # tar -cf home.tar home/        # archive the whole /home directory (c for create)
  2453. # tar -czf home.tgz home/       # same with zip compression
  2454. # tar -cjf home.tbz home/       # same with bzip2 compression
  2455.  
  2456.  
  2457. Only include one (or two) directories from a tree, but keep the relative structure. For example archive /usr/local/etc and /usr/local/www and the first directory in the archive should be local/.
  2458.  
  2459. # tar -C /usr -czf local.tgz local/etc local/www
  2460. # tar -C /usr -xzf local.tgz    # To untar the local dir into /usr
  2461. # cd /usr; tar -xzf local.tgz   # Is the same as above
  2462.  
  2463.  
  2464. Extract
  2465.  
  2466. # tar -tzf home.tgz             # look inside the archive without extracting (list)
  2467. # tar -xf home.tar              # extract the archive here (x for extract)
  2468. # tar -xzf home.tgz             # same with zip compression
  2469. # tar -xjf home.tgz             # same with bzip2 compression
  2470. # tar -xjf home.tgz home/colin/file.txt    # Restore a single file
  2471.  
  2472.  
  2473. More advanced
  2474.  
  2475. # tar c dir/ | gzip | ssh user@remote 'dd of=dir.tgz' # arch dir/ and store remotely.
  2476. # tar cvf - `find . -print` > backup.tar              # arch the current directory.
  2477. # tar -cf - -C /etc . | tar xpf - -C /backup/etc      # Copy directories
  2478. # tar -cf - -C /etc . | ssh user@remote tar xpf - -C /backup/etc      # Remote copy.
  2479. # tar -czf home.tgz --exclude '*.o' --exclude 'tmp/' home/
  2480.  
  2481.  
  2482. dd
  2483.  
  2484. The program dd (disk dump) is used to copy partitions and disks and for other copy tricks. Typical usage:
  2485.  
  2486. # dd if=<source> of=<target> bs=<byte size> conv=<conversion>
  2487.  
  2488.  
  2489. Important conv options:
  2490.  
  2491.  
  2492.     *   notrunc       do not truncate the output file, all zeros will be written as zeros.
  2493.  
  2494.     *   noerror       continue after read errors (e.g. bad blocks)
  2495.  
  2496.     *   sync       pad every input block with Nulls to ibs-size
  2497.  
  2498.  
  2499. The default byte size is 512 (one block). The MBR, where the partiton table is located, is on the first block, the first 63 blocks of a disk are empty. Larger byte sizes are faster to copy but require also more memory.
  2500. Backup and restore
  2501.  
  2502. # dd if=/dev/hda of=/dev/hdc bs=16065b                # Copy disk to disk (same size)
  2503. # dd if=/dev/sda7 of /home/root.img bs=4096 conv=notrunc,noerror # Backup /
  2504. # dd if /home/root.img of=/dev/sda7 bs=4096 conv=notrunc,noerror # Restore /
  2505. # dd bs=1M if=/dev/ad4s3e | gzip -c > ad4s3e.gz                  # Zip the backup
  2506. # gunzip -dc ad4s3e.gz | dd of=/dev/ad0s3e bs=1M                 # Restore the zip
  2507. # dd bs=1M if=/dev/ad4s3e | gzip | ssh eedcoba@fry 'dd of=ad4s3e.gz' # also remote
  2508. # gunzip -dc ad4s3e.gz | ssh eedcoba@host 'dd of=/dev/ad0s3e bs=1M'
  2509. # dd if=/dev/ad0 of=/dev/ad2 skip=1 seek=1 bs=4k conv=noerror    # Skip MBR
  2510.     # This is necessary if the destination (ad2) is smaller.
  2511.  
  2512.  
  2513.  
  2514. Recover
  2515.  
  2516. The command dd will read every single block of the partiton, even the blocks. In case of problems it is better to use the option conv=sync,noerror so dd will skip the bad block and write zeros at the destination. Accordingly it is important to set the block size equal or smaller than the disk block size. A 1k size seems safe, set it with bs=1k. If a disk has bad sectors and the data should be recovered from a partiton, create an image file with dd, mount the image and copy the content to a new disk. With the option noerror, dd will skip the bad sectors and write zeros instead, thus only the data contained in the bad sectors will be lost.
  2517.  
  2518. # dd if=/dev/hda of=/dev/null bs=1m                   # Check for bad blocks
  2519. # dd bs=1k if=/dev/hda1 conv=sync,noerror,notrunc | gzip | ssh \ # Send to remote
  2520. root@fry 'dd of=hda1.gz bs=1k'
  2521. # dd bs=1k if=/dev/hda1 conv=sync,noerror,notrunc of=hda1.img    # Store into an image
  2522. # mount -o loop /hda1.img /mnt                        # Mount the image
  2523. # rsync -ax /mnt/ /newdisk/                           # Copy on a new disk
  2524. # dd if=/dev/hda of=/dev/hda                          # Refresh the magnetic state
  2525.   # The above is useful to refresh a disk. It is perfectly safe, but must be unmounted.
  2526.  
  2527.  
  2528. Delete
  2529.  
  2530. # dd if=/dev/zero of=/dev/hdc count=1                 # Delete MBR and partiton table
  2531. # dd if=/dev/zero of=/dev/hdc                         # Delete full disk
  2532. # dd if=/dev/urandom of=/dev/hdc                      # Delete full disk better
  2533. # kill -USR1 PID                                      # View dd progress (Linux only!)
  2534.  
  2535.  
  2536.  
  2537.  
  2538. screen
  2539.  
  2540. Screen has two main functionalities:
  2541.  
  2542.  
