Sommaire pour No. 175 de Linux User & Developer

This issue » Build the perfect network » Find & exploit CMS vulnerabilities » Manage your Ubuntu disks » Control your Pi with the Amazon Echo Welcome to the latest issue of Linux User & Developer, the UK and America’s favourite Linux and open source magazine. What’s your perfect network? Maybe it’s small and high-speed, serving files and media around your house lightning-fast. Maybe you’re responsible for a corporate network and you want constant uptime, solid security and easily accessible shared drives. Whatever it is you’re after, we’ll show you the essential steps you need to take to build it in our complete guide on p18. Also in this issue we take a look at the top 10 system tools you need to make your life easier. Whether you’re a…

While towards the end of 2016 we saw Google release a number of smaller updates in quick succession, this hasn’t stopped it from releasing a major update in early 2017. This security update is particularly important, as it patches a whopping 90 vulnerabilities and exploits recently found within the operating system. Of the exploits being patched, 29 of them are listed as being critical, with 41 rated high and the remained ranked as a moderate security concern. At the core of the latest patch is a fix for the much discussed mediaserver component, which has proved to be an exploitable part of the OS’ backend. The flaw relates to the Stagefright media library exploit, which until now could have been remotely triggered. In its advisory, Google lists the exploit as:…

Top 10 This month Incremental updates to some of the biggest distributions have helped propel them up the download leaderboards, while others have fared less well at the start of 2017. Highlights Manjaro Manjaro’s rolling release schedule is proving to work wonders for driving new users to check it out. We recently praised its 16.10 release, claiming to be one of the best Arch-based distributions users should download. You really need to check it out! Solus Despite going under the radar last year, Solus is back with a bang in 2017. Its latest version showcases the speed of the distribution, while it doesn’t skimp on its features either. Fedora Arguably the biggest surprise this month is the slide of Fedora. Despite praise for its recent 25 update, competition from…

Resources OWASP Top 10 2013 bit.ly/1a3Ytvg CMS usage statistics bit.ly/2bJIbmI Wappalyzer wappalyzer.com CMSmap bit.ly/2jq2Zjc TurnKey Joomla bit.ly/2iejPnr TurnKey WordPress bit.ly/2jyHIbp WPScan wpscan.org Joomscan bit.ly/2j3jCEU Joomla VEL vel.joomla.org WordPress, Joomla! and Drupal are among the most popular content management systems (CMSs) around the world. Because CMSs are web applications, they share the complete spectrum of vulnerabilities affecting web apps: SQL-i, XSS, CSRF and so on (OWASP has a comprehensive list of these issues). Although there are plenty of automated tools that can help you identify some of these vulnerabilities, a particular breed of CMS vulnerability scanners and exploitation frameworks are more appropriate whenever engaging in a real penetration testing assessment. Bear in mind that these automated tools do no magic: they can only report what is already known. This is why…

Resources A beginner’s guide to disks and disk partitions in Linux bit.ly/2jDByqH Manage volumes and partitions bit.ly/2ijNFHd How to use fdisk to manage partitions on Linux bit.ly/2iFJKT7 General overview of the Linux file system bit.ly/2jvdulp The concept of how data storage works remains the same in most modern operating systems. When an operating system is installed, what normally happens is that the disk will be divided into one or more partitions. Then each of these partitions will be formatted with a file system. When we talk about Linux operating systems, it is important to understand that some of the partitions will be specifically formatted for elements such as a swap area or LVM physical volumes. As we all know, disks are used for permanent storage while random access memory (RAM)…

What you’ll need • Github repository: https://github.com/alexellis/motephat-alexa • Pimoroni mote-phat and accessories (pimoroni.com) • Soldering iron, flux and solder In 2016, Amazon brought the Echo (£150) and Echo Dot (£50) devices to the UK market, providing a voice assistant for your home. The Alexa service provides lots of built-in features such as radio and music streaming, creating and editing your shopping lists, weather updates and many other custom skills provided by third parties. Skill builders such as Uber and Capital One publish their skills for the general public, which means they go through a vetting process similar to that of the Apple App Store. For this tutorial, we will be creating an unpublished skill for our own Echo or Echo Dot to control the Pimoroni home lighting kit called Mote.…

