Table of contents for No. 174 in Linux User & Developer

This issue » Lock down your system » Power up your Pi » Understand exploits » Erlang explained Welcome to the latest issue of Linux User & Developer, the UK and America’s favourite Linux and open source magazine. We all worry about security. As Linux users we have less chance of our personal machine being co-opted into a botnet, but that doesn’t mean that if it picks something up it can’t merrily forward it on to its Windows-based brethren. Then there are the risks inherent to networks and to the Internet of Things, many based on Linux but made up of mixed architectures. We can’t rely on Windows, Android or even Apple devices to look after themselves; we know how easy it can be to circumvent their protections. Only Linux…

In an attempt to consolidate and improve overall security levels in its ever-popular open-source programming framework, Node.js has implemented its own Node.js Security Project into the mix. The Node.js Security Project was initially set up to help collect information about vulnerabilities that Node users most commonly face. As a direct part of the Node.js Foundation, it’ll be used to help plug exploits and identify core weaknesses within the framework. Another major role of the Node.js Security Project is to help manage the module ecosystem that the framework has been famed for. Over the past 12 months, the module system has nearly quadrupled in size, and as with any developments of this kind, security needs to be paramount. Forums have been rife with bugs, so this additional security layer could prove…

“Linus Torvalds announced the release of the 4.9 Linux kernel, noting that it “is the biggest release we’ve ever had, at least in number of commits.” In fact, the numbers aren’t even close. With over 16,000 changesets (3,000 more than the previous cycle), Linux 4.9 is the biggest kernel in some time. Each of those changesets represents a group of patches, many of which will have had a number of iterations and reviews during development. All of which well explains why Linus decided to wait an extra week after a (rare) RC8 before pushing the final kernel out the door. The latest kernel includes a number of new features that we have covered in previous issues, including support for Intel’s Memory Protection Keys, and Andy Lutomirski’s work on Virtually Mapped…

 Ufw (Uncomplicated Firewall) and its graphical companion Gufw serve as front-ends for the iptables firewall that is standard in most distributions of Linux. “Sparta will ask you to specify a range of IP addresses to scan. Once the scan is complete, Sparta will identify any machines, as well as any open ports or running services” Run the following command: …in Kali to explore further. Gufw is self-explanatory and comes with a switch to enable the firewall, and wizards to block or allow certain ports. There are even preset configurations to allow certain applications and games such as Call of Duty. The command-line version is almost as easy to use. Run: Then to check firewall status, run: By default, all outgoing connections are enabled and all incoming are disabled. You can…

Resources Bash gnu.org/software/bash/bash.html gnuplot http://www.gnuplot.info/ Tim van Beveren's research into air safety incidents raised a deeply uncomfortable fact: humans are less suited to processing text and perform much better when provided with graphical input. This is especially important when aircraft systems display information as series of numbers that are not coloured or marked up with additional visual information like an underlying bar chart. Even though the average system script – process computers will not be discussed in this tutorial – is not as critical as a wrong decision by a pilot, providing users with large blocks of text is not particularly economic and leads to errors that could be avoided. Fortunately, creating graphics from a shell script is not a difficult task. The gnuplot program, which has been part of…

Resources An installation of Erlang A text editor such as Emacs or vi This tutorial is the second one in the series of tutorials about the Erlang programming language. The main subject of this tutorial is Erlang data types and functions. As you might remember from the tutorial in the previous issue, all Erlang code comes in modules unless you are experimenting in the Erlang shell; as a result, all Erlang code comes in functions. Erlang has a pretty unusual way of defining functions, especially if you are used to programming languages such as C or Python, which will be explained here. Additionally, as Erlang is a functional programming language, it also supports anonymous functions, which are also going to be illustrated. You will also learn about atoms, lists, maps…

What you’ll need • Sense HAT • Raspbian with Pixel OS with Sense HAT emulator Some of the most basic and repetitive games are the most fun to play. Consider Flappy Bird, noughts and crosses or even catch. This tutorial shows you how to create a simple drop-and-catch game that makes excellent use of some of the Sense HAT’s features. Start off by coding an egg – a yellow LED – to drop each second, and a basket – a brown LED – on the bottom row of LEDs. Use the Sense HAT’s accelerometer to read and relay back when you tilt your Sense HAT left or right, enabling you move the basket toward the egg. Successfully catch the egg and you play again, with a new egg being dropped…

