Sommaire pour No. 188 de Linux User & Developer

Welcome to the UK and North America’s favourite Linux and FOSS magazine. Through the storm of Spectre and Meltdown, we need to tip our hats to those unsung heroes who are rapidly creating new kernel features to help protect users against these vulnerabilities. It’s a Herculean task and they should celebrated, not berated. We need to include in there Kernel Column writer Jon Masters, who, as well as working doggedly on the ARM side of the issues, has written an extended column this month on the battle to mitigate both vulnerabilities. What a guy! For the rest of the magazine, we hope to make your life less stressful, with a guide to becoming a virtualisation power user (p18); a write-up on the inspirational work of the Arribada Initiative in animal…

Performance, cost efficiency, scalability and speed: these are just some of the factors that have already prompted 42 per cent of businesses to take the plunge into container technology, regardless of its relative infancy. With the market predicted to be worth $2.7 billion by 2020 according to 451 Research, this trend is set to continue as businesses look to leverage these benefits for running their applications in the cloud. However, there are still some significant obstacles and misconceptions that need to be overcome. Challenges around ensuring application security are prominent, for example, but even more important for the future of the industry will be ensuring portability and compatibility. The growth in the popularity of containers is undeniable, but a disconnect has emerged between the interest being shown in the technology…

Unless you’ve been living under a rock for the past few weeks (and perhaps even then), you can’t have escaped news of several new security vulnerabilities that were discovered to impact various modern microprocessors. The names ‘Meltdown’ and ‘Spectre’ have by now garnered all of the usual media attention that one has come to expect from a branded vulnerability that comes with its own website and logo. But unlike some previous incidents over the years, these latest exploits affect hardware – not the Linux kernel or application software. The vulnerabilities were discovered independently by multiple teams, including Google Project Zero (which aims to find so-called ‘zero day’ high-severity security bugs in parts of critical system hardware and software stacks), and researchers at the Technical University of Graz in Austria (TUGraz),…

1 Connection details First, head to Edit > Connection details > Virtual Networks, click the + and enter the name of the virtual network as isolated. 2 Define network Next, untick the option to enable both the IPv4 network or the IPv6 network. In the last step you only need to select ‘Isolated virtual network’. 3 Use it Right-click a VM and go to Open > Virtual Hardware details > Add Hardware > Network. Set ‘Network source’ as ‘isolated’ and ‘Device model’ as ‘virtio’.…

Migration is the process of moving a VM from one host to another and is one of the key features of virtualisation. VMs can be migrated both online (live) or offline. An offline migration suspends the guest then moves an image of the guest’s memory to the destination host. The guest is resumed on the destination host and the memory the guest used on the source host is freed. However, to avoid interruptions, it’s best to do live migrations. For these to be successful, the VM guests must use a shared storage pool. This ensures that the migration process only has to transfer the VM’s memory to the new host, which takes a fraction of the time it would to transfer the entire virtual disk to another host. A live…

Metasploit is a powerful and easy-to-use pen-testing framework widely used by security enthusiasts and professionals alike. It is written entirely in Ruby, so if you come from other scripting languages such as Python, you will feel (almost) at home. The framework is made of six different types of modules (Ruby scripts): Exploits, Payloads, Encoders, NOPs, Post and Auxiliary. Exploits are scripts that take advantage of a system vulnerability. An exploit carries and delivers a Payload to the vulnerable host, allowing us to get a foothold into the system. Being able to deliver a payload requires us to be stealthy sometimes: that’s the Encoders’ purpose. For memory corruption flaws, sometimes you will need a NOP-Sled: hence the Nops modules. Once you ‘pown’ a system, you will be performing Post exploitation tasks;…

Racket, including the DrRacket IDE https://download.racket-lang.org or use your package manager If you use your package manager, make sure that DrRacket is included in the Racket package for your distribution – if not, you will need to download it separately Racket is an increasingly popular open source programming language with a large standard library, an active developer community and a strong suite of programmer tools built around it. It has been under development in one form or another for over 20 years, but its roots stretch back far earlier to Scheme in the 1970s and LISP in the 1950s. These days, Racket is becoming increasingly popular in computer science education, particularly in the United States, and is a key tool for programming language research. A wide variety of different language…

