Table of contents for No. 191 in Linux User & Developer

Welcome to the UK and North America’s favourite Linux and open source magazine. It’s been another fascinating month in the open source world. Of course, Ubuntu 18.04 LTS has landed, but we’ve also seen strong open source advocate Nextcloud snag a seven-figure deal to supply the German federal government with a private Bundescloud for 300,000 civil servants. Then Microsoft floored a lot of people by revealing an entirely Linux-based OS for a microcontroller it is touting for IoT devices. The Linux Foundation’s Jim Zemlin describes Microsoft’s Linux usage as the “new normal” – and we shouldn’t be surprised, plenty of companies now use Linux and FOSS when it makes money and practical sense. To that end we turn to our main feature this month, where we’ll show you how to…

Top 10 (Average hits per day, 30 days to 6 April 2018) This month •• In development (4) •• Stable releases (22) BSD operating systems have recently seen a renaissance, with FreeBSD-based TrueOS hovering in the top 10 and other options in the top 100 Highlights TrueOS TrueOS prides itself on being easy to install, with a graphical installation system and a good number of pre-configured desktop environments. OpenBSD Security-focused, OpenBSD 6.3 features ISO support in the virtual machine daemon, updates to LibreSSL and OpenSSH, and SMP for ARM64 systems. NetBSD This popular implementation of the Berkeley Software Distribution is a lightweight OS designed to work on a wide range of hardware platforms. Latest distros available: filesilo.co.uk…

“One of the things we’re most grateful for is having such an active Pop!_OS community providing feedback” Before Pop!_OS, our attention was focused on ensuring our computer hardware ran flawlessly with Linux. When the end of Unity was announced last year, it created a lot of unknowns among the team; but what started as an unknown quickly became an opportunity. For over 12 years, we had been outsourcing one of System76’s most important customer interactions, the desktop experience – and during this tenure, we collected tons of data: a list of customer requests for an improved desktop interface. Linux excels in the fields of computer science, engineering and DevOps – this is where our customers live. It’s important for us to make sure we create the most productive computer environment…

Linus Torvalds has announced Linux 4.16, noting that things had calmed down sufficiently at the last minute to avoid the need for an RC8 (Release Candidate 8). Those things that had remained in flux toward the end were mostly networking-related, and the networking maintainer had explicitly said he was okay with it. The 4.16 kernel includes a number of new features, among them AMD’s Secure Encrypted Virtualization (SEV), and many additional mitigations for Meltdown and Spectre security vulnerabilities across various architectures. On the latter point, 4.16 pulled in upstream mitigations for Spectre variant 1 (bounds-check bypass) exploits. These rely upon vulnerable code sequences within the kernel that attempt to test whether an untrusted value provided by the user (that is, the application) is within a permitted range. Processing of that…

The central premise of Docker is that you should be able to package any application once in a ‘container’ and then run it anywhere without needing to install any extra dependencies. The project itself was originally released in 2013 as an add-on for the Linux kernel by Solomon Hykes, who became renowned for keeping tight control over the way the product was developed and evolved by the wider community. The way Docker differs from a standard virtualisation system, such as Oracle VirtualBox or VMware Workstation, is that it uses the resource-isolation features of the host Linux kernel rather than just the virtualisation features of the CPU. As a result, Docker uses far less memory and processing power, and the individual application containers it generates are much smaller and easier to…

1 BDD with Cucumber With the help of vagrant-cucumber, you can run all your behavioural tests locally against your Vagrant VM. To launch them, copy your pre-existing .feature files and step definitions to the Vagrantfile folder and run vagrant cucumber from there. 2 Shell commands vagrant-exec runs shell commands inside your VM, and you can do this by navigating to the Vagrantfile directory and prefixing each one with vagrant exec. It’s easy to remember and means you don’t need to create a new SSH session each time. 3 Fabric provisioning vagrant-fabric takes things a step further by enabling you to execute scripted actions and deployments with the help of a Python 2.7 extension called Fabric. Use it as a provisioner in your project’s Vagrantfile.…