  2543.     * Run multiple terminal session within a single terminal.
  2544.  
  2545.     * A started program is decoupled from the real terminal and can thus run in the background. The real terminal can be closed and reattached later.
  2546.  
  2547.  
  2548. Short start example
  2549.  
  2550. start screen with:
  2551.  
  2552. # screen
  2553.  
  2554.  
  2555. Within the screen session we can start a long lasting program (like top). Detach the terminal and reattach the same terminal from an other machine (over ssh for example).
  2556.  
  2557. # top
  2558.  
  2559.  
  2560. Now detach with Ctrl-a Ctrl-d. Reattach the terminal with
  2561.  
  2562. # screen -r
  2563.  
  2564.  
  2565. or better:
  2566.  
  2567. # screen -R -D
  2568.  
  2569.  
  2570. Attach here and now. In detail this means: If a session is running, then reattach. If  necessary detach and logout remotely first. If it was not running create it and notify the user.
  2571.  
  2572. Screen commands (within screen)
  2573.  
  2574. All screen commands start with Ctrl-a.
  2575.  
  2576.  
  2577.     *   Ctrl-a ? help and summary of functions
  2578.  
  2579.     *   Ctrl-a c create an new window (terminal)
  2580.  
  2581.     *   Ctrl-a Ctrl-n and Ctrl-a Ctrl-p to switch to the next or previous
  2582.       window in the list, by number.
  2583.  
  2584.     *   Ctrl-a Ctrl-N where N is a number from 0 to 9, to switch to the corresponding window.
  2585.  
  2586.     *   Ctrl-a " to get a navigable list of running windows
  2587.  
  2588.    *   Ctrl-a a to clear a missed Ctrl-a
  2589.  
  2590.    *   Ctrl-a Ctrl-d to disconnect and leave the session running in the background
  2591.  
  2592.    *   Ctrl-a x lock the screen terminal with a password
  2593.  
  2594.  
  2595. The screen session is terminated when the program within the running terminal is closed and you logout from the terminal.
  2596.  
  2597. Find
  2598.  
  2599. Some important options:
  2600.  
  2601.  
  2602.    *   -x (on BSD) -xdev (on Linux)       Stay on the same file system (dev in fstab).
  2603.  
  2604.    *   -exec cmd {} \;       Execute the command and replace {} with the full path
  2605.  
  2606.    *   -iname       Like -name but is case insensitive
  2607.  
  2608.    *   -ls       Display information about the file (like ls -la)
  2609.  
  2610.    *   -size n       n is +-n (k M G T P)
  2611.  
  2612.    *   -cmin n       File's status was last changed n minutes ago.
  2613.  
  2614.  
  2615. # find . -type f ! -perm -444        # Find files not readable by all
  2616. # find . -type d ! -perm -111        # Find dirs not accessible by all
  2617. # find /home/user/ -cmin 10 -print   # Files created or modified in the last 10 min.
  2618. # find . -name '*.[ch]' | xargs grep -E 'expr' # Search 'expr' in this dir and below.
  2619. # find / -name "*.core" | xargs rm   # Find core dumps and delete them
  2620. # find / -name "*.core" -print -exec rm {} \;  # Other syntax
  2621. # find . \( -name "*.png" -o -name "*.jpg" \) -print
  2622.                                     # iname is not case sensitive
  2623. # find . \( -iname "*.png" -o -iname "*.jpg" \) -print -exec tar -rf images.tar {} \;
  2624. # find . -type f -name "*.txt" ! -name README.txt -print  # Exclude README.txt files
  2625. # find /var/ -size +1M -exec ls -lh {} \;
  2626. # find /var/ -size +1M -ls           # This is simpler
  2627. # find . -size +10M -size -50M -print
  2628. # find /usr/ports/ -name work -type d -print -exec rm -rf {} \;  # Clean the ports
  2629.    Find files with SUID; those file have to be kept secure
  2630. # find / -type f -user root -perm -4000 -exec ls -l {} \;
  2631.  
  2632.  
  2633.  
  2634. Miscellaneous
  2635.  
  2636. # which command                      # Show full path name of command
  2637. # time command                       # See how long a command takes to execute
  2638. # time cat                           # Use time as stopwatch. Ctrl-c to stop
  2639. # set | grep $USER                   # List the current environment
  2640. # cal -3                             # Display a three month calendar
  2641. # date [-u|--utc|--universal] [MMDDhhmm[[CC]YY][.ss]]
  2642. # date 10022155                      # Set date and time
  2643. # whatis grep                        # Display a short info on the command or word
  2644. # whereis java                       # Search path and standard directories for word
  2645. # setenv varname value               # Set env. variable varname to value (csh/tcsh)
  2646. # export varname="value"             # set env. variable varname to value (sh/ksh/bash)
  2647. # pwd                                # Print working directory
  2648. # mkdir -p /path/to/dir              # no error if existing, make parent dirs as needed
  2649. # rmdir /path/to/dir                 # Remove directory
  2650. # rm -rf /path/to/dir                # Remove directory and its content (force)
  2651. # cp -la /dir1 /dir2                 # Archive and hard link files instead of copy
  2652. # cp -lpR /dir1 /dir2                # Same for FreeBSD
  2653. # mv /dir1 /dir2                     # Rename a directory
  2654.  
  2655.  
  2656.  
  2657.  
  2658. Install Software
  2659.  
  2660. List installed packages
  2661.  
  2662. # rpm -qa                            # List installed packages (RH, SuSE, RPM based)
  2663. # dpkg -l                            # Debian, Ubuntu
  2664. # pkg_info                           # FreeBSD list all installed packages
  2665. # pkg_info -W smbd                   # FreeBSD show which package smbd belongs to
  2666. # pkginfo                            # Solaris
  2667.  
