Sommaire pour No. 189 de Linux User & Developer

Welcome to the UK and North America’s favourite Linux and FOSS magazine. Somewhat appropriately, I experienced an earthquake while writing up this month’s inspiring open source piece on open source mesh networks being used for disaster relief (p34). Fortunately, it was only 4.3 on the Richter Scale. But this month there are plenty of other things to get excited about as we devote 14 pages to setting up a network suitable for advanced home or small-business use (p18). If security and privacy are more your concern, you’ll enjoy our guide to building Qubes OS from scratch, with its bare-metal hypervisor-based compartmentalisation measures (p60). Meanwhile, in tutorials we have a standalone primer on the wonders of statistical programming with R; server hardening with Nate Drake; and in Pi tutorials we have…

Top 10 (Average hits per day, 30 days to 11 Feb 2018) This month In development (5) Stable releases (5) The usual suspects occupy the top 10 list, although it’s worth noting that ArchLinux has dropped to 12th place; rival Manjaro remains at number 1. Highlights ArchLinux One of the most well-known alternatives to the Debian family, ArchLinux has its own package manager and is available for x86, x64 and ARM devices. Manjaro Linux Manjaro is a more powerful interpretation of Arch, with automatic hardware detection, multiple kernel support and desktop configurability. Archman GNU/Linux Although based on Arch, this version eschews pacman in favour of Octopi, with the intention of making software installation easier. It’s lightweight, too. Latest distros available: filesilo.co.uk…

Give developers the tools to find and fix coding errors as they write code, such as developer sandboxes The staggering growth of the application economy has put unprecedented pressure on development teams. Missed delivery deadlines can result in lost revenues, while poor functionality can impact customer loyalty and retention. To meet the demands of a faster time to market, many organisation are adopting DevOps. This burgeoning philosophy shifts left the responsibility for ensuring stability and security of an application throughout the entire lifecycle – including production and customer usage – to include developers. Evolution of ‘shift left’ The shift left into development has not only impacted the role and responsibility of developers, but has transformed the entire software life cycle. In the more traditional approach to software development, Waterfall, there…

Linus Torvalds announced Linux 4.16-rc2 in February, noting that things were fairly calm and that he took “the fairly quiet rc [as] a good sign for 4.16”. Indeed, he had previously noted that “things certainly look a lot better than with 4.15. We have no (known) nasty surprises pending, and there were no huge issues during the merge window”. That came, of course, in stark contrast to the tail-end of the 4.15 development cycle, which had coincided with the public disclosure of significant security vulnerabilities that impact many modern microprocessors. In the end, 4.15 had required nine RCs (Release Candidates), compared with the usual 7, and close to the record of 10. Since each RC happens on a weekly cycle, this threw off advanced planning made by a number of…

“Most routers have DNS forwarding and DHCP services built in, but you can get more control if you run your own” Once you have more than one device on a network, you need them to be able to talk to one another. That means you need to be able to give each host an IP address and let it know the IP addresses of the other hosts. This can be done manually by giving each device a static address and adding it to the hosts file of each of the other devices, but this soon gets out of hand – and what happens when a guest wants to connect their phone to your wireless network? The solutions are DHCP and DNS. A DHCP server will allocate an address to any…

Adding more computers to a network not only adds to the maintenance workload, you also need to keep an eye on them for problems. There are plenty of monitoring programs available which broadly fall into two categories: those that simply provide information on the current and historical behaviour of the systems, and those that watch for specific problems and either attempt to tackle them or send you an alert. Cacti (www.cacti.net) can produce beautiful graphs of the status of many computers. It’s a PHP app so installing it can be tricky. First, unpack it into your web server – we will assume Apache here – DocumentRoot and cd into the cacti directory. Create a suitable database and user: Make sure the web server user can write to directories: Add this…

Access point firmware Replace your access point or router’s firmware with an open source alternative 1 DD-WRT  www.dd-wrt.com DD-WRT is the most well-known of the choices. Its name comes from the fact that it was originally developed for the classic WRT54G access point, but now it covers hundreds of models, listed at the website. 2 Openwrt Openwrt is a fork of DD-WRT that is more flexible, but at the expense of more effort on your part – think Arch vs Ubuntu on routers. With Openwrt, for example, you can add extra packages to increase the capabilities of your router. 3 Installing the firmware Installing your own OS on your router is surprisingly simple, especially with DD-DRT. You simply upload a firmware file as if you were doing a factory-supplied update.…

