Linux starting points........

In recent years a number of corporations have poured millions of dollars into creating Windows-like user interfaces for Linux, and into persuading the various major distros to adopt them.

See this article, for example:

http://troy-at-kde.livejournal.com/14690.html

There you have the owner of Slackware and his cronies being wined and dined by kde at a supposed "conference", which is just a way of disguising an expensive vacation. A bribe.

Primarily, I'm talking about kde, to a lesser degree, gnome. There's also one called xfce, and maybe a couple of other even lesser ones.

Henceforth, I'm just going to refer to kde, but I mean all of them.

Why are they doing this? Because they are threatened by people running a free operating system who actually understand how it works.

By people who don't need _them_. Who aren't _controlled_ by them.

You can let them lead you by the nose to kde and pretend that you are running Linux, but you won't be. You'll be letting kde run Linux for you. You'll be letting the corporations _behind_ kde
run Linux for you.

Ironically, it takes just as long to learn to use kde as it does to learn to run Linux from the shell, the commandline.

Myself and many others do this, and we can do anything that someone running kde can do. And a lot more.

The kde technocrats want you to think that Linux is so complicated that no mere mortal can comprehend it, and when you add kde to Linux (which more than doubles its size) it does indeed become too complex to deal with. How about that? :-)

But tens of of thousands of ordinary people managed to run Linux just fine before kde existed. And they didn't have anywhere near the documentation that's available now. Tens of thousands of
people _still_ run Linux from the commandline.

If you are thinking that running Linux from the commandline means spending all of your time typing in long commands, then you are quite mistaken. If you are thinking that it means you won't be able to run your favorite graphical applications and use a mouse, you are quite mistaken.

Two parallel courses of study are involved here: Learning the basics of how Linux works, and learning the basics of the shell,bash being the most common one these days.

We are all different; we are all individuals. We each need a unique user interface tailored to _our_ specific needs. And it is _easy_ to create one with just a little knowledge of bash.

Here are three excellent documents to get you on the path of freedom and power, to learning Linux instead of some artificial user interface:

The first section of this one is actually an introduction to the real basics of bash, how to use the command line. It's section on mathematical tools is not so hot.

See: http://groups.google.com/group/alt.linux/msg/208349400085e7a3

http://www.tldp.org/LDP/GNU-Linux-Tools-Summary/GNU-Linux-Tools-Summa...

How Linux actually works:

http://www.tldp.org/LDP/intro-linux/intro-linux.html.tar.gz

Basic shell scripting, etc:

http://www.tldp.org/LDP/Bash-Beginners-Guide/Bash-Beginners-Guide.htm...

These are basic reference documents:

This one is dated, but still very useful:

http://rute.2038bug.com/rute.html.tar.bz2

Don't let the word "advanced" throw you. There are many basic things covered in this fine work:

http://www.tldp.org/LDP/abs/abs-guide.html.tar.gz

These are good reference sites:

http://www.comptechdoc.org/os/linux/

http://www.tldp.org/LDP/Linux-Dictionary/html/index.html

http://linux-newbie.sunsite.dk/index.html

There is a free, online school for newbies out there, but I've
checked it out and wasn't much impressed.

---------------------------------------------------

I'm looking for people to teach the newbies, and for newbies who
want to learn to run Linux from the command line.

I am not interested in getting involved in running arguments
about the points I've raised.

If you disagree with me, simply post your opinions and others
will read them. You are entitled to them.

I will not be responding any more posts of an argumentative nature.

The usenet has thousands of people who will argue anything from
now until eternity. That's their thing. I have better things to
do.

Checking for suspicious account use

sulekha

the following is the recipe which i saw in Linux security cookbook

Checking for Suspicious Account Use

Problem
You want to discover unusual or dangerous usage of accounts on your system: dormant user accounts, recent logins to system accounts, etc.

Solution
To print information about the last login for each user:
$ lastlog [-u username]

To print the entire login history:
$ last [username]

To print failed login attempts:
$ lastb [username]

To enable recording of bad logins:
# touch /var/log/btmp
# chown --reference=/var/log/wtmp /var/log/btmp
# chmod --reference=/var/log/wtmp /var/log/btmp

how correct is this recipe? what are the modifications/changes that needs to made so as to make it work in ubuntu 8.04.1

ibutho

It seems accurate to me and the only modification you may need to do is prefix individual commands with sudo. /var/log/btmp stores all the last bad logins, but in most distros its not created by default. If you run "lastb", a list of all bad logins since you created /var/log/btmp will be shown. For a specific user, its "lastb user".


cariboo907

/var/log/btmp have been atomagically created on all the Debian based distro I have used.

hidden files in home directory

sulekha

can anyone explain me the purpose of the following hidden files which are usually seen in the home directory ?