  2668.  
  2669. Add/remove software
  2670.  
  2671. Front ends: yast2/yast for SuSE, redhat-config-packages for Red Hat.
  2672.  
  2673. # rpm -i pkgname.rpm                 # install the package (RH, SuSE, RPM based)
  2674. # rpm -e pkgname                     # Remove package
  2675.  
  2676.  
  2677. Debian
  2678.  
  2679. # apt-get update                     # First update the package lists
  2680. # apt-get install emacs              # Install the package emacs
  2681. # dpkg --remove emacs                # Remove the package emacs
  2682.  
  2683.  
  2684. FreeBSD
  2685.  
  2686. # pkg_add -r rsync                   # Fetch and install rsync.
  2687. # pkg_delete /var/db/pkg/rsync-xx    # Delete the rsync package
  2688.  
  2689.  
  2690. Set where the packages are fetched from with the PACKAGESITE variable. For example:
  2691.  
  2692. # export PACKAGESITE=ftp://ftp.freebsd.org/pub/FreeBSD/ports/i386/packages/Latest/
  2693. # or ftp://ftp.freebsd.org/pub/FreeBSD/ports/i386/packages-6-stable/Latest/
  2694.  
  2695.  
  2696. FreeBSD ports
  2697.  
  2698. The port tree /usr/ports/ is a collection of software ready to compile and install. The ports are updated with the program portsnap.
  2699.  
  2700. # portsnap fetch extract             # Create the tree when running the first time
  2701. # portsnap fetch update              # Update the port tree
  2702. # cd /usr/ports/net/rsync/           # Select the package to install
  2703. # make install distclean             # Install and cleanup (also see man ports)
  2704. # make package                       # Make a binary package for the port
  2705.  
  2706.  
  2707.  
  2708. Library path
  2709.  
  2710. Due to complex dependencies and runtime linking, programs are difficult to copy to an other system or distribution. However for small programs with little dependencies, the missing libraries can be copied over. The runtime libraries (and the missing one) are checked with ldd and managed with ldconfig.
  2711.  
  2712. # ldd /usr/bin/rsync                 # List all needed runtime libraries
  2713. # ldconfig -n /path/to/libs/         # Add a path to the shared libraries directories
  2714. # ldconfig -m /path/to/libs/         # FreeBSD
  2715. # LD_LIBRARY_PATH                    # The variable set the link library path
  2716.  
  2717.  
  2718.  
  2719.  
  2720. Convert Media
  2721.  
  2722. Sometimes one simply need to convert a video, audio file or document to another format.
  2723. Text encoding
  2724.  
  2725. Text encoding can get totally wrong, specially when the language requires
  2726. special characters like àäç. The command iconv can convert from
  2727. one encoding to an other.
  2728.  
  2729. # iconv -f <from_encoding> -t <to_encoding> <input_file>
  2730. # iconv -f ISO8859-1 -t UTF-8 -o file.input > file_utf8
  2731. # iconv -l                           # List known coded character sets
  2732.  
  2733.  
  2734. Without the -f option, iconv will use the local char-set, which is usually fine
  2735. if the document displays well.
  2736. Unix - DOS newlines
  2737.  
  2738. Convert DOS (CR/LF) to Unix (LF) newlines within a Unix shell. See also dos2unix and unix2dos if you have them.
  2739.  
  2740. # sed 's/.$//' dosfile.txt > unixfile.txt
  2741.  
  2742.  
  2743. Convert Unix to DOS newlines within a Windows environment. Use sed from mingw or cygwin.
  2744.  
  2745. # sed -n p unixfile.txt > dosfile.txt
  2746.  
  2747.  
  2748.  
  2749. PDF to Jpeg and concatenate PDF files
  2750.  
  2751. Convert a PDF document with gs (GhostScript) to jpeg (or png) images for each page. Also much shorter with convert (from ImageMagick or GraphicsMagick).
  2752.  
  2753. # gs -dBATCH -dNOPAUSE -sDEVICE=jpeg -r150 -dTextAlphaBits=4 -dGraphicsAlphaBits=4 \
  2754. -dMaxStripSize=8192 -sOutputFile=unixtoolbox_%d.jpg unixtoolbox.pdf
  2755. # convert unixtoolbox.pdf unixtoolbox-%03d.png
  2756. # convert *.jpeg images.pdf          # Create a simple PDF with all pictures
  2757.  
  2758.  
  2759. Ghostscript can also concatenate multiple pdf files into a single one.
  2760.  
  2761. # gs -q -sPAPERSIZE=a4 -dNOPAUSE -dBATCH -sDEVICE=pdfwrite -sOutputFile=all.pdf \
  2762. file1.pdf file2.pdf ...              # On Windows use '#' instead of '='
  2763.  
  2764.  
  2765.  
  2766. Convert video
  2767.  
  2768. Compress the Canon digicam video with an mpeg4 codec and repair the crappy sound.
  2769.  
  2770. # mencoder -o videoout.avi -oac mp3lame -ovc lavc -srate 11025 \
  2771. -channels 1 -af-adv force=1 -lameopts preset=medium -lavcopts \
  2772. vcodec=msmpeg4v2:vbitrate=600 -mc 0 vidoein.AVI
  2773.  
  2774.  
  2775.  
  2776. Copy an audio cd
  2777.  
  2778. The program cdparanoiahttp://xiph.org/paranoia/ can save the audio tracks (FreeBSD port in audio/cdparanoia/), oggenc can encode in Ogg Vorbis format, lame converts to mp3.
  2779.  