Welcome to the InfoSec Arsenal, where you will learn how to arm yourself to the teeth! As a penetration tester, or a security enthusiast, you need tools to speed up your security engagements and tests. We are talking about software, of course, but a good pen-testing drop box wouldn’t hurt either (See Column: Add some hardware to your arsenal, p47). From simple yet precise web brute-forcing utilities such as wfuzz to complex and powerful reverse engineering frameworks such as radare2, there are plenty of tools to suit everyone’s taste and engagement needs. One good thing about pen-testing is that most of these tools ship out-of-the-box with well-known pen-testing GNU/Linux distros, such as Kali Linux or Parrot Security, so go ahead and pick one (or both). You will find that some…

Parallel programming can be one of the messiest techniques to implement. After all, the whole point is to try to run multiple processes concurrently and therefore speed up your computations. Once you start having more than one thing at a time happening, it can get confusing as to what process caused the result you’re seeing. Debugging reaches a whole new level of difficulty at this point. Also, in many data analysis tasks you may have very large sets of data that need to be coordinated across all of these parallel processes. You need to be aware of the possibility of corruption of results or repetition of calculations. This can happen if the multiple threads are not properly synchronized when they read or write the data involved. All of this can…

• What is Qubes OS? What is Qubes OS and how does it differ from other distributions? Discover why you might want to use Qubes. • The Qubes OS installation process The installation process for Qubes OS is more complex and involved than for typical distributions, but we’ll guide you through it. • It’s all about the domains/qubes/AppVMs Compartmentalisation is at the core of Qubes OS: your use is split into security-based contexts. • App install and updating Installing and updating applications within Qubes OS is based around updating the underlying TemplateVMs. • Windows on Qubes OS Some Linux users need to use Windows on occasion. HVM support means it can be used in Qubes OS too – but with some limitations. • Keep your install secure Some simple best…

Resources PiServer www.raspberrypi.org/blog/piserver The good people of the Raspberry Pi Foundation have outdone themselves once again with the release of PiServer, a tool which enables you to easily set up PXE (Pixie) network booting. In plain English, this means you can set up a network of Raspberry Pis, each of which are connected to a single server. The Pis can boot over the network without any need for microSD cards and you, as the server admin, can control user accounts and accessible files. The fact that every Pi, as a network ‘client’, uses the same accessible files makes PiServer perfect for classroom environments or workplaces where you may want to use Raspberry Pis for specific purposes such as teaching or operating machinery. You can create as many users as…

RAM 1GB Storage 10GB Specs 1.6 GHz processor, 64-bit only Available from www.netrunner.com Netrunner is a product of Blue Systems, a German IT company which is one of the most prominent supporters of the KDE project and which employs quite a few core project developers. Netrunner has multiple KDE-centric versions. There’s the headline Desktop release, based on Debian, and this rolling release based on Manjaro Linux – one of the most popular distributions built atop Arch Linux. Given its close ties to KDE, Netrunner ensures its distributions offers the best KDE experience. Netrunner Rolling doesn’t try to mask the fact that it’s based on Manjaro. For example, if you’ve used Manjaro you’ll notice Netrunner Rolling uses the same boot menu. The unique point of this boot menu is that…

There’s no dearth of graphical tools that can download content from video sharing websites. What sets youtubedl apart from the rest is that it’s a command-line utility, and despite its name it can fetch videos from dozens of video sharing services including Vimeo, Udemy, Khan Academy, Ted, PBS, BBC, Archive.org and a lot more. The utility is written in Python and you can install it with Python’s PIP package manager using sudo pip install youtube_dl. Despite being a CLI utility, using it is fairly straightforward: just specify the link to the video to download it. But don’t confuse simplicity of use with a paucity of features, because the program is very dexterous. You can, for example, use the -F switch to fetch a list of available resolutions for a video…

01 Optimise your website images When uploading your website to the internet, make sure all of your images are optimised for the web. Try using jpegmini.com software; or if using WordPress, install the EWWW Image Optimizer plugin. 02 Host your website in the UK Make sure your website is hosted in the UK, and not just for legal reasons. If your server is located overseas, you may be missing out on search engine rankings on google.co.uk – you can check where your site is based on www.check-host.net. 03 Do you make regular backups? How would it affect your business if you lost your website today? It’s vital to always make your own backups; even if your host offers you a backup solution, it’s important to take responsibility for your own…