.Xauthority
.xsession-errors
.recently-used-xbel
.recently-used
.pulse-cookie
.lesshst
.ICEauthority
.gksu.lock
.esd_auth


aarklon

The `.xsession' file, a hidden file in your home directory, specifies the clients that are automatically run when your X session first starts. It is just a shell script, usually containing a list of clients to run. You can edit your `.xsession' file in a text editor, and if this
file doesn't exist, you can create it.


Fritz monroe

I don't have details, but it's a place for you to start digging.

.Xauthority - X11 forwarding related
.xsession-errors - holds errors caused during the start of X Windows
.recently-used - Gnome's recently opened documents (Places >> Recent Documents)
.pulse-cookie - maybe pulseaudio related?
.lesshst - no idea
.ICEauthority - don't know
.gksu.lock - this is a lock file for gksu (Gtk+ frontend to su and sudo)
.esd_auth - something to do with the esd sound system.
.recently-used-xbel - not sure, seems to be GIMP related. So probably the GIMP recently opened images

Sidney Lambe

$ apropos Xauthority

Xauthority: nothing appropriate

$ apropos authority

Xau library: XauFileName [Xau] (3) - X authority database routines
XauDisposeAuth [Xau] (3) - X authority database routines
XauGetAuthByAddr [Xau] (3) - X authority database routines
XauGetBestAuthByAddr [Xau] (3) - X authority database routines
XauLockAuth [Xau] (3) - X authority database routines
XauReadAuth [Xau] (3) - X authority database routines
XauUnlockAuth [Xau] (3) - X authority database routines
XauWriteAuth [Xau] (3) - X authority database routines
iceauth (1x) - ICE authority file utility
xauth (1) - X authority file utility

And that last entry looks pretty promising.

$ man xauth

There's your answer, on your own box, right under your nose.


Mark Hobley

Maybe we need some more manual pages:

man .Xauthority

No manual entry for .Xauthority

man .xsession-errors

No manual entry for .xsession-errors

We have one for xsession, but it contains capitalized names. I don't know why we do this. The capital X is probably something to do with the X windowing system (or should that be the x windowing system? Hmmm, should we be using uppercase first letters for executables? Yuck! Letter
case adds to the confusion here).

man xsession

Xsession(5)

NAME
Xsession - initialize X session


N.B:- Tested in ubuntu 8.04.1

chown

Setting File Ownership with chown


Problem
You need to change ownership on a file or directory. Perhaps you've copied something to someone else's directory but she still can't edit it, because it's owned by you. Many Linux problems result from incorrect ownership or permission. You're seeing messages like "Permission denied" or "File is read-only" when it shouldn't be.

Solution
Use chown (change owner) to change the file owner, the file and group owner, or the group owner:
# chown user filename
# chown user:group filename
# chown :group filename

For example:
$ chown -v carlas:share index.txt
changed ownership of `index.txt' to carlas:share
$ chown -v :share toc.txt
changed ownership of `toc.txt' to :share


Problem
You want to change ownership of directories and their contents, or just the contents of directories, a list of files, or change ownership of files from one UID to another.

Solution

chown supports some batch operations, or you can use find, or you can use shell wildcards.

you can use shell wildcards:
# chown carlas *.txt

To give all of a user's files to another user, use:
# chown -R -v from valh piglet /shared/scripts

You can do the same thing with find:
# find / -user valh -exec chown -v piglet { } \;

find can also search by UID, which chown cannot:
# find / -uid 1050 -exec chown -v 1200 { } \;

To change the ownership of a directory, including subdirectories and files, with verbose output, use:
# chown -R -v piglet /shared/scripts

changed ownership of `scripts' to piglet
changed ownership of `scripts/backups.tgz' to piglet
changed ownership of `scripts/fake-spec-rpm' to piglet

Either the user's login name or UID can be used. If you've deleted a user and the user has left behind orphan files, you'll need the UID.

chmod

Use the setgid bit to automatically set the shared group ownership on files.
This is how to set it with octal notation: chmod -v 2775 /shared-directory

You can also use symbolic notation: chmod -v +s /shared-directory

Keep in mind that +s sets both the setgid and setuid bits, which could be a security problem if executables or scripts are stored in this directory. chmod 2775 sets only the setgid bit.