  2780. # cdparanoia -B                      # Copy the tracks to wav files in current dir
  2781. # lame -b 256 in.wav out.mp3         # Encode in mp3 256 kb/s
  2782. # for i in *.wav; do lame -b 256 $i `basename $i .wav`.mp3; done
  2783. # oggenc in.wav -b 256 out.ogg       # Encode in Ogg Vorbis 256 kb/s
  2784.  
  2785.  
  2786.  
  2787.  
  2788. Printing
  2789.  
  2790. Print with lpr
  2791.  
  2792. # lpr unixtoolbox.ps                 # Print on default printer
  2793. # export PRINTER=hp4600              # Change the default printer
  2794. # lpr -Php4500 #2 unixtoolbox.ps     # Use printer hp4500 and print 2 copies
  2795. # lpr -o Duplex=DuplexNoTumble ...   # Print duplex along the long side
  2796. # lpr -o PageSize=A4,Duplex=DuplexNoTumble ...
  2797. # lpq                                # Check the queue on default printer
  2798. # lpq -l -Php4500                    # Queue on printer hp4500 with verbose
  2799. # lprm -                             # Remove all users jobs on default printer
  2800. # lprm -Php4500 3186                 # Remove job 3186. Find job nbr with lpq
  2801. # lpc status                         # List all available printers
  2802. # lpc status hp4500                  # Check if printer is online and queue length
  2803.  
  2804.  
  2805.  
  2806.  
  2807. Databases
  2808.  
  2809. PostgreSQL
  2810.  
  2811. Change root or a username password
  2812.  
  2813. # psql -d template1 -U pgsql
  2814. > alter user pgsql with password 'pgsql_password';  # Use username instead of "pgsql"
  2815.  
  2816.  
  2817. Create user and database
  2818.  
  2819. The commands createuser, dropuser, createdb and dropdb are convenient shortcuts equivalent to the SQL commands. The new user is bob with database bobdb ; use as root with pgsql the database super user:
  2820.  
  2821. # createuser -U pgsql -P bob         # -P will ask for password
  2822. # createdb -U pgsql -O bob bobdb     # new bobdb is owned by bob
  2823. # dropdb bobdb                       # Delete database bobdb
  2824. # dropuser bob                       # Delete user bob
  2825.  
  2826.  
  2827. The general database authentication mechanism is configured in pg_hba.conf
  2828. Grant remote access
  2829.  
  2830. The file $PGSQL_DATA_D/postgresql.conf specifies the address to bind to. Typically listen_addresses = '*' for Postgres 8.x.
  2831.  
  2832. The file $PGSQL_DATA_D/pg_hba.conf defines the access control. Examples:
  2833.  
  2834. # TYPE  DATABASE    USER        IP-ADDRESS        IP-MASK          METHOD
  2835. host    bobdb       bob        212.117.81.42     255.255.255.255   password
  2836. host    all         all        0.0.0.0/0                           password
  2837.  
  2838.  
  2839. Backup and restore
  2840.  
  2841. The backups and restore are done with the user pgsql or postgres. Backup and restore a single database:
  2842.  
  2843. # pg_dump --clean dbname > dbname_sql.dump
  2844. # psql dbname < dbname_sql.dump
  2845.  
  2846.  
  2847. Backup and restore all databases (including users):
  2848.  
  2849. # pg_dumpall --clean > full.dump
  2850. # psql -f full.dump postgres
  2851.  
  2852.  
  2853. In this case the restore is started with the database postgres which is better when reloading an empty cluster.
  2854.  
  2855. MySQL
  2856.  
  2857. Change mysql root or username password
  2858.  
  2859. Method 1
  2860.  
  2861. # /etc/init.d/mysql stop
  2862. or
  2863. # killall mysqld
  2864. # mysqld --skip-grant-tables
  2865. # mysqladmin -u root password 'newpasswd'
  2866. # /etc/init.d/mysql start
  2867.  
  2868.  
  2869. Method 2
  2870.  
  2871. # mysql -u root mysql
  2872. mysql> UPDATE USER SET PASSWORD=PASSWORD("newpassword") where user='root';
  2873. mysql> FLUSH PRIVILEGES;                           # Use username instead of "root"
  2874. mysql> quit
  2875.  
  2876.  
  2877. Create user and database
  2878.  
  2879. # mysql -u root mysql
  2880. mysql> CREATE DATABASE bobdb;
  2881. mysql> GRANT ALL ON *.* TO 'bob'@'%' IDENTIFIED BY 'pwd'; # Use localhost instead of %
  2882.                                                   # to restrict the network access
  2883. mysql> DROP DATABASE bobdb;                        # Delete database
  2884. mysql> DROP USER bob;                              # Delete user
  2885. mysql> DELETE FROM mysql.user WHERE user='bob and host='hostname'; # Alt. command
  2886. mysql> FLUSH PRIVILEGES;
  2887.  
  2888.  
  2889. Grant remote access
  2890.  
  2891. Remote access is typically permitted for a database, and not all databases. The file /etc/my.cnf contains the IP address to bind to. Typically comment the line bind-address = out.
  2892.  
  2893. # mysql -u root mysql
  2894. mysql> GRANT ALL ON bobdb.* TO bob@'xxx.xxx.xxx.xxx' IDENTIFIED BY 'PASSWORD';
  2895. mysql> REVOKE GRANT OPTION ON foo.* FROM bar@'xxx.xxx.xxx.xxx';
  2896. mysql> FLUSH PRIVILEGES;                  # Use 'hostname' or also '%' for full access
  2897.  
  2898.  
  2899. Backup and restore
  2900.  
  2901. Backup and restore a single database:
  2902.  