1 LocTote FlakSack Sport It’s difficult to provide physical protection for individual small items, as you can easily do with a laptop. However, the LocTote FlakSack Sport (http://loctote.com, £75) keep several small pieces of equipment secure. It takes the form of a slash-resistant bag with a nylon and steel locking strap and combination lock which with you can attach it to an immovable object. 2 Lock Alarm Mini The Lock Alarm Mini (www.lockalarm.com, £25) offers both physical protection and an alarm. The physical protection is provided by a strong steel cable to secure your laptop or other kit. This is difficult to cut with hand tools and, if a thief does try to cut through it, an alarm will sound. 3 SmartWater SmartWater provides the benefits of both visible and…

Resources Raspbian Stretch Lite www.raspberrypi.org/downloads Etcher https://etcher.io N-O-D-E https://github.com/N-O-D-E/Dongle RubberDucky Payloads https://github.com/hak5darren/USB-Rubber-Ducky/wiki/Payloads RubberDucky USB devices are great penetration-testing tools. This device is plugged into a target computer, and the USB drive tricks the computer into thinking it’s a HID keyboard device in order to gain privileged access. Keyboards naturally provide a user with unrestricted access to the computer, in ways that a USB stick wouldn’t normally be able to. Pre-configured ‘Ducky’ scripts are then run on the target machine to prank the user or provide unauthorised remote access. Not only are we going to turn a Raspberry Pi Zero W into a USB device capable of running Ducky scripts, we’re also going to gain remote access to the target machine in order to select which scripts we’d like to…

While Numba allows you to compile sections of your code for increased speed, there are other options available. The simplest, most direct one is to use a different interpreter. This allows you to get better performance without necessarily having to do anything – and as all programmers know, you should always follow the laziest path available. Installing Pypy on a Debian-based system should be as simple as the following command. This will install a new Python interpreter for you to use on your system. One thing to be aware of is that the performance of Pypy is dependent on the architecture on which you’re running the code, so you may notice different speed increases on your Raspberry Pi (based on the ARM chip), as opposed to your regular x86-based desktop.…

RAM 256MB recommended Storage Minimum 650MB Specs An x86 Pentium with a VGA compatible graphics card Available from: https://www.reactos.org ReactOS is an open source operating system based on the design principles of Windows NT. It’s written completely from scratch rather than being a Linux-based system. The project exists to give users an open source platform to run software designed for Windows by being binary-compatible with the proprietary OS. The OS is getting more usable with every release; in addition to enhancing the core, the developers are working on visual enhancement – this release comes with improved support for styles created for Windows XP. The improved visuals in ReactOS 4.7 and in particular the work by Giannis Adamopoulos is a major talking point of this release. Giannis has worked on bringing…

ScummVM is one of the most popular virtual machine platforms for playing classic games. It’s a scripting language that was originally created by LucasArts for the development of the game Maniac Mansion, and has since been used to create several other classic adventure game titles, including the Monkey Island series. The ScummVM project implements a virtual machine to interpret Scumm games. It was originally designed solely to play LucasArts’ adventure games, but now also supports a variety of non-Scumm games by studios such as Revolution Software and Adventure Soft. This latest release adds support for 23 new titles. The project’s website hosts binaries for all popular distributions. Besides the launcher itself, you can also install about a dozen games (released as freeware by their publishers) directly from the project’s website,…

“Use our intuitive Control Panel to manage your domain name”  Featured host: www.thenames.co.uk0370 321 2027 About us Part of a hosting brand started in 1999, we’re well-established, UK-based, independent and our mission is simple – ensure your web presence ‘just works’. We offer great-value domain names, cPanel web hosting, SSL certificates, business email, WordPress hosting, cloud and VPS. What we offer •Free email accounts with fraud, spam and virus protection •Free DNS management •Easy-to-use Control Panel •Free email forwards – automatically redirect your email to existing accounts •Domain theft protection to prevent it being transferred out accidentally or without your permission •Easy-to-use bulk tools to help you register, renew, transfer and make other changes to several domain names in a single step •Free domain forwarding to point your domain…