Welcome to the Linux User & Developer DVD. This issue, discover the top 10 system tools for DevOps, sysadmins and developers. From speeding up tasks to managing data, optimising files to monitoring networks, everything here will streamline your workflow, enhance your Linux experience, secure your data or improve your systems. Troubleshoot, optimise and manage your system. It’s the ultimate toolkit for Linux pros. Featured software: Ubuntu Ubuntu is one of the world’s most consistently popular distros, offering one experience across multiple devices. It’s by far the most widely used Linux distribution amongst enthusiasts – and with good reason. It’s mature and stable, with LTS (Long Term Supported) versions and due to its high adoption rate it has a huge amount of peer-to-peer support across the web. Debian Debian is a…

1 BeagleBone Black Arguably one of the most well-known boards out there, the BeagleBone has proven time and time again to be a low-cost option for both developers and hobbyists alike. It includes all the basic functions and features needed for an entry level developer to get started, even boasting the ability to boot Linux in less than ten seconds. 2 Banana Pi M3 In terms of power, the Banana Pi M3 is hard to match. At its core is a monster octa-core processor working alongside 2GB of RAM. Take a closer look and you’ll find a LAN port, dual-USB ports and a full HDMI connection. 3 Intel Edison with Kit for Arduino While a little more expensive than some options here, this Intel-based board is a class act throughout.…

“Peeqo seems completely different to any robot before, where did the inspiration for him come from? I always wanted to build a robot. I’ve always been fascinated by them and was always keeping an eye on what was happening in the field. The debate that revolved around the creation of most social robots was how do you make them relatable and approachable, and how do you make them communicate the myriad expressions that we humans are capable of? Most robots focused on recreating human expression by essentially trying to recreate the human face, often diving headfirst into the uncanny valley. At the same time, I was fascinated by GIFs and their ability to communicate information and emotion and their resurgence as a form of communication in today’s messaging world. Something…

Backups are vital for disaster recovery. Such a disaster might be a fire or hardware failure – or a security breach. With your users all given their own accounts, spotting an intrusion should be simple. Sadly, it doesn’t always turn out this way. On a home network, a typical modem/router will double as a hardware firewall. While there is nothing wrong with this, all connected computers should also run their own firewall software, to make doubly sure that intrusions are not permitted. Home users will also want to look at the configuration on their routers. Are default settings being used? Is there a software vulnerability that allows access to the network from unauthorised users? Look into potential weaknesses and ensure that the router is as secure as possible. For a…

Resources Monit mmonit.com Computers are complex: a seemingly simple operation like opening a file may need thousands of operations taking place internally to succeed. Even if one instruction fails, your file won’t open. If there is a human working with the computer, such failure is not a big deal. Humans can recognise and correct the error that caused an operation to fail. However, if there are several computers working on complex tasks with minimal human interaction, it is critical to make sure you get to know about failures upfront. Monit is one such tool that helps you track and monitor processes, files, directories and file systems. It can look for changes – such as in timestamps, checksums or sizes – in a network and can notify you of errors and…

We talked earlier in this article about ensuring you have good file backups by using the Crashplan utility, but this little gem of a system tool – rsnapshot – is more suited to full machine backups in case you need to restore your whole system. rsnapshot is a filesystem snapshot utility based on rsync. rsnapshot makes it easy to make periodic snapshots of local machines, and remote machines over ssh, making extensive use of hard links whenever possible to greatly reduce the disk space required. Because rsnapshot only keeps a fixed (but configurable) number of snapshots, the amount of disk space used will not continuously grow. After snapshot files have been created, they can easily be uploaded to an alternate storage location such as Amazon S3, a remote SFTP server…

Tailored display Thanks to a transparent photovoltaic layer on Scripto, the display on the device is both readable in low light and in direct sunlight. The screen adapts to the light it absorbs, helping keep the pressure off your eyes Customisable word processor Scripto uses a heavily customised word processor at its core, which can be further tailored by users to match their needs. Perhaps one of its best aspects are its range of pre-made templates, which can be used to change up how users create their pages Biodegradable chassis Although many aspects of Scripto can be personalised to suit the user’s needs, the casing is of particular interest. The casing used here is completely biodegradable, with instructions included on how to safely dispose of the product when it’s no…