  2903. # mysqldump -u root -psecret --add-drop-database dbname > dbname_sql.dump
  2904. # mysql -u root -psecret -D dbname < dbname_sql.dump
  2905.  
  2906.  
  2907. Backup and restore all databases:
  2908.  
  2909. # mysqldump -u root -psecret --add-drop-database --all-databases > full.dump
  2910. # mysql -u root -psecret < full.dump
  2911.  
  2912.  
  2913. Here is "secret" the mysql root password, there is no space after -p. When the -p option is used alone (w/o password), the password is asked at the command prompt.
  2914.  
  2915. SQLite
  2916.  
  2917. SQLitehttp://www.sqlite.org is a small powerfull self-contined, serverless, zero-configuration SQL database.
  2918. Dump and restore
  2919.  
  2920. It can be useful to dump and restore an SQLite database. For example you can edit the dump file to change a column attribute or type and then restore the database. This is easier than messing with SQL commands. Use the command sqlite3 for a 3.x database.
  2921.  
  2922. # sqlite database.db .dump > dump.sql              # dump
  2923. # sqlite database.db < dump.sql                    # restore
  2924.  
  2925.  
  2926. Convert 2.x to 3.x database
  2927.  
  2928. sqlite database_v2.db .dump | sqlite3 database_v3.db
  2929.  
  2930.  
  2931.  
  2932. Disk Quota
  2933.  
  2934. A disk quota allows to limit the amount of disk space and/or the number of files a user or (or member of group) can use. The quotas are allocated on a per-file system basis and are enforced by the kernel.
  2935. Linux setup
  2936.  
  2937. The quota tools package usually needs to be installed, it contains the command line tools.
  2938.  
  2939. Activate the user quota in the fstab and remount the partition. If the partition is busy, either all locked files must be closed, or the system must be rebooted. Add usrquota to the fstab mount options, for example:
  2940.  
  2941. /dev/sda2     /home    reiserfs     rw,acl,user_xattr,usrquota 1 1
  2942. # mount -o remount /home
  2943. # mount                              # Check if usrquota is active, otherwise reboot
  2944.  
  2945.  
  2946. Initialize the quota.user file with quotacheck.
  2947.  
  2948. # quotacheck -vum /home
  2949. # chmod 644 /home/aquota.user        # To let the users check their own quota
  2950.  
  2951.  
  2952. Activate the quota either with the provided script (e.g. /etc/init.d/quotad on SuSE) or with quotaon:
  2953.  
  2954. quotaon -vu /home
  2955.  
  2956.  
  2957. Check that the quota is active with:
  2958.  
  2959. quota -v
  2960.  
  2961.  
  2962.  
  2963. FreeBSD setup
  2964.  
  2965. The quota tools are part of the base system, however the kernel needs the option quota. If it is not there, add it and recompile the kernel.
  2966.  
  2967. options QUOTA
  2968.  
  2969.  
  2970. As with Linux, add the quota to the fstab options (userquota, not usrquota):
  2971.  
  2972. /dev/ad0s1d    /home    ufs     rw,noatime,userquota    2  2
  2973. # mount /home                        # To remount the partition
  2974.  
  2975.  
  2976. Enable disk quotas in /etc/rc.conf and start the quota.
  2977.  
  2978. # grep quotas /etc/rc.conf
  2979. enable_quotas="YES"                  # turn on quotas on startup (or NO).
  2980. check_quotas="YES"                   # Check quotas on startup (or NO).
  2981. # /etc/rc.d/quota start
  2982.  
  2983.  
  2984.  
  2985. Assign quota limits
  2986.  
  2987. The quotas are not limited per default (set to 0). The limits are set with edquota for single users. A quota can be also duplicated to many users. The file structure is different between the quota implementations, but the principle is the same: the values of blocks and inodes can be limited. Only change the values of soft and hard. If not specified, the blocks are 1k. The grace period is set with edquota -t. For example:
  2988.  
  2989. # edquota -u colin
  2990.  
  2991.  
  2992. Linux
  2993.  
  2994. Disk quotas for user colin (uid 1007):
  2995.  Filesystem         blocks       soft       hard     inodes     soft     hard
  2996.  /dev/sda8            108       1000       2000          1        0        0
  2997.  
  2998.  
  2999. FreeBSD
  3000.  
  3001. Quotas for user colin:
  3002. /home: kbytes in use: 504184, limits (soft = 700000, hard = 800000)
  3003.   inodes in use: 1792, limits (soft = 0, hard = 0)
  3004.  
  3005.  
  3006. For many users
  3007.  
  3008. The command edquota -p is used to duplicate a quota to other users. For example to duplicate a reference quota to all users:
  3009.  
  3010. # edquota -p refuser `awk -F: '$3 > 499 {print $1}' /etc/passwd`
  3011. # edquota -p refuser user1 user2     # Duplicate to 2 users
  3012.  
  3013.  
  3014. Checks
  3015.  
  3016. Users can check their quota by simply typing quota (the file quota.user must be readable). Root can check all quotas.
  3017.  
  3018. # quota -u colin                     # Check quota for a user
  3019. # repquota /home                     # Full report for the partition for all users
  3020.  
  3021.  
  3022.  
  3023.  
  3024. Shells
  3025.  
  3026. Most Linux distributions use the bash shell while the BSDs use tcsh, the bourne shell is only used for scripts. Filters are very useful and can be piped:
  3027.  
  3028.  
  3029.    *   grep   Pattern matching
  3030.  
  3031.    *   sed   Search and Replace strings or characters
  3032.  
  3033.    *   cut   Print specific columns from a marker
  3034.  
  3035.    *   sort   Sort alphabetically or numerically
  3036.  