1 Edit hiera.yaml This file lists the ‘facts’ you want to track. With a config folder of /etc/puppetlabs,define searchable folders in puppet/, common variables in code/environments/production/ and package settings in code/environments/production/modules/<modulename>. 2 Write a custom module Create a new module called ‘profile’ and write a test class for it, ensuring it uses parameters with memorable names and sensible data types. Writing a test manifest is optional, but it can be helpful when troubleshooting your module and key values later. 3 Set common values Head to the data/ directory in the production environment folder and set your variables in common.yaml. The keys you define should follow the pattern profile::test_ class::parameter and their values should to match the data types you set in your module. 4 Verify your facts After successfully compiling…

“How is software born?” It’s an unusual first question from the genial Japanese creator of the Ruby programming language, Yukihiro ‘Matz’ Matsumoto. He’s making his first keynote speech in the UK in five years to over 500 Ruby developers at the annual two-day Bath Ruby Conference. Ruby celebrated its 25th year in February although officially its first release, 0.95, was in December 1995, so in answer to his own philosophical question, Matz suggests that software is born when it is named. It’s the kind of poetic answer you expect from the creator of such an expressive language and means Ruby was ‘born’, at least for Matz, two years earlier on 24 February 1993 – hence the big celebration in Tokyo earlier this year and across social media. Talking of the…

What is it about programming languages that fascinate you? The programming language is the way to express what you want a computer to do in a way that both we humans and computers can understand. It’s kind of a compromise. But at the same time it is the programming language that is the way to express your thoughts in a clear manner so that it is also a tool to express your ideas. Think about that – you can write down your software on a sheet of paper, so it doesn’t execute on the computer simply because it can’t see the paper, but it is still a program and it will still help you understand what you want to do. Programming languages have different ways to express ideas, how to…

Resources Post exploitation repository http://bit.ly/lud_postexp Metasploit local exploit suggester http://bit.ly/lud_suggest LinEnum http://bit.ly/lud_linenum Linux exploit suggester http://bit.ly/lud_suggest2 Exploit database http://bit.ly/lud_exploit Vulners scanner http://bit.ly/lud_vulners Lynis https://cisofy.com So far our tutorials in this series have been dealing with different techniques to find and exploit well-known vulnerabilities in order to get a foothold into a system. Most of the time, however, that initial foothold won’t get you a root shell. That’s because some of these services may run using a non-privileged user account (for example, Apache’s ‘www-data’ user). As a pen-tester, your next step is obvious: to escalate privileges, or priv esc. To some, priv esc is kind of an art, and we agree. Whatever your thoughts about it, priv esc can be achieved by abusing misconfigured services,…

Rust, in a nutshell, is a safe C. Developed in the last 10-12 years under the sponsorship of Mozilla, it quickly took on a number of safety features that are directly useful within software engineering projects. At its heart, it’s a systems programming language just as C is, but it combines low-level access to the machine with elegant features, such as strong typing and ownership, that help Rust programmers avoid bugs and memory leaks much more effectively than they could in C – or in similar languages such as C++. Today, Rust is hugely popular, owing to its elegance and robustness. In fact, it was named the most-loved language in the Stack Overflow developer survey in 2016, 2017 and 2018. Getting started We’ll assume that you know a bit about…

Ubuntu 18.04 is the first release to offer only a 64-bit full install ISO for download. If you do need to run on 32-bit hardware (or other alternative architectures such as ARM), you have a couple of options. First, you can simply install the previous LTS release (16.04.3) and upgrade to the latest version. Alternatively, you can use the netboot image. This tiny image – available in ISO and USB stick versions together with the files needed to carry out a PXE network boot – includes just enough of the distribution to be able to boot from a network to download the rest of the required files. When launched, the installer prompts for basic network configuration including an optional HTTP proxy, language and keyboard preferences, mirror selection and user details,…

Like it? Fred has done construction projects in the Antarctic and has worked on space weather on remote islands. He gets excited about biological sciences and large datasets. Follow his adventures on Twittter at@FredFourie. Further reading Fred is interested in areas where the natural world and electronics meet. He’s also been tinkering with machine learning and object detection and suggests there might be some crossover in the future with using object detection. Follow his projects at https://hackaday.io/FredWFourie. Sometime in 2014, Fred Fourie saw a longterm time-lapse video of corals fighting with each other for space. That piqued his interest in the study of bio-fouling, which is the accumulation of plants, algae and micro-organisms such as barnacles. Underwater documentaries such as Chasing Coral and Blue Planet II further drove his curiosity,…