Of course, Kivy is not the only framework that you could use to create this image display. As another example, we will look at how you could use PyGame to do a similar job of showing a series of photos on a Raspberry Pi display. As you can see, this code is a bit more low-level. The commented line is where you would place the code that creates the list, named 'filelist', that has the filenames for all of the pictures that you wanted to use as part of the display. To display the image is a two-step process. You first need to fill the window with white to essentially erase the currently displayed image. Then the function 'img_ swap()' uses the 'blit()' method to copy the image data to…

Normally we have a screenshot for graphics apps that we review, but since Quil is a library for interactive drawings and animations, the page won’t bring them to life as well as you visiting the project’s homepage or, better yet, running the software. Why would you? Well, Quil mixes Processing – an artist-friendly API – with Clojure, a language so hot that you’re seriously running out of excuses not to at least give it a try. Real soon. As with all things Clojure, Lein makes for the simplest of installs – lein new quil my-sketch, then open the generated core.clj file up in your favourite Clojure friendly editor (Emacs or Lighttable), and evaluate the file. The website is full of examples, as well as links to tutorials, and a chance…

“Having your own dedicated server will give you maximum performance; our UK servers typically include same-day activation” Featured host:   www.cyberhostpro.com 0845 527 9345 About us Cyber Host Pro are committed to provide the best cloud server hosting in the UK; we are obsessed with automation and have been since our doors opened 15 years ago! We’ve grown year on year and love our solid growing customer base who trust us to keep their business’s cloud online! If you’re looking for a hosting provider who will provide you with the quality you need to help your business grow then contact us to see how we can help you and your business! We’ve got a vast range of hosting solutions including reseller hosting and server products for all business sizes.…

Welcome to the Linux User & Developer DVD. This issue we’re all about InfoSec as we help you to test your security, lock down your systems and networks, and even explore a deliberately vulnerable VM to learn more about threats and how to counter them. Inside our live booting distros you’ll also be able to access all the FOSS from our InfoSec feature and keep your systems and data completely watertight. Featured software: Kali Linux The ultimate security testing distro for Linux users will help you to make your system and network watertight. Use it to access the software in our InfoSec feature and to test your systems and networks for the ultimate in secure computing. Please note that the default login for the live boot edition of Kali Linux…

 Although in recent months Microsoft has upped its game when it comes to supporting the world of open source, and to some degree Linux, it’s come to pass that it’s now officially the latest high-profile member of the Linux Foundation. Despite its long history in closed-source software, members of Microsoft have gone on record to say that the partnership will help the Redmond giant develop and deliver new mobile and cloud experiences to more people than ever before. Microsoft has recently been praised for publishing source code repositories, a big step up from a few years ago, but even more impressive is its work when collaborating with the open source community. Recently it has been seeking community consensus in many key development projects, with consumer feedback helping to shape their…

Top 10 This month Stable releases (19) In development (9) The release of Fedora 25 has helped spark some major interest back into the distribution, with it gaining a new wave of users and enticing back those who had previously deserted it. Highlights elementary OS Despite the 0.4 Loki update being released over five months ago now, new users are still flocking over to elementary OS. Its combination of strong usability mixed in with great design is proving to be hard to match. Mint The 18.1 beta of Linux Mint has helped it maintain its spot at the top of the download list. Its biggest addition is a new screensaver with built-in playback controls; it’s pretty good! Fedora It’s hard not to be impressed with what Fedora have achieved…

“One of the central tenets of network security is to reduce your ‘attack surface’ through removing unnecessary software” Hardening. Penetration. Remote exploits. Least privilege. The number of buzzwords and terms related to InfoSec (information security) is almost as great as the various tools out there, each of which boasts that it’ll analyse your network for any potential threat and/or secure it against hackers. In this guide, we will examine some of the network security community’s favourite tools as well as detail the specific threats they address. One of the central tenets of network security is to reduce your ‘attack surface’ through removing unnecessary software. For this reason, any tools listed here should be run from within a pen-testing distribution of Linux, such as Kali, wherever possible. Before proceeding, make sure…