WHAT IS IT? Every time you see this symbol in the magazine, there is free online content that's waiting to be unlocked on FileSilo. WHY REGISTER? • Secure and safe online access, from anywhere • Free access for every reader, print and digital • Download only the files you want, when you want • All your gifts, from all your issues, all in one place 1. UNLOCK YOUR CONTENT Go to www.filesilo.co.uk/linuxuser and follow the instructions on screen to create an account with our secure FileSilo system. When your issue arrives or you download your digital edition, log into your account and unlock individual issues by answering a simple question based on the pages of the magazine for instant access to the extras. Simple! 2. ENJOY THE RESOURCES You can…

PROJECT HIGHLIGHT AutoSploit There was no shortage of controversy this month. Misuse of a face-swap tool that applied deep learning to swap heads in videos saw it being used to place celebrities’ faces in adult films. The r/deepflakes subreddit that was promoting this was banned for ‘involuntary pornography’, but as you can see in the matrix, unofficial products are popping up on GitHub. AutoSploit, an automated mass-exploiter project on GitHub, was causing no less controversy in the security industry. This exploiter uses the Shodan.io API to find targets and automatically runs a series of Metasploit modules against the verified targets. This led some industry experts to rage against its creator, NullArray, for handing a destructive toy to script kiddies to use. However, as it has been pointed out, it’s not…

You can set up cron jobs on each computer to do the boring stuff Adding computers to your network also adds work in terms of maintaining them and keeping them up to date. You don’t want to be hopping from one keyboard to the next to do things, and your servers may not even have keyboards or monitors, so the first thing to do is set up SSH. Most distros have two SSH packages, the client and server. The client package is often installed by default so you just need to add the server to each machine you want to control remotely. On Ubuntu, the package is called opensshserver. After installing and starting the service, you should be able to connect from another computer with $ ssh user@hostname. The first…

Other monitoring apps There are many other products available to monitor a network of computers 1 Nagios  www.nagios.org This is the main heavyweight contender in this field. If you want to monitor it, there’s bound to be a Nagios plugin to do it for you. It’s probably overkill for a SoHo-type network but worth considering for larger installations. 2 Zabbix  www.zabbix.com Zabbix is another enterprise-level system, mostly aimed at anyone needing to watch over large numbers of computers and services, but it may also fit the needs of smaller networks in some cases. It works with Windows too. 3 OpenNMS  www.opennms.org/en OpenNMS is another product describing itself as “carrier-grade”. It uses an event-driven architecture where actions are taken when services stop or criteria are exceeded, but again is mostly likely…

“I still remember hearing about the Haiti earthquake,” says Dr Paul Gardner-Stephen. Uncharacteristically for Paul, who tends to ride a bike everywhere, he was driving a car to work that day. “I had the radio on so I was hearing about the earthquake as it was happening.” Paul’s day job is a senior lecturer for the College of Science and Engineering at Flinders University, Adelaide, Australia, but for the last eight years he’s also been running the Serval Project, a not-for-profit that has created an open source mesh mobile telephony system for disaster zones. We’re talking over a pixelated VoIP call, but his warm personality comes through the poorly rendered view of his office. He cracks humorous asides during our conversation, but as he recalls how he felt about Haiti…

1 Hak5 drop boxes Hak5 (https://hakshop.com) is a well-known and reputable company providing pen-testers with a wide variety of hardware devices for performing MITM attacks, packet sniffing, keystroke injection and data exfiltration. It has everything you need to drop a box and start engaging: from pocket-sized wireless devices to network implants disguised as USB-to-Ethernet adaptors. 2 iStorage Encrypted drives You need to securely store all your information somewhere. Apart from encrypting your laptop’s hard disk using LUKS, you can also rely on datAshur and diskAshur devices from iStorage. It sells a wide range of USB hard disks, desktop hard disks and USB flash drives with AES 256-bit hardware encryption. These have been designed to be tamper-evident and -resistant. See https://istorage-uk.com. 3 Build yourself a pen-testing drop box Why not build…

Since its inception in 1993, R has evolved to become one of the most widely used programming packages in the world, and is the most popular language specifically designed for statistics. It is one of the great success stories of open source development, eclipsing its non-free predecessor, S, and building on its large developer community to build a rich library with many important external packages. R is a matrix-based language like MATLAB or Octave, and is designed using a functional-style paradigm. The result is a highly flexible language optimised for statistical analysis. We can’t hope to cover everything that R has to offer in this article, but we’ll try to give an idea of the colour of the language and the different operations it supports. We’ll be covering a couple…