Most file managers have a find function to help you search for files. But these lack powerful filtering mechanisms such as regular expressions that are usually only available on the command line. Searchmonkey JAVA is a graphical tool that bridges the gap between the basic functions of file managers and powerful CLI tools by bringing a feature-rich regular-expression builder to the desktop. You can use Searchmonkey to easily construct a complex search query with little effort. It can help you search for files by their size, type, creation, modification and last-accessed date. You can also search for files recursively, and the app enables you to control how many subfolders it should look into. The Option tab houses other advanced search options such as the option to skip binary files and…

Gambas, which is a recursive acronym for Gambas Almost Means Basic, is an object-orientated dialect of the Basic programming language. Gambas’ purpose is to mimic Visual Basic’s ease of use of while introducing improved functionality. If you’re familiar with VB, you can get started with Gambas without much trouble, although the two aren’t source-code compatible. Gambas makes it very easy to build graphical apps on Linux using the Qt4 or the GTK+ toolkits, and also includes a GUI designer to help ease the process. In fact, Gambas includes an IDE written in Gambas itself. Gambas is a true object-orientated language with objects and classes, methods, constants, polymorphism, constructors and destructors, and more. You can use it to write network apps and for SDL, XML and OpenGL programming. Gambas can also…

“Netcetera is one of Europe’s leading Web Hosting service providers, with customers in over 75 countries worldwide” Featured host: www.netcetera.co.uk03330 439780 About us Formed in 1996, Netcetera is one of Europe’s leading web hosting service providers, with customers in over 75 countries worldwide. It is a leading IT infrastructure provider offering co-location, dedicated servers and managed infrastructure services to businesses worldwide. What we offer Managed Hosting A full range of solutions for a cost-effective, reliable, secure host Dedicated Servers Single server through to a full racks with FREE setup and a generous bandwidth allowance Cloud Hosting Linux, Windows, hybrid and private cloud solutions with support and scaleability features Datacentre co-location from quad-core up to smart servers, with quick setup and full customisation Supreme hosting www.cwcs.co.uk0800 1 777 000 CWCS…

Uncle Bill is the first to arrive. With the endless energy of a sixteen-year-old, he bursts into the room. “Party!” he screams. I wish he wouldn’t. It’s hard enough to celebrate your fifty-third birthday, every single year, without having the added weight of trying to ignore the enthusiasm of your younger older uncle – I still haven’t worked out what to call my ancestors who chose to stop ageing at a younger age than I did. He’s never going to grow up, and any experience he gains won’t turn into wisdom because of the strange effects of renewing brain cells. But knowing he’s never going to change doesn’t make him any easier to be around. Next is Joanna, my ninety-five-year-old granddaughter. “Grandpa,” she says, giving me a beautifully-wrapped present. “Happy…

The headline-grabbing Cambridge Analytica scandal has hit users of all platforms, highlighting once again the importance of openness when it comes to the treatment of personal data by online services such as social networks. Keeping in mind that just 270,000 people used the ‘thisisyourdigitallife’ app, it is staggering that data for 50 million people (including friends and family of the app users) was then farmed, and used for political-campaign targeting in a process that began in 2014. Mark Zuckerberg, as ever doing his best to distance Facebook from scandal, took the time to issue a full-page apology in several newspapers. In it, the billionaire CEO apologises for the 2014 breach of trust “that leaked Facebook data of millions of people” and reveals that along with limiting data to third-parties, Facebook…

1 Install Docker Find instructions on how to configure your package manager and install both the Docker daemon and client app at http://bit.ly/lud_install. If this doesn’t work you could also try installing the binaries from http://bit.ly/lud_binaries. 2 Set up Docker Compose This is a helpful tool for creating applications that span multiple containers, such as a website that’s split into a webserver, database and content hosting components. See http://bit.ly/lud_compose for installation details. 3 Create a container Pull down a new container, verify it’s installed and run it with: 4 Check container status You can view all the currently installed container types using docker images. To get more useful information such as which containers are running and what they’re up to, you should try: $ docker ps -a. 5 Access your…