Resources WebSecurity Dojo Installation bit.ly/2fvdkfx Kali Linux installation bit.ly/19pOpAj Msfvenom bit.ly/1KBC8aM DirtyCOW bit.ly/2f0Giks Ptrace bit.ly/1stOb70 JD-GUI http://jd.benow.ca/ MySQL CVE-2016-6663 bit.ly/2e5sng4 MySQL CVE-2016-6664 bit.ly/2eDrNCF MySQL system crash video tinyurl.com/zdejlkz Quite a few dangerous vulnerabilities have popped out lately, most of them exploitable by means of executing different Proof of Concept (PoC) scripts. Some of them even come with catchy names too (i.e. DirtyCOW). Sometimes these PoCs work out-of-the-box, but sometimes they don't. So if a PoC does not yield the expected result, it does not necessarily mean that it has not affected the system in some way. If you execute an exploit and it does not work, maybe it is because that particular system is either not vulnerable or the PoC needs to be adjusted. Worst-case scenario: the exploit damages the…

Resources Unix / Linux Administration http://bit.ly/2gooTVG The Beginner’s Guide to Managing Users and Groups on Linux http://bit.ly/1MCcvt8 Managing Linux User Account Security http://bit.ly/2geSyNG Managing Ubuntu Linux Users and Groups http://bit.ly/2howvoO As you might expect, adding and managing users is the most common task of any Linux system administrator. User accounts help in keeping boundaries between the people who use the system and the processes that run on the system. Groups are a means of assigning rights to your system. As expected, each user needs to have a separate user account. Having a user account provides an area in which you can securely store files. One way to add user accounts is through the User Manager windows. The other, very straightforward method for creating a new user from the shell is…

What you’ll need • Suitable for all models of Raspberry Pi The warrant canary borrows its name from the unfortunate bird that was taken down mine shafts. It’s a reaction against secret requests to obtain customer’s personal data. For example, when a court order is served on a business, its owners are forbidden from alerting users that their data has been compromised. Warrant canaries cleverly slalom around this legal hurdle through regularly making a statement that they have not been subject to such a request. If they switch off their warrant canary, as Reddit did in March 2016, users will know that an external agency also has access to the data a company stores about them. The legal ramifications of this are complex and depend on where you are in…

RAM 1GB Storage 10GB drive space (20GB recommended) Specs 1GHz processor (1.4GHz recommended) For many users coming over to Linux for the first time, Fedora has been one of the leading lights to help guide them on their path. Notorious for being highly usable and boasting a fantastic community, continuous developments have helped propel it to one of the premier offerings available for download. Its latest release, Fedora 25, blends together a suite of new features, mixed in with some improvements to help core stability as well. As ever, Fedora has released three editions of the distribution, each tailored to a specific use and stemming from a base package. Fedora 25 Atomic Host (replacing Cloud), Server and Workstation have all had some noticeable enhancements. Each edition has an underlying foundation…

Security - you know you need it, but something always gets in the way. If you have one, two or a handful of VPSes, and perhaps an internet-facing server or two at home – don’t forget to count that Raspberry Pi project - you’ll have at least thought about security, probably even have a firewall, and maybe even do daily software updates, but you’ll have been far too busy to get serious about Intrusion Detection software. Well, stop prevaricating, postponing and procrastinating, and take a look at Samhain. One of the best host-based intrusion detection systems (HIDS), Samhain sits stealthily on your system monitoring packets and detecting file modifications – as well as searching for rootkits and detecting rogue SUID executables. It can run as a standalone monitor on a…

Live boot Insert the disc into your computer and reboot. You will need to make sure that your computer is set up to boot from disc FOSS Free and open-source software needs to be installed via the distros or by using the disc interface Distros Distros can be live booted so that you can try a new operating system instantly without making permanent changes to your computer Explore Alternatively you can insert and run the disc to explore the interface and content Important information Check this before installing or using the disc For the purpose of this disclaimer statement the phrase ‘this disc’ refers to all software and resources supplied on the disc as well as the physical disc itself. You must agree to the following terms and conditions before…