"We'll use two main packages, googlemaps and webbrowser" “In a previous article, we looked at how to connect a GPS to your Raspberry Pi and be able to find your current location on the planet from the GPS receiver. This issue, we will look at how you can use this kind of location information to build your own mapping application, such as a navigation system. We will be making a few assumptions about what hardware is connected to your Raspberry Pi. The first is that you have some kind of GPS receiver attached, in order to give you your current location. Second, we will assume that you have some kind of display screen attached, so that you can have a graphical user interface available to draw maps on to. Last,…

Price £91.99 Website  www.verbatim-europe.co.uk Specs 2TB Capacity USB 3.0 connection 3.5” desktop form factor External power supply Bundled software: Nero Backup Software, Green Button energy saving software It’s hard to ever imagine having an amount of storage that qualifies as “enough,” isn’t it? Thanks to our ever-expanding data needs, it’s easy to wonder how we survived an era when external storage was primarily measured in gigabytes, let alone megabytes. But shifting large amounts of data, such as recorded media files or full system backups, can be a time-consuming process – and that’s especially true if you’re still using drives on the USB 2.0 standard, first introduced way back in 2000. This latest storage offering from Verbatim uses the more recent USB 3.0 standard, allowing for data transfer rates that are…

Checking dates or timestamps is something you do often enough in a script that it’s surprising UNIX doesn’t have better utilities for comparing and performing operations on dates. But these tools are a quick download away, thanks to Sebastian Freundt’s Dateutils. Dateutils is a collection of tools for working with dates and times on the command line – everything from datediff, which calculates the difference between two dates and even has an option for leap seconds, to datesort, which rearranges lines (containing dates) in a file chronologically. Run autoreconf on the untarred source files, then the usual ./configure, make and make install, to generate the complete collection of ten utilities. Dependencies are minimal; we were missing only gperf from our recently reinstalled Debian test machine. Along with the software comes…

It’s always great news when a new kernel update hits, but even at Linux User HQ we were surprised to see the enormity of what the latest 4.9 offers up. “If you look at the number of lines changed, we’ve had bigger releases in the past, but they have tended to be due to specific issues (v4.2 got a lot of lines from the AMD GPU register definition files, for example, and we’ve had big re-organisations that caused a lot of lines in the past: v3.2 was big due to staging, v3.7 had the automated uapi header file disintegration, etc,” explains Torvalds on the Linux Kernel Mailing List. One of the biggest additions in Linux 4.9 is the direct support for the Raspberry Pi Zero, alongside another 28 ARM-powered devices.…

“Linus Torvalds announced the release of the 4.10-rc4 kernel, having closed the merge window for new development at the tail end of last year. In the weeks since 4.10-rc1, relatively few major issues have been discovered, and this release cycle is already shaping up to be slightly smaller than the (near record-breaking) previous one. In his latest mail, Linus noted that this is “the point where I start hoping the rcs start shrinking”. If everything continues on track, the final 4.10 release will happen in time for the next issue, and we will have a full write-up to accompany it. Among the new features coming in Linux 4.10 is a rewrite to how the kernel handles background writeback, support for Intel’s Cache Allocation Technology (CAT), and a number of improvements…

Even though the deployment of more devices adds redundancy to a system, a router failure can eliminate the entire network. This makes it an ideal host for various services: if the router fails, no one cares about the rest. Even though some time has passed since our last look at OpenWRT, the router platform nevertheless remains highly interesting. This tutorial will show you how to use the package manager found in the OpenWRT distribution to add to the various applications to your router just as if it were a normal computer or a workstation. This allows you to use the router to provide a variety of network services that, otherwise, require the presence of a dedicated PC. Reducing the total power dissipation in an office is sensible for multiple reasons.…