Vagrant’s native support for Oracle VirtualBox is not your only option for using it. Thanks to community plug-in support and code contributions, it’s also possible to use other providers. This is particularly useful in enterprise settings where you might already be running something more scalable like OpenStack or VMware vSphere. As an example, you can use Docker as a provider for your Vagrant configurations on Linux hosts just as easily as you would VirtualBox. The only difference is the exact set of commands you would use to do that in your Vagrantfile: This tells Vagrant to use Docker as a provider, and then instructs that provider to build a container from the Dockerfile you’ve provided. To directly download a container image and run it, replace d.build_dir with: In both cases…

Cookpad (https://cookpad.com/uk), the main sponsor of the Bath Ruby conference, is a classic example of a web company that relies heavily on Ruby and Ruby on Rails. It’s a recipe-sharing site, and while CTO Miles Woodroffe says the site has over 60 million users a month in Japan, it’s also expanding globally, having moved its international HQ to Bristol. “We’re really invested in Ruby as a platform,” Woodroffe told us. “A lot of our infrastructure is powered by Ruby scripting – Ruby for everything pretty much.” As well as having 100 Ruby engineers dotted around the world, Cookpad employs two core Ruby team members full-time. One of them is Koichi ‘ko1’ Sasada, creator of YARV – the official interpreter for Ruby since 1.9. Sasada is now working on concurrency (Project…

Resources Git If not already installed, install through your package manager or from https://gitscm.com Wget Install through your package manager or from www.gnu.org/software/wget It can be difficult to manage a large software project with lots of different contributors. You need to be able to keep track of all the changes as they come in so that you can revert them, build on them or deal with conflicts between them as necessary. The tools that we use for this are called version-control systems; there are many different systems available, but our favourite is Git. Git was developed by Linus Torvalds, the creator of the Linux kernel, because none of the other version-control systems at the time were suitable for the large software project he was working on – that is, Linux…

1 Create your account Visit https://app.any.run/#register and create a new account, with any email address you like. Using the free plan only gives you access to a Windows 7 32-bit sandbox. 2 Upload your malicious binary to the sandbox Grab your malicious program and send it to the sandbox. You can use the New Task icon on the left (+) to upload a local file, or you can paste an URL holding the binary. Only files up to 16MB are allowed. 3 Let it run Wait for a while until the sandbox is ready. The system will start gathering some useful information about the program: network connections, registry changes, malicious behaviour, and so on. You are free to interact with the system at any time. 4 Have a look at…

KUBUNTU Kubuntu brings KDE Plasma to Ubuntu, providing an alternative high-end desktop environment If you’re switching to Ubuntu 18.04 from the last LTS release, you’re going to change your desktop environment anyway, so what about trying KDE? The Qt-based desktop is fast, beautiful and quite a different option! LUBUNTU Lubuntu is a more lightweight version of Ubuntu, running the LXDE desktop environment If you’re running Ubuntu on lower-spec hardware – perhaps even a Raspberry Pi – the light but fully featured Lubuntu may be worth a look. Unlike the main flavour, 32-bit images are still available. XUBUNTU Xubuntu provides another lightweight alternative, using the Xfce desktop environment Like Lubuntu, Xubuntu focuses on running well on modest hardware, but has all the applications pre-installed to get you up and running right…

On 14 March 2018 – often referred to as Pi Day, because the date written in US format is 3.14 – the Raspberry Pi Model 3 B+ was released. Among the upgrades were a new 1.4GHz, 64-bit, quad-core ARM processor, dual-band 802.11ac wireless and LAN, and Bluetooth 4.2. Faster Ethernet was added in the form of gigabit Ethernet over USB 2.0, and there’s also improved thermal management. Additional improvements have also been made to booting from a USB mass-storage device, such as a flash drive or hard drive. This tutorial explains how to take such a device and boot up your Raspberry Pi 3 B+ using it. Once everything’s configured, there’s no longer any need to use an SD card – it can be removed and used in another Raspberry…