WHAT IS IT? Every time you see this symbol in the magazine, there is free online content that's waiting to be unlocked on FileSilo. WHY REGISTER? • Secure and safe online access, from anywhere • Free access for every reader, print and digital • Download only the files you want, when you want • All your gifts, from all your issues, all in one place 1. UNLOCK YOUR CONTENT Go to www.filesilo.co.uk/linuxuser and follow the instructions on screen to create an account with our secure FileSilo system. When your issue arrives or you download your digital edition, log into your account and unlock individual issues by answering a simple question based on the pages of the magazine for instant access to the extras. Simple! 2. ENJOY THE RESOURCES You can…

Following reports that Ubuntu 17.10 bricked certain laptops, Canonical has finally reissued the October 2017 version of Ubuntu. At the root of the problem was the Intel SPI Driver, which resulted in Lenovo laptops (and some from Dell and Acer) being unable to boot, or blocked from making changes to the BIOS. Worryingly, the bug could impact your system simply from being loaded as a live image. Worst of all, while fixes are now in circulation, this bug can leave the motherboard unusable. The Intel SPI driver enables direct BIOS upgrades, but remains disabled in future versions of the Linux kernel. With the ability to overwrite SPI flash memory, the Intel SPI driver’s documentation warns against enabling it “unless you know what you are doing.” The entry for Artful Aardvark…

Virtualisation is one those computing mainstays that has been around for several decades in one form or another. Flexibility and performance are some of the major factors that attract users to virtualisation. In the enterprise, it helps consolidate servers by reducing the number of ‘bare metal’ servers and other computing hardware, which leads to power savings and increases hardware utilisation. Virtualisation is also wonderful for isolating services by using one server to run one service in a process, ensuring that, if exploited, a weakness in one doesn’t affect the others. Even for small-scale setups, virtualisation helps to speed up server rollouts. You can spawn a virtual machine (VM) from prebuilt templates or images in a fraction of the time it takes to provision a bare metal system. In the same…

In the last issue, we learned the basic concepts behind writing a makefile, and how the Make utility works. In this issue, we’re going to be looking at some more advanced features of Make that simplify the process of writing rules. As we learned last month, we can use rules to tell Make how to build a file and what its prerequisites are. However, since many files are built in similar ways, our makefile involved a lot of repeated code. For a more complicated project, the makefile could become unmaintainable and unwieldy very quickly. The tools that we’re going to learn about in this article enable us, to some extent, to automate the process of writing rules by writing single rules that can be applied to build multiple files. Perhaps…

Do you have what it takes to… Hack the Box? Now that you know a bit about Metasploit, try your new skills against Hack The Box: https://www.hackthebox.eu. This is an online platform full of CTFs (reversing, crypto, web hacking, forensics, stego) and most of them are free of charge… if you can hack your way in, that is! 1 Hack your way in Browse to https://www.hackthebox.eu/invite and hack your way in to become a member. We’ve done it already but we can’t provide you with any clues because it goes against Hack The Box’s seventh rule: Don’t spoil! 2 Connect to the VPN After hacking your way in, in order to access to the multiple available machines to pown, you will need to set up a VM with all your…

Resources Raspberry Pi Pimoroni Rainbow HAT https://shop.pimoroni.com/products/rainbow-hat-for-android-things Pimoroni is adept at creating awesome Hardware Attached on Top (HATs) for the Raspberry Pi. Last year it released the Rainbow HAT and, as expected, it’s stacked with a buffet of sensors, inputs and displays to explore your surroundings. Use it as a weather station, a clock, a timer, a mood light or endless other things. This tutorial walks you through some of the Rainbow HAT’s main functions such as displaying text and taking a temperature reading. Then we move onto coding for the ten LEDs: everyone likes LEDs, and the Rainbow HAT boasts both mini-LEDs and seven full-RGB LEDs. Combine these with the built-in piezoelectric buzzer and the three touch buttons, and you have a simple all-in-one musical disco machine. In the…

Flickr is arguably the most popular image-hosting service used by both professionals and regular folk with point-and-shoots. Frogr enables you to share content with the online service from the comfort of a desktop client. As well as being able to upload local and remote photos and videos to Flickr, the app gives you access to Flickr’s basic upload features including the ability to describe images, tag them, set specific licences and geolocation information, and categorise them into sets and group pools. In addition to adding images to existing sets, you can also create new ones within the application itself. For more seasoned Flickr users working on a large number of files, the app offers the option of saving them all to a Frogr project file. You can then load the…