1 Use the KDE environment The command sudo qubes-dom0-update @kde-desktop-qubes switches to the KDE desktop. Change the default login manager to KDE’s sddm with sudo systemctl disable lightdm and sudo systemctl enable sddm. Reboot. 2 Use dark KDE in dom0 By default, KDE uses a light theme, but you can switch to a dark one. From the main menu, open System Tools > System Settings > Workspace Appearance. In Desktop Theme select Oxygen, then apply the theme. 3 Add items to application menu After you’ve added an application to your TemplateVM, you’ll want it to appear in your domain app menus. To make that happen, launch Qube Settings for that domain, select the Applications tab and move items to the right column. 4 Full-screen mode in Qubes OS Qubes deliberately…

Resources  pyLCI Source https://github.com/CRImier/pyLCI pyLCI documentation https://pylci.rtfd.io Tutorial files available: filesilo.co.uk pyLCI is a simple hardware interface you can use on your Pi to control and configure it without the usual requirement of having a HDMI monitor, Ethernet connection or a connecting a USB-UART dongle. Mainly, it enables you quickly configure the most important settings, such as connecting the Pi to a wired or wireless network and getting its IP address. This makes your Pi accessible – whether you are in the comfort of your home, somewhere outdoors, or maybe even working with your Pi on a long bus ride! All you need is a simple shield with a character display (16x2, for instance) and some buttons; there are many suitable shields which you can get, some of them as cheap…

If the web browser is slowing down your computer, try switching to QupZilla – a feature-rich, lightweight alternative that uses QtWebEngine. It has all the standard functions that you’d expect from a modern web browser, including bookmarks, history and tabs. Additionally, the browser has an RSS feed reader and includes a password manager. QupZilla also has several interesting features, such as the ability to change its user-agent to be more appealing to certain websites, and is capable of taking a screenshot of the entire web page. You can also tie common actions to mouse gestures for convenient execution, plus there’s a built-in ad blocker. QupZilla is very tweakable and has an extensive Preferences window, which is neatly organised. From here you can switch to six bundled themes and change the…

If you’re planning an event and want to stream music throughout without any intervention, you can delegate the task to BallroomDJ. This graphical app is designed for, well, ballroom events and dance studios that require uninterrupted music playback. The app includes a music manager to help organise your media library. It also includes features such as automatic playlist generation and flexible playlist control, while other relevant functions include the ability to define maximum playback time and customise a marquee display. You also have the option to trim the start and end of songs and adjust its playback speed and pitch without modifying the audio file. While the app will play music without any human intervention, it does give users the ability to interact with the play queue by adding, removing…

Writing and managing documents, spreadsheets and presentations on Linux can be tricky for anyone who has recently migrated from Windows. Microsoft Office won’t run without Wine; LibreOffice, for all its strengths, doesn’t look like Microsoft Office. One solution is to try a different office suite, and Softmaker Office – the 2018 version of which has just been released – could be the answer for many people. As well as adopting the DOCX, XLSX and PPTX file formats by default, Softmaker Office 2018 also introduces a Microsoft Office-style ribbon menu. First seen in Microsoft Office 2007, the ribbon is intended to ease access of rarely used tools. In Softmaker Office it has a secondary purpose, however: to ‘ease in’ newcomers to office tasks on Linux. Available in 32-bit and 64-bit versions,…

When Luke Kanies founded Puppet in 2005, the project, along with the likes of Chef, rapidly took IT automation mainstream. Puppet was Kanies’s way of exorcising the fears he had as a sysadmin that he and his colleagues would be stuck dealing with repetitive tasks with the potential to go wrong – while titans of the internet, such as Google and Amazon, had the ‘magic source’ to automatically configure vast numbers of systems. The rest of the industry was struggling, so Kanies licensed the first Puppet release under GPL (and later Apache 2.0). It used a model-based approach built around a simple declarative language that enabled sysadmins to create ‘manifests’ to declare how each system should be configured to do its job. Now in its thirteenth year, Puppet is spreading…

1 Draytek Vigor 2925 Dual-WAN Router Firewall A router like this DrayTek Vigor 2925 unit with dual WAN ports means you can connect to two providers for increased bandwidth and a failsafe connection. Price: £185 Website: http://bit.ly/vigor2925 2 FRITZ!Box 3490 If your provider allows you to use your own modem, something like this Fritz!Box is a good choice because it offers dual wireless networks, which is ideal for giving guest access. Price: £160 Website: http://bit.ly/FritzBox3490 3 Zyxel GS2210-24LP A basic network switch simply routes traffic to the right device. A much more expensive managed switch allows you to control traffic. Price: £160 ( for 8 port), £300 (for 24 port) Website: http://bit.ly/GS2210 4 Zyxel 802.11ac Dual-Radio Ceiling Mount PoE Access Point If you need to provide extra…