As Linux distributions develop and improve, it isn’t unusual for third-party tools and software to adapt. The Intel Graphics Update Tool is a good example. Released in 2013 to give Linux users a safe and reliable way to install and upgrade to stable drivers and firmware on Intel graphics hardware, five years down the line the software has become largely redundant. The Intel graphics blog announced on 8 March that “users will notice Fedora 27 and Ubuntu 17.10 and beyond are very current. Therefore, we are discontinuing the Update Tool as of version 2.0.6. The final version 2.0.6 of the update tool was targeted specifically at both Ubuntu 17.04 and Fedora 26. Earlier revisions for those Linux distributions are no longer being supported.” Previously known as the Intel Graphics Installer…

• Docker deployments p20 Discover everything that you need to get started with creating, running and managing Docker containers on web developer workstations through to enterprise servers. • Script with Vagrant p22 Fully automate the creation of virtual servers and environments across different devices, machines and OSes with the help of a scripting language. • More Vagrant providers p24 Extending our automation of virtual server creation on enterprise platforms such as Hyper-V and VMware vSphere, as well as cloud platforms like AWS and Azure. • Puppet provisioning p26 Centrally manage web applications and keep server configurations synchronised across your devices and networks with this established and well-supported tool. • Configure Ansible p28 Set up a worthy alternative to Puppet and Chef, then use it to manage applications and configuration files…

Puppet’s main function is to manage configuration for Linux and Windows boxes across the network by slaving their settings to a common ‘master’ configuration called a ‘catalogue’. The key benefit of this is that you can set common configurations for your servers in one place rather than having to do it manually on each server. “This should (in theory) mean fewer hard-to-troubleshoot typos and confusing log messages” This should, in theory, mean fewer hard-to-troubleshoot typos and confusing log messages being caused by bad configuration values. However, Puppet takes this a step further by enabling you to define settings for smaller clusters of servers or even individual boxes from that same master server. As long as the slave is running the supplied agent software, and it has synced with the master…

The most straightforward way to get Ansible up and running is by installing it through through the pip package manager distributed with Python. However, you can also install it through your distro’s package manager. Unfortunately the latest version won’t be in the main channels by default, so there’s a little extra legwork to do. RHEL 7 users need to enable the Extras repository before Ansible can be installed through yum, while older versions will need you to enable EPEL. Meanwhile, Ubuntu users can install the latest package from the project’s PPA; just run the following command to add that:…

Contributing to a programming language isn’t something you can just drop into; it involves quite a steep learning curve. Ruby’s answer is to run Hack Challenges. These are an opportunity for aspiring Ruby committers to test their mettle and learn how to extend Ruby features, fix bugs and improve the overall performance of the language. Up until very recently such challenges only ever took place in Japan, but in an effort to draw in new contributors from the global community, in March Matz – along with core Ruby committers, Koichi ‘ko1’ Sasada and Yusuke ‘Mame’ Endoh – headed to Cookpad’s new international UK HQ in Bristol to run a challenge. Leading developers were invited from across the world – Paris, Cape Town, Sao Paulo and San Francisco – and tasked…

Resources Arduino Mega RFID Kit (MF522-AN) Soldering iron Raspberry Pi (or other computer) Python Arduinos aren’t just for fun and games – sometimes there’s a need for them in your professional life too. They could be used for taking measurements in a lab, as props in presentations, or – more importantly – for dispensing coffee in the office kitchen. If you happen to work for a company that doesn’t provide staff with coffee, you’re likely to have come across a ‘coffee club’ or an honesty jar where people pay the asked amount for a scoop or pod of coffee. While this is a good system and, generally speaking, works well, there are obvious benefits which automation can bring: no longer any need to carry small change, the ability to monitor…

Neural networks have been around, as an idea, since the very beginning of artificial intelligence research. The problem has always been that it’s very difficult to implement them in an efficient way. This has kept these techniques out of the hands of the average software developer – at least until Google developed a library for its Google Brain internal project. This was released in 2015 as an open source library called TensorFlow. In just a few short years, it’s found its way into a huge number of fields and projects, including convolutional neural networks, audio recognition and image recognition, among others. Because of its popularity, TensorFlow has been ported to many different platforms – including, most recently, mobile operating systems such as Android and iOS. In this article, we’ll look…