Designed as an educational and advocacy organisation to promote open development, the Open Source Initiative is adding an additional responsibility to its missions in 2018: celebrating its 20th anniversary. Founded in February 1998 in Palo Alto, California, the OSI was the result of a strategy session during which the term ‘open source’ was created. In 1998, the computing landscape was very different. The notion of open source, sharing code for reuse and modification, and even free software was completely alien to most, and a fringe activity to the rest. Thanks to Linux and the efforts of the Open Source Initiative, we live in a world that continues to move closer to intellectual collaboration. Case in point: long seen as the enemy of open source, Microsoft joined the OSI as a…

As expected, Linux Mint 19 has been confirmed for a summer release, and continues the convention for female names as ‘Tara’. Based on Ubuntu 18.04 LTS, Linux Mint 19 will include critical security fixes for the duration of the Long Term Support, making it an ideal hopping-on point for newcomers, as well as a vital upgrade. Several new features have been announced for Linux Mint 19. For instance, improved HiDPI support is included – perhaps better known as ‘Retina Display’ in Apple-speak marketing. This means that Mint 19 should look amazing on the latest MacBooks and iMacs. Various core apps are being updated, too. These include adding full text search to Nemo, and some tweaks and improvements to the Mint Update tool. Mint Welcome is undergoing a modest change, too.…

“Nextcloud has gained a reputation as a self-hosted, open source alternative to many of the proprietary cloud-based file share and syncing services. But even from its roots in ownCloud, the project has had greater ambitions, and in the last year it has released a flurry of updates that has fortified it as secure collaboration platform. Nextcloud’s managing director, Frank Karlitschek, and its marketeer, Jos Poortvliet, invited us to chat about the future and the project’s latest collaborative feature, Nextcloud Talk. Most of our readers would know Nextcloud and ownCloud, but I thought it’d be good to have an overview from you on what it is. I’d be interested to know as well where the idea came from. Frank Karlitschek: Absolutely. It’s actually very good timing because I think tomorrow –…

1 Sysprep the image Make sure the VM you want to use as a template isn’t running. Then fire up a terminal and run the virt-sysprep command to reset, unconfigure and remove any system-specific settings in the VM. It’s a good idea to rename it to mark it as a template (such as template_CentOS-Labs) to avoid accidently booting it. 2 Review the settings Now launch virt-manager and select the sysprepped template VM. Right-click it and select Clone, which displays the Clone Virtual Machine window. Provide a name for the cloned VM and take time to check its settings. By default, virt-manager makes a copy of any attached virtual hard disks. 3 Create the clone To avoid issues in the future, you should also make it a point to change the…

Conservation isn’t cheap. Fortunately, open hardware and software has the potential to utterly transform how we protect and monitor our planet. But it’s a question of focusing on which technologies offer the most value and will have the greatest adoption in the field that’s important, explains Alasdair Davies over VoIP from his London base. A conservationist and open software/ hardware technologist, he’s speaking to us a few days before heading back out into the field. This time it’s a turtle conservation programme on Príncipe Island, which lies off the west coast of Africa in the Gulf of Guinea, where he’ll attach and test a Raspberry Pi-based tagging system on female green sea turtles, collecting the results when they return to nest. (You can see some of the remarkable video footage…

Deploying a Raspberry Pi for every single application gets expensive; fortunately, cheaper modules exist. Expressif‘s ESP32 expands the success of the legendary ESPP8266: it takes the venerable Extensa CPU and its Wi-Fi module, and expands it with a Bluetooth transmitter (and a few power-saving features not discussed in this article). When purchased in bulk from China, all of this can be had for less then £10 – and let‘s not even get started on the significant size reduction in comparison to combinatorial process computers such as the Arduino Yún. The following steps use the DevKit C development kit, which can be purchased at various sources such as the generally reputable Dutch electronics shop Elektor (see the first entry in Resources). It comes with a Serial-to-USB chip, the drivers of which…