Almost all large software projects end up spanning a large number of directories. Projects use directories in order to organise a project into coherent self-contained pieces so that individual developers can work on particular parts of them. Indeed in some languages, such as Java, some sort of directory structure is actually enforced by the language. When it comes to creating a makefile in order to build a project, it can be hard to keep track of all the files that occur everywhere in a project, and developers use a number of techniques to organise their Make builds and make them reflect their projects’ directory structure. We’ll be examining a couple of commonly used techniques. A classic way of organising builds for multi-directory projects is to have a separate makefile inside…

If you own or operate your own Linux server, you can congratulate yourself on being in good company: Linux accounts for almost 97 per cent of public server operating systems. This is partly because Linux is free of charge but also due to the fact that popular server distros such as Debian and Ubuntu are open source and highly customisable. Unfortunately Linux’s relative popularity also means that servers are a popular target for attacks, such as Mirai, the staggering denial of service attack in 2016, which harnessed IoT (Internet of Things) devices to overwhelm DNS hosting provider Dyn. In this guide, you’ll discover some ways to ‘harden’ your server to protect against this and other types of attacks. If you haven’t set up your server yet, our distro of choice…

“Without Qubes OS, a bug in any part of a distribution can lead to the takeover of a system” Qubes OS is touted by its developers as ‘a reasonably secure’ operating system but in reality, the distribution offers huge benefits over standard distros from a security perspective – provided you’re willing to put in a little bit of effort. It’s advocated as ‘the best OS available today’ by none other than exiled whistle-blower Edward Snowden (a quote proudly displayed on the Qubes OS home page), and this level of praise is the norm rather than the exception among privacy experts. At the core of the Qubes OS model is the concept of compartmentalisation. The OS assumes that there is no such thing as a perfect, bug-free desktop environment; and because,…

I worked on this project part-time for 14 months Rick Perotti Rick is a demo architect at Oracle Corporation, currently working on IoT and Chatbot projects. Outside of work he loves using Raspberry Pis and Arduinos. Like it? You can see Rick’s mood board for the project on his Pinterest page (www.pinterest.co.uk/r570sv/switches-and-dials). For more of Rick’s tinkering follow him on Instagram (www.instagram.com/rick.perotti). Further reading Rick’s project adventures are recorded at www.instructables.com/member/r570sv and include a mechanical fortune teller that uses the open source Jasper for always-on, voice-controlled apps (https://jasperproject. github.io) and a Pi. As a kid, Rick Perotti was fascinated with switches and dials on control panels of all kinds – on dashboards, spaceships and aircraft cockpits. As an adult, that led him to build a nostalgically fuelled rocket ship control…

ExifTool is a flexible utility for working with photographic metadata. Photo management apps such as digiKam, Geeqie, and gThumb enable you to view and edit metadata for an image or two, but the command-line ExifTool lets you process dozens of images in a fraction of time. The program doesn’t need to be installed – you can simply download and extract the tool’s tarball and run it directly. When you point ExifTool to one or more image files it generates a long list of its metadata; besides JPG, a wide range of other image formats is supported, as well as raw files from DSLRs and video files. You can head to the project’s website to view the ever-expanding full list of supported formats. ExifTool can perform other useful actions besides merely…

  Featured host: www.netcetera.co.uk0800 808 5450 About us Formed in 1996, Netcetera is one of Europe’s leading web hosting service providers, with customers in over 75 countries worldwide. It is a leading IT infrastructure provider offering co-location, dedicated servers and managed infrastructure services to businesses worldwide. What we offer Managed Hosting A full range of solutions for a cost-effective, reliable, secure host Dedicated Servers Single server through to a full racks with FREE setup and a generous bandwidth allowance Cloud Hosting Linux, Windows, hybrid and private cloud solutions with support and scaleability features Datacentre co-location from quad-core up to smart servers, with quick setup and full customisation Supreme hosting  www.cwcs.co.uk0800 1 777 000 CWCS Managed Hosting is the UK’s leading hosting specialist. It offers a fully comprehensive range of hosting products,…