• Desktop Ubuntu 18.04 ditches the Unity desktop and brings GNOME on X.Org to LTS for the first time in a long time. • Server The Server release of Bionic Beaver sports a much-improved installer and a new, smaller ISO file for a minimal install option. • Cloud The latest Ubuntu release offers tighter integration with Canonical’s cloud offerings and a simplified deployment process. • Containers As well as a new release of LXD, Ubuntu continues to offer support for Kubernetes and Docker on public, private, hybrid or bare-metal clouds. • Core/IoT/Robotics Ubuntu is experiencing huge growth in the areas of IoT players and robotics, making use of Canonical’s investment in the snap ecosystem.…

1 Install conjure-up Conjure-up itself is installed from a snap package using the command sudo snap install conjure-up –classic. After installation, use conjure-up to launch the tool. If you’re using a pre-snap release, install snapd first with sudo apt install snapd. 2 Select a Kubernetes spell and choose a cloud After launching conjure-up and selecting the ‘The Canonical Distribution of Kubernetes’ as your spell, you’ll be prompted to choose a cloud provider. Choose ‘new self-hosted controller’ and accept the listed default apps to begin the deployment. 3 Connect to and manage your Kubernetes container After the deployment completes, kubectl (for management) and kubefed (for federation) tools will be installed on your local machine. Use kubectl cluster-info to show the cluster status and confirm all is good.…

1 Create a key to sign uploads Before starting to build the image, you need to create a key to sign future store uploads. Generate a key that will be linked to your Ubuntu Store account with snapcraft create-key. Confirm the key with snapcraft list-keys. 2 Register with Ubuntu Store Next, you have to register your key with the Ubuntu Store, linking it to your account. You will be asked to login with your store account credentials – use the command snapcraft register-key to start the process. 3 Create a model assertion To build an image, you need to create a model assertion. This is a JSON file which contains a description of your device with fields such as model, architecture, kernel and so on. Base this on an existing…

Voice assistants are all the rage at the moment, what with Microsoft’s Cortana, Apple’s Siri, Google’s Home and Amazon’s Alexa all entering the market. Users are becoming more comfortable talking to a device and receiving audible instructions, in a way that’s not too dissimilar from the computer in the Star Trek franchise. However, with current concerns regarding privacy, it’s important to know what data is collected, where it’s going, and who could potentially be eavesdropping on your conversations. We don’t mean to sound paranoid, but if you’ve got an open mic in your environment it’s pretty important to know where any data might be heading; some of the larger corporations collect information about users to better target advertisements towards them. That’s why users are turning to open source alternatives. Last…

Specs CPU i686 Intel or AMD processor Graphics Video adaptor and monitor with 1,024x768 or higher resolution RAM 512MB Storage 5GB License GPL and various Available from https://mxlinux.org  The MX Linux project is a joint effort between the antiX and MEPIS communities, and the distribution they produce uses some modified components from both projects. MX Linux is also popular for its stance of sticking with sysvinit instead of switching over to systemd. The distribution uses a customised Xfce for a dapper-looking desktop that performs adequately even on older hardware. MX Linux ships as a Live environment and uses a custom installer verbose enough to explain what’s going on with the various steps. The installer also uses reasonable defaults that’ll help first-timers sail through the installation. The partitioning screen…

Keyboard warriors who love the command line can now even beat their media library into shape with beets. In addition to managing music libraries, beets can fix the filenames and metadata of your music collection, fetch cover art and lyrics, transcode audio to different formats, and do a lot more. While Beets is available in the repositories of popular distributions, you should install the latest version using Python’s pip package manager using pip install beets. You’ll need to spend some time creating a configuration file for the utility. Once created, beets will import your music files and sort them as per the instructions in the configuration file. During import, the utility also fixes and fills in any gaps in the metadata by referencing the online MusicBrainz database. Once the files…

01 Optimise your website images When uploading your website to the internet, make sure all of your images are optimised for the web. Try using jpegmini.com software; or if using WordPress, install the EWWW Image Optimizer plugin. 02 Host your website in the UK Make sure your website is hosted in the UK, and not just for legal reasons. If your server is located overseas, you may be missing out on search engine rankings on google.co.uk – you can check where your site is based on www.check-host.net. 03 Do you make regular backups? How would it affect your business if you lost your website today? It’s vital to always make your own backups; even if your host offers you a backup solution, it’s important to take responsibility for your own…