Resources Arduino MegaBreadboardsLCD DisplayLEDsButtonsResistors In part one of this tutorial, we created a Dictaphone-style device, capable of voice recording and playback, using an already assembled microphone circuit and a resistor ladder digital-to-analogue converter. The recording should have been approaching telephone quality and was abruptly ended after a constant, pre-set time. Playback began immediately and would only play the entire recording. In the second part of the tutorial, we’ll show you how to turn this device – already remarkable given the low price of the components – into one which can be easily controlled by the user. If assembled on a printed-circuit board and housed within a solid enclosure, this project could even become a DIY gift or the prototype for a commercial product, if one was so inclined. Building upon…

• Anti-theft products, Anti-theft products for tech range from devices to provide physical security, through alarms that will let you know if your equipment is tampered with, to products to mark your gear uniquely and indelibly. We look at the pros and cons of each, and identify some suitable products. • Behavioural changes, Even if you don’t want to buy any anti-theft products – although we certainly suggest you do – you could probably make your kit a lot more secure just by altering the way you behave. It’s all too easy to let your guard down, so here are some commonsense precautions. DIY solutions, Creating your own anti-theft products could provide you with extra functionality while, at the same time, being an interesting exercise and perhaps providing a cost…

“It was important that my hub was open source” Peter Monaco  lives in the San Francisco Bay Area and is a software engineer. He’s currently working at the Connectivity Lab at Facebook, which is an innovation team working to develop economically sustainable technologies. Like it? For a full walkthrough of Peter’s project go to http://bit.ly/WallMountRasPi Touchscreen, where he’s revised the instructions to include powering the touchscreen using 120 VAC (US standard for mains electric) or Power over Ethernet. Further reading Peter uses SketchUp for his design work, so if you want to print the parts for this project, you can find all the STL files at https://www.thingiverse.com/thing:2749782. Peter recommends using Bezel_v2 and Faceplate_v2. This project is an elegant solution to a tricky problem with the affordable but useful 7-inch Raspberry…

“One area that is always an issue with Python code is performance. Much of this is due to using programming techniques from other languages that simply don’t work the same way in Python. These types of issues are usually dealt with by rewriting your code in a more Pythonic form. While this is perfectly adequate in most cases, people are always keen to squeeze every last bit of performance out of their code. In these cases, you have a few different options. Here, we’ll look at one of them named Numba, which compiles your code using a JIT compiler based on additions to your code that enable you to fine-tune the JIT compiler. This has traditionally been an issue for the Raspberry Pi, since it requires the LLVM compiler and…

MPV is based on the mplayer2 player (which was forked from mplayer) and continues the tradition of the extremely popular command-line app by introducing optimised and cleaned-up code with new configuration options and features. The CLI player offers a minimal user interface that stays out of the way and lets you watch your videos without distraction. The bloat-free interface pops up when you move the mouse over the bottom part of the video during playback. It includes the essentials: playback control, a seek bar, a full-screen button and buttons to switch audio and subtitle tracks. Although you control it via CLI options, the player has easy to remember and intuitive options. You can also place these in a configuration file to control and to override its default behaviour. As it’s…

Fotoxx has a rich set of retouch and editing functions that go beyond changing brightness, contrast and colour. Like most dedicated image editors, it enables you to select an object or area within an image using various tools such as a freehand outline, following edges, selecting matching tones and so on. One unique feature of the tool is that it allows you to edit the images without using layers. You can also create HDR and panoramic images, reduce noise and remove dust spots, create collages, mash-ups and slideshows with animations. There are also several artistic effects to help convert a photo into a line drawing, sketch, painting, embossing, cartoon, dot image or mosaic. On initial launch, it fires up a quick-start guide in the browser, along with a dialogue box…

01 Optimise your website images When uploading your website to the internet, make sure all of your images are optimised for the web. Try using jpegmini.com software; or if using WordPress, install the EWWW Image Optimizer plugin. 02 Host your website in the UK Make sure your website is hosted in the UK, and not just for legal reasons. If your server is located overseas, you may be missing out on search engine rankings on google.co.uk – you can check where your site is based on www.check-host.net. 03 Do you make regular backups? How would it affect your business if you lost your website today? It’s vital to always make your own backups; even if your host offers you a backup solution, it’s important to take responsibility for your own…