Add the sticky bit to prevent anyone but the file owner from deleting the file, by using:
# chmod +t /shared-directory or chmod 3775 /shared-directory

On a historical note , UNIX systems used to use the sticky bit on files to hoard executable files in swap space and avoid reloading.


Setting File and Directory Permissions with chmod's Symbolic Notation


You would like to change specific permission bits, rather than using the all-or-nothing approach of chmod's numeric notation, such as marking a script as executable.

Solution
The most common use for symbolic notation is to add the executable bit to a file's permissions without changing any other permissions:
$ chmod +x scriptname

The default action is a, or all, so the example makes scriptname executable by everyone. This adds the executable bit to the file owner only:
$ chmod u+x scriptname

You can surgically remove a specific mode bit. In this example, the group and other users lose their executable bits:
$ chmod go-x scriptname

This is a quick way to set the setgid bit on a directory, for creating a shared directory. All files created in this directory will have the same group ownership as the directory:
$ chmod +s /shared-directory

You can remove all permissions for group and other users by doing the following:
$ chmod go= scriptname

To make group permissions the same as the file owner's, use:
$ chmod g=u scriptname


Doing Batch Operations with chmod

Problem You need to set permissions on all the files or a directory, or on batches of files.

Solution

chmod supports operating on lists of files. You can also use find or shell wildcards to generate a list.

To make several files read-only for everyone, you can use chmod as follows:
$ chmod 444 file.txt file2.txt file3.txt

To make all files in the current directory readable/writable, for the file owner and group, without changing the directory permissions, use:
$ find . -type f -exec chmod -v 660 { } \;

You can also change all files belonging to a particular user. This example starts at the root of the filesystem:
$ find / -user terri -exec chmod -v 660 { } \;

You can set permissions for a directory and its contents, including subdirectories, with the -R (recursive) flag:
$ chmod -R -v 755 /shared

This example makes all the .txt files in the current directory readable/writable to the owner, and world-readable:
$ chmod -v 644 *.txt

To change all files in the current directory that begin with your chosen string, use:
$ chmod -v 644 apt*


access mode symbolic octal

suid s with u 4000
sgid s with g 2000
sticky t 1000


immutable files

ex: touch keep.txt
chattr +i keep.txt


only root user can create an immutable file but cannot delete it until the flag is removed.
making files immutable is often done as a part of security or intrusion detection effort

Configuring Filesystem Mounts with /etc/fstab

Problem

Users need to make their own backups on CDs, and use USB memory sticks and other types of removable media. You don't want to give them root privileges just so they can mount these devices. But only root can use the mount command we discussed in Recipe 9.9. And you also want to control which file systems are automatically mounted at boot.

Solution

Add entries to /etc/fstab, defining mount points and access permissions.
This example shows a Linux partition, two Windows partitions, and removable media:

#
/dev/hda6 /rh-data reiserfs defaults,user,noauto 0 1
/dev/hda1 /win2k ntfs defaults,user,ro,gid=win2k 0 0
/dev/hda2 /win98 vfat defaults,user,gid=win98 0 0
/dev/hdc0 /cdrom auto defaults,user,noauto,ro 0 0
/dev/fd0 /floppy auto defaults,user,noauto 0 0
/dev/sda1 /memstick auto defaults,user,noauto 0 0

Once a device has an entry in /etc/fstab, it can be mounted by using the mountpoint:
$ mount /cdrom
$ mount /memstick

And unmounted the same way: $ umount /cdrom


Discussion

These are the six fields that make up /etc/fstab:

device The device name assigned by the kernel.

mountpoint The directory to which the filesystem is attached, which is user-defined.


type The filesystem type. It's okay to use "auto" in this field for most filesystems. See mount(8) for the supported filesystem types.


options Command options in a comma-delimited list. See mount(8) for a complete list

dump
If you're using the dump command for backups, this tells dump the backup interval, in days. 1 means every day, 2 means every other day, and so on.


pass This tells fsck which filesystem to check first at boot up, if it ever needs to. Make your root filesystem 1, any other Linux filesystems 2, and non-Linux filesystems 0.