  3037.    *   uniq   Remove duplicate lines from a file
  3038.  
  3039.  
  3040. For example used all at once:
  3041.  
  3042. # ifconfig | sed 's/  / /g' | cut -d" " -f1 | uniq | grep -E "[a-z0-9]+" | sort -r
  3043. # ifconfig | sed '/.*inet addr:/!d;s///;s/ .*//'|sort -t. -k1,1n -k2,2n -k3,3n -k4,4n
  3044.  
  3045.  
  3046. The first character in the sed pattern is a tab. To write a tab on the console, use ctrl-v ctrl-tab.
  3047.  
  3048. bash
  3049.  
  3050. Redirects and pipes for bash and sh:
  3051.  
  3052. # cmd 1> file                         # Redirect stdout to file.
  3053. # cmd 2> file                         # Redirect stderr to file.
  3054. # cmd 1>> file                        # Redirect and append stdout to file.
  3055. # cmd &> file                         # Redirect both stdout and stderr to file.
  3056. # cmd >file 2>&1                      # Redirects stderr to stdout and then to file.
  3057. # cmd1 | cmd2                         # pipe stdout to cmd2
  3058. # cmd1 2>&1 | cmd2                    # pipe stdout and stderr to cmd2
  3059.  
  3060.  
  3061. Modify your configuration in ~/.bashrc (it can also be ~/.bash_profile). The following entries are useful, reload with ". .bashrc".
  3062.  
  3063. # in .bashrc
  3064. bind '"\e[A"':history-search-backward # Use up and down arrow to search
  3065. bind '"\e[B"':history-search-forward  # the history. Invaluable!
  3066. set -o emacs                          # Set emacs mode in bash (see below)
  3067. set bell-style visible                # Do not beep, inverse colors
  3068.    # Set a nice prompt like [user@host]/path/todir>
  3069. PS1="\[\033[1;30m\][\[\033[1;34m\]\u\[\033[1;30m\]"
  3070. PS1="$PS1@\[\033[0;33m\]\h\[\033[1;30m\]]\[\033[0;37m\]"
  3071. PS1="$PS1\w\[\033[1;30m\]>\[\033[0m\]"
  3072.  
  3073. # To check the currently active aliases, simply type alias
  3074. alias  ls='ls -aF'                    # Append indicator (one of */=>@|)
  3075. alias  ll='ls -aFls'                  # Listing
  3076. alias  la='ls -all'
  3077. alias ..='cd ..'
  3078. alias ...='cd ../..'
  3079. export HISTFILESIZE=5000              # Larger history
  3080. export CLICOLOR=1                     # Use colors (if possible)
  3081. export LSCOLORS=ExGxFxdxCxDxDxBxBxExEx
  3082.  
  3083.  
  3084.  
  3085. tcsh
  3086.  
  3087. Redirects and pipes for tcsh and csh (simple > and >> are the same as sh):
  3088.  
  3089. # cmd >& file                         # Redirect both stdout and stderr to file.
  3090. # cmd >>& file                        # Append both stdout and stderr to file.
  3091. # cmd1 | cmd2                         # pipe stdout to cmd2
  3092. # cmd1 |& cmd2                        # pipe stdout and stderr to cmd2
  3093.  
  3094.  
  3095.  
  3096. The settings for csh/tcsh are set in ~/.cshrc, reload with "source .cshrc". Examples:
  3097.  
  3098. # in .cshrc
  3099. alias  ls      'ls -aF'
  3100. alias  ll      'ls -aFls'
  3101. alias  la      'ls -all'
  3102. alias  ..      'cd ..'
  3103. alias  ...     'cd ../..'
  3104. set   prompt    = "%B%n%b@%B%m%b%/> " # like user@host/path/todir>
  3105. set   history   =  5000
  3106. set   savehist  = ( 6000 merge )
  3107. set   autolist                        # Report possible completions with tab
  3108. set   visiblebell                     # Do not beep, inverse colors
  3109.  
  3110. # Bindkey and colors
  3111. bindkey -e     Select Emacs bindings  # Use emacs keys to edit the command prompt
  3112. bindkey -k up history-search-backward # Use up and down arrow to search
  3113. bindkey -k down history-search-forward
  3114. setenv CLICOLOR 1                     # Use colors (if possible)
  3115. setenv LSCOLORS ExGxFxdxCxDxDxBxBxExEx
  3116.  
  3117.  
  3118. The emacs mode enables to use the emacs keys shortcuts to modify the command prompt line. This is extremely useful (not only for emacs users). The most used commands are:
  3119.  
  3120.  
  3121.    *   C-a       Move cursor to beginning of line
  3122.  
  3123.    *   C-e       Move cursor to end of line
  3124.  
  3125.    *   M-b       Move cursor back one word
  3126.  
  3127.    *   M-f       Move cursor forward one word
  3128.  
  3129.    *   M-d       Cut the next word
  3130.  
  3131.    *   C-w       Cut the last word
  3132.  
  3133.    *   C-u       Cut everything before the cursor
  3134.      
  3135.    *   C-k       Cut everything after the cursor (rest of the line)
  3136.  
  3137.    *   C-y       Paste the last thing to be cut (simply paste)
  3138.  
  3139.    *   C-_       Undo
  3140.  
  3141.  
  3142. Note: C- = hold control, M- = hold meta (which is usually the alt or escape key).
  3143.  
  3144.  
  3145. Scripting
  3146.  
  3147. Basics | Script example | sed/useful commands
  3148.  
  3149. The Bourne shell (/bin/sh) is present on all Unix installations and scripts written in this language are (quite) portable; man 1 sh is a good reference.
  3150.  