Resources An installation of Erlang A text editor such as Emacs or vi This is the third tutorial in our series about the Erlang programming language. This tutorial will deal with many Erlang subjects, including message passing between Erlang processes, along with printing and formatting output and records. We will also revisit subjects such as lists, maps, getting user input and OTP. Until the next issue, try to write as much Erlang code as possible to understand the various Erlang concepts and keep your morale high, because forthcoming tutorials will discuss more difficult topics such as OTP, Mnesia, debugging, file I/O, network programming and web development. Erlang strings Strictly speaking Erlang does not have strings, because a string in Erlang is just a list of characters. However, it would not…

1 Ubuntu Desktop / Server Of course, any list of essential distros isn’t complete without mentioning Ubuntu, by far the most widely used Linux distribution amongst enthusiasts – and with good reason. It’s mature and stable, with LTS (Long Term Supported) versions and due to its high adoption rate it has a huge amount of peer-to-peer support across the web. https://www.ubuntu.com/download/desktop 2 Debian While Ubuntu has a very capable server distribution, Debian – on which Ubuntu is built, of course – is more commonly used for non-desktop purposes. Debian is one of the oldest and therefore best-supported versions of Linux available. Random fact: Debian distributions are named after Toy Story characters. Really! The latest release is Jessie. https://www.debian.org/ 3 OpenSUSE Linux users tend to fall into two camps, those who…

What you’ll need • Suitable for all models of Raspberry Pi If you’re worried about the somewhat Orwellian notion of forced disclosure of passwords, this project posits a rather radical solution to the dilemma by creating a second password for your user account, which, instead of logging you in, will nuke your home folder using special tools. While this is simple to set up, do make sure to back up your personal data to a safe place before going ahead. Also bear in mind that anyone with physical access to your machine may seize it before you have a chance to flip this kill switch. 01 Create your new user account Although you most likely will already have a user account on the Pi, create a new one for this…

In the main article we have focused on using the Google mapping services, but they aren't the only ones available. The Python module geopy can handle the geocoding functions that the googlemaps module does. The difference is that geopy can use services from several different sources, including Google, Bing or OpenMapQuest, among others. They are available as geocoder classes within the package. For example, you could get the location from the Nominatum service with the following code: The returned location object is a dictionary including the full address, the latitude and longitude, among other values. Once you have geographical data that you want to render and display for the end user, you can use the module geoplotlib to do so. Geoplotlib uses mapping tiles from OpenStreetMaps providers in order to…

One of the biggest advances to come from the world of Linux in recent months is the emergence of more Ubuntu-based distributions. Offering flexibility in how they’re used, these distributions also tend to boast a fairly smooth easy installation system and an even easier interface to master. Zorin has long been in the background of existing Ubuntu distributions, but has gained more recognition of late due to positive feedback on previous updates. In its twelfth update, an array of new features has been introduced, as well as some improvements to core functions. One primary feature that hasn’t changed is the installation, which maintains its simplicity and is done in the same vein as a standard Ubuntu installation. One of the positive aspects of Zorin’s installation is that dual booting actually…

We’ve reviewed a few pieces of software recently with venerable heritage, such as Vim. Maxima just about beats them all, dating back to the 1960s and MIT’s Macsyma, which inspired Maple and Mathematica. The final 1982 version was released under GNU GPL in 1998, becoming Maxima. RPMs and an Android version are supplied, but we compiled from source – all 37MB of Lisp code. We already had all of the dependencies installed on our test machine; you’ll need a Common Lisp implementation for starters. The usual configure and make will take some time, as Maxima is a big package. Running the full gamut of ‘differentiation, integration, Taylor series, Laplace transforms, ordinary differential equations, systems of linear equations, polynomials, sets, lists, vectors, matrices and tensors’, documentation is unsurprisingly excellent, given its…

 Featured host: www.cyberhostpro.com 0845 527 9345 “Having your own dedicated server will give you maximum performance; our UK servers typically include same-day activation” About us Cyber Host Pro are committed to provide the best cloud server hosting in the UK; we are obsessed with automation and have been since our doors opened 15 years ago! We’ve grown year on year and love our solid growing customer base who trust us to keep their business’s cloud online! If you’re looking for a hosting provider who will provide you with the quality you need to help your business grow then contact us to see how we can help you and your business! We’ve got a vast range of hosting solutions including reseller hosting and server products for all business sizes. What…