Let's take a closer look at what goes in the options field. All these values belong to the defaults option:

rw Read/write.
suid Allow setuid and setgid bits to operate.
dev Interpret block and character devices.
exec Allow execution of binaries.

auto
This is used in boot scripts (Debian uses /etc/init.d/mountall.sh; Red Hat uses /etc/rc.d/rc.sysinit), indicating which filesystems are to be started at boot up.

nouser Non-root users cannot mount or unmount the filesystem.

async Asynchronous I/O, which is standard for Linux.


The defaults values are overridden by appending additional options, as on the win2k line in the /etc/fstab example above (defaults,user,ro,gid=win2k). The options are:

user
Non-root users can mount and unmount the device, provided they were the ones who mounted it

users
Any user can unmount the device.

noauto
The device must be explicitly mounted by a user and does not automatically mount at boot.

ro
The device is read-only. Be sure to use this for NTFS volumes.

noatime
Do not update the "time accessed" file attribute. This speeds up filesystem performance. It also extends the life of CD-RWs and DVD-RWs that use packet-writing, and of USB storage media, by reducing the number of writes.

gid=win2k
Assign group membership, if you are controlling access with groups.

Mounting filesystems, not devices

We tend to think of mounting devices and partitions, but strictly speaking, only filesystems are mounted. "Mount" and "attach" mean the same thing, if you want a different word to use. Some Linux distributions, such as Red Hat, use the /mnt directory. Debian uses top-level directories, such as /floppy or /cdrom. There's no hard-and-fast rule; put them wherever it suits you. Just be careful not to mount two filesystems in the same directory. If you do, the existing files will disappear until the intruder filesystem is unmounted.

Usually it's not necessary to specify the filesystem type, because mount will figure it out. First, it will probe the superblock. Currently adfs, bfs, cramfs, ext, ext2, ext3, hfs, hpfs, iso9660, jfs, minix, ntfs, qnx4, reiserfs, romfs, udf, ufs, vxfs, xfs, and xiafs are supported. If that fails, it will try each filesystem listed in /proc/filesystems, which shows all the filesystems supported by your kernel.

source Carla Schroder

Detecting Hardware with lspci

Problem

You're looking at new systems, or installing Linux on a box that used to run a different OS, and you're wondering if all the components—video, modem, Ethernet, sound will work on Linux. The vendors can't, or won't, tell you if their products will work on Linux. You need to know what the chipsets are, to find out if there are Linux drivers.
Alternatively, you want to know what components are installed inside a computer, and you don't feel like hauling the thing out, popping the case open, and tearing it apart.

Solution

Use lspci:
# /sbin/lscpi
# /sbin/lspci -v
# /sbin/lspci -vv

To show a summary of all devices connected to the PCI bus, use:
$ /sbin/lspci
00:00.0 Host bridge: VIA Technologies, Inc. VT8363/8365 [KT133/KM133] (rev 02)
00:01.0 PCI bridge: VIA Technologies, Inc. VT8363/8365 [KT133/KM133 AGP]
00:06.0 Ethernet controller: Linksys Network Everywhere Fast Ethernet 10/100 model NC100
(rev 11)
...

Use the -v or -vv flags to display more information:
# /sbin/lspci -v
0000:01:00.0 VGA compatible controller: 3Dfx Interactive, Inc. Voodoo 3 (rev 01) (prog-if
00 [VGA])
Subsystem: 3Dfx Interactive, Inc.: Unknown device 1252
Flags: 66MHz, fast devsel, IRQ 10
Memory at d4000000 (32-bit, non-prefetchable) [size=32M]
Memory at d8000000 (32-bit, prefetchable) [size=32M]
I/O ports at c000 [size=256]
Expansion ROM at [disabled] [size=64K]
Capabilities: [54] AGP version 1.0
Capabilities: [60] Power Management version 1

If you're looking for drivers, you can now take this output (e.g., VT8363/8365 or 3Dfx Interactive, Inc. Voodoo 3 (rev 01)) to run a Google search.
5.2.3 Discussion
lspci reads some information from the PCI bus, then displays additional information from its own database of hardware IDs—vendors, devices, classes and subclasses at /usr/share/misc/pci.ids. There is even a command to update this file:
# update-pciids

The lspci maintainers welcome submissions of new data; please read /usr/share/misc/pci.ids for how to make submissions.If there is a device attached to the system that the lspci simply does not recognize, such as a very old, odd ISA device, you'll have to open the case to see what it is. Or try running dmesg

source:- carla schroder