  3151. Basics
  3152.  
  3153. Variables and arguments
  3154.  
  3155. Assign with variable=value and get content with $variable
  3156.  
  3157. MESSAGE="Hello World"                        # Assign a string
  3158. PI=3.1415                                    # Assign a decimal number
  3159. N=8
  3160. TWON=`expr $N * 2`                           # Arithmetic expression (only integers)
  3161. TWON=$(($N * 2))                             # Other syntax
  3162. TWOPI=`echo "$PI * 2" | bc -l`               # Use bc for floating point operations
  3163. ZERO=`echo "c($PI/4)-sqrt(2)/2" | bc -l`
  3164.  
  3165.  
  3166. The command line arguments are
  3167.  
  3168. $0, $1, $2, ...                              # $0 is the command itself
  3169. $#                                           # The number of arguments
  3170. $*                                           # All arguments (also $@)
  3171.  
  3172.  
  3173. Special Variables
  3174.  
  3175. $$                                           # The current process ID
  3176. $?                                           # exit status of last command
  3177.  command
  3178.  if [ $? != 0 ]; then
  3179.    echo "command failed"
  3180.  fi
  3181. mypath=`pwd`
  3182. mypath=${mypath}/file.txt
  3183. echo ${mypath##*/}                           # Display the filename only
  3184. echo ${mypath%%.*}                           # Full path without extention
  3185. var2=${var:=string}                          # Use var if set, otherwise use string
  3186.                                             # assign string to var and then to var2.
  3187.  
  3188.  
  3189.  
  3190. Constructs
  3191.  
  3192. for file in `ls`
  3193. do
  3194.    echo $file
  3195. done
  3196.  
  3197. count=0
  3198. while [ $count -lt 5 ]; do
  3199.    echo $count
  3200.    sleep 1
  3201.    count=$(($count + 1))
  3202. done
  3203.  
  3204. myfunction() {
  3205.    find . -type f -name "*.$1" -print       # $1 is first argument of the function
  3206. }
  3207. myfunction "txt"
  3208.  
  3209.  
  3210. Generate a file
  3211.  
  3212. MYHOME=/home/colin
  3213. cat > testhome.sh << _EOF
  3214. # All of this goes into the file testhome.sh
  3215. if [ -d "$MYHOME" ] ; then
  3216.    echo $MYHOME exists
  3217. else
  3218.    echo $MYHOME does not exist
  3219. fi
  3220. _EOF
  3221. sh testhome.sh
  3222.  
  3223.  
  3224. Bourne script example
  3225.  
  3226. As a small example, the script used to create a PDF booklet from this xhtml document:
  3227.  
  3228. #!/bin/sh
  3229. # This script creates a book in pdf format ready to print on a duplex printer
  3230. if [ $# -ne 1 ]; then                        # Check the argument
  3231.  echo 1>&2 "Usage: $0 HtmlFile"
  3232.  exit 1                                     # non zero exit if error
  3233. fi
  3234.  
  3235. file=$1                                      # Assign the filename
  3236. fname=${file%.*}                             # Get the name of the file only
  3237. fext=${file#*.}                              # Get the extension of the file
  3238.  
  3239. prince $file -o $fname.pdf                   # from www.princexml.com
  3240. pdftops -paper A4 -noshrink $fname.pdf $fname.ps # create postscript booklet
  3241. cat $fname.ps |psbook|psnup -Pa4 -2 |pstops -b "2:0,1U(21cm,29.7cm)" > $fname.book.ps
  3242.  
  3243. ps2pdf13 -sPAPERSIZE=a4 -sAutoRotatePages=None $fname.book.ps $fname.book.pdf
  3244.                                             # use #a4 and #None on Windows!
  3245. exit 0                                       # exit 0 means successful
  3246.  
  3247.  
  3248.  
  3249. Some sed commands
  3250.  
  3251. sed 's/string1/string2/g'                    # Replace string1 with string2
  3252. sed -i 's/wroong/wrong/g' *.txt              # Replace a recurring word with g
  3253. sed 's/\(.*\)1/\12/g'                        # Modify anystring1 to anystring2
  3254. sed '/<p>/,/<\/p>/d' t.xhtml                 # Delete lines that start with <p>
  3255.                                             # and end with </p>
  3256. sed '/ *#/d; /^ *$/d'                        # Remove comments and blank lines
  3257. sed 's/[ \t]*$//'                            # Remove trailing spaces (use tab as \t)
  3258. sed 's/^[ \t]*//;s/[ \t]*$//'                # Remove leading and trailing spaces
  3259. sed 's/[^*]/[&]/'                            # Enclose first char with [] top->[t]op
  3260.  
  3261.  
  3262. Some useful commands
  3263.  
  3264. sort -t. -k1,1n -k2,2n -k3,3n -k4,4n         # Sort IPv4 ip addresses
  3265. echo 'Test' | tr '[:lower:]' '[:upper:]'     # Case conversion
  3266. echo foo.bar | cut -d . -f 1                 # Returns foo
  3267. PID=$(ps | grep script.sh | grep bin | awk '{print $1}')    # PID of a running script
  3268. PID=$(ps axww | grep [p]ing | awk '{print $1}')             # PID of ping (w/o grep pid)
  3269. IP=$(ifconfig $INTERFACE | sed '/.*inet addr:/!d;s///;s/ .*//')   # Linux
  3270. IP=$(ifconfig $INTERFACE | sed '/.*inet /!d;s///;s/ .*//')        # FreeBSD
  3271. if [ `diff file1 file2 | wc -l` != 0 ]; then [...] fi       # File changed?
  3272. cat /etc/master.passwd | grep -v root | grep -v \*: | awk -F":" \ # Create http passwd
  3273. '{ printf("%s:%s\n", $1, $2) }' > /usr/local/etc/apache2/passwd
  3274.  
  3275. testuser=$(cat /usr/local/etc/apache2/passwd | grep -v \    # Check user in passwd
  3276. root | grep -v \*: | awk -F":" '{ printf("%s\n", $1) }' | grep ^user$)
  3277.  
  3278.  
  3279.  
  3280.  
  3281. Programming
  3282.  
  3283. C basics
  3284.  
  3285. strcpy(newstr,str)                        /* copy str to newstr */
  3286. expr1 ? expr2 : expr3                     /* if (expr1) expr2 else expr3 */
  3287. x = (y > z) ? y : z;                      /* if (y > z) x = y; else x = z; */
  3288. int a[]={0,1,2};                          /* Initialized array (or a[3]={0,1,2}; */
  3289. int a[2][3]={{1,2,3},{4,5,6}};            /* Array of array of ints */
  3290. int i = 12345;                            /* Convert in i to char str */
  3291. char str[10];
  3292. sprintf(str, "%d", i);
  3293.  
  3294.  
  3295. C example
  3296.  
  3297. A minimal c program simple.c:
  3298.  
  3299. #include <stdio.h>
  3300. main() {
  3301.    int number=42;
  3302.    printf("The answer is %i\n", number);  
  3303. }
  3304.  
  3305.  
  3306. Compile with:
  3307.  
  3308. # gcc simple.c -o simple
  3309. # ./simple
  3310. The answer is 42
  3311.  
  3312.  
  3313.  
  3314. C++ basics
  3315.  
  3316. *pointer                                  // Object pointed to by pointer
  3317. &obj                                      // Address of object obj
  3318. obj.x                                     // Member x of class obj (object obj)
  3319. pobj->x                                   // Member x of class pointed to by pobj
  3320.                                          // (*pobj).x and pobj->x are the same
  3321.  
  3322.  
  3323. C++ example
  3324.  
  3325. As a slightly more realistic program in C++, let's create a class in its own header (IPv4.h) and implementation (IPv4.cpp) and create a program which uses the class functionality. The class has a member to convert an IP address in integer format to the known quad format. This is a minimal c++ program with a class and multi-source compile.
  3326. IPv4 class
  3327.  
  3328. IPv4.h:
  3329.  
  3330. #ifndef IPV4_H
  3331. #define IPV4_H
  3332. #include <string>
  3333.  
  3334. namespace GenericUtils {                          // create a namespace
  3335. class IPv4 {                                      // class definition
  3336. public:
  3337.    IPv4();
  3338.    ~IPv4();
  3339.    std::string IPint_to_IPquad(unsigned long ip);// member interface
  3340. };
  3341. } //namespace GenericUtils
  3342. #endif // IPV4_H
  3343.  
  3344.  
  3345.  
  3346. IPv4.cpp:
  3347.  
  3348. #include "IPv4.h"
  3349. #include <string>
  3350. #include <sstream>
  3351. using namespace std;                              // use the namespaces
  3352. using namespace GenericUtils;
  3353.  
  3354. IPv4::IPv4() {}                                   // default constructor/destructor
  3355. IPv4::~IPv4() {}
  3356. string IPv4::IPint_to_IPquad(unsigned long ip) {  // member implementation
  3357.    ostringstream ipstr;                          // use a stringstream
  3358.    ipstr << ((ip &0xff000000) >> 24)             // Bitwise right shift
  3359.          << "." << ((ip &0x00ff0000) >> 16)
  3360.          << "." << ((ip &0x0000ff00) >> 8)
  3361.          << "." << ((ip &0x000000ff));
  3362.    return ipstr.str();
  3363. }
  3364.  
  3365.  
  3366. The program simplecpp.cpp
  3367.  
  3368. #include "IPv4.h"
  3369. #include <iostream>
  3370. #include <string>
  3371. using namespace std;
  3372.  
  3373. int main (int argc, char* argv[]) {
  3374.    string ipstr;                                 // define variables
  3375.    unsigned long ipint = 1347861486;             // The IP in integer form
  3376.    GenericUtils::IPv4 iputils;                   // create an object of the class
  3377.    ipstr = iputils.IPint_to_IPquad(ipint);       // call the class member
  3378.    cout << ipint << " = " << ipstr << endl;      // print the result
  3379.  
  3380.    return 0;
  3381. }
  3382.  
  3383.  
  3384.  
  3385. Compile and execute with:
  3386.  
  3387. # g++ -c IPv4.cpp simplecpp.cpp                # Compile in objects
  3388. # g++ IPv4.o simplecpp.o -o simplecpp.exe      # Link the objects to final executable
  3389. # ./simplecpp.exe
  3390. 1347861486 = 80.86.187.238
  3391.  
  3392.  
  3393. Use ldd to check which libraries are used by the executable and where they are located. This command is also used to check if a shared library is missing or if the executable is static.
  3394.  
  3395. # ldd /sbin/ifconfig
  3396.  
  3397.  
  3398. Simple Makefile
  3399.  
  3400. The corresponding minimal Makefile for the multi-source program is shown below. The lines with instructions must begin with a tab! The back slash "\" can be used to cut long lines.
  3401.  
  3402. CC = g++
  3403. CFLAGS = -O
  3404. OBJS = IPv4.o simplecpp.o
  3405.  
  3406. simplecpp: ${OBJS}
  3407.     ${CC} -o simplecpp ${CFLAGS} ${OBJS}
  3408. clean:
  3409.     rm -f ${TARGET} ${OBJS}
  3410.  
  3411.  
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!