1 Kali Linux Although it flies under the radar, Kali Linux comes with over 600+ pre-installed pen testing tools that majorly enhance your security toolbox. Tools are highly flexible and many are being updated regularly. Best of all, they can be easily implemented into different platforms, including both ARM and VMware. 2 Pentoo Linux Based on Gentoo, Pentoo can be cleverly used on top of any existing Gentoo installation. Its array of tools vary from exploits to database scanners, equipping you with everything you need to put your security to the test. 3 Parrot Security OS One of the best things about Parrot is just how lightweight it is, making it a viable choice for those running old or slow hardware. It doesn’t skimp on features, however, and you’re bound…

Western Digital has long been a pioneer in making storage more accessible for users all over the world. Its latest announcement sees the introduction of a new kit to help equip your Raspberry Pi with a hard drive storage solution. Named the WD PiDrive Foundation Edition, the hard drive comes equipped with a complete custom software build, closely based on the Raspbian OS and NOOBS OS installer. For end users, this combination provides a quick and simple installation of Raspbian PIXEL and Raspbian Lite onto the drive itself. The drive is to be offered in three capacity versions: a 64GB flash drive, a 250GB disk drive and 375GB disk drive. Both of the bigger capacity options will include a WD PiDrive cable, a unique cable that provides an optimal powering…

“How long has Guinnux been in development for? Where did the original idea for it come from? Guinnux started in 2010 as a buildroot project. We soon realised the similarities between embedded installations and Linux server deployment in terms of their requirements and that it needed to be predominantly unattended. On top of that, we aimed to help promote a structured development environment. That’s where many of Guinnux’s aims were created. Furthermore, buildroot was not flexible enough to move away from uClibc and to deploy new solutions on top of existing frameworks. Deploying new images instead of staged updates to sites is not viable when you have hundreds and thousands of sites. As you can imagine, keeping all of this development and the runtime environment in sync ended up becoming…

Confidentiality When discussing InfoSec, it is a given that private data should be just that. Confidentiality encompasses obvious steps to keep data safe such as storing it offline, encryption and use of 2FA (two-factor authentication). Confidentiality also pertains to people. Anyone with access to sensitive data should be trained to avoid security risks by choosing strong passwords, being aware of getting hacked themselves through social engineering, and having clear privacy guidelines to follow. Integrity Integrity involves ensuring data is consistent and accurate, both when stored and transmitted. Simpler ways of ensuring this involve setting file permissions and user access controls. More advanced methods may involve use of cryptographic checksums such as MD5 to produce a hash value of a new document to compare to the previous copy. Integrity also encompasses…

Although Linux systems cannot be affected by Windows malware, by default they will happily forward on malicious files via internet or USB to more vulnerable machines. ClamAV is an excellent FOSS (free and open source software) antivirus software toolkit. Its database is updated once every few hours and its detection rate beats that of many commercial scanners. In Kali, run: …to install the necessary files. You can use the command freshclam to update the virus database manually, but it’s far better to schedule this as a cron job. Run the command: …to scan individual files or folders. The ClamAV daemon will launch automatically once installed, but is not a real-time scanner in that it will not check files as they are written. The application ClamFS, however, can be used to…

Sparta, which comes pre-installed in Kali, serves as a front-end for the awesome nmap and Nkito tools among others, making network enumeration much easier. Upon launch, Sparta will ask you to specify a range of IP addresses to scan. Once the scan is complete, Sparta will identify any machines, as well as any open ports or running services. Where possible, it will also list the OS in the Information tab. If ports 80 or 443 are open, Sparta will also have Nkito run a scan. Nkito essentially checks server software to make sure it’s up to date, as well as ensuring that there are no potentially harmful files or programs. Use the Nkito tab to view the results and the Notes tab to record your progress. Sparta also incorporates the…

Resources Munin http://munin-monitoring.org/ A computer network is not complete without a resource-monitoring component. While there is no dearth of such monitoring tools, a tried and tested tool is always better than relatively new tools – especially when it comes to network uptime and reliability. In this tutorial we will take a look at one such reliable networked resource monitoring tool called Munin. It lets you easily monitor the performance of not only your computers, but networks, SANs, applications, and various other resources. Written in Perl, Munin is easily extensible and its plugins can be written in any language. You can extend the functionality to monitor specific resources via Munin plugins. Architecturally, Munin has a master/node design where the master connects to all the nodes at regular intervals and asks them…

Using a single-board computer such as a Raspberry Pi to control real-world devices requires two quite different skills. First, you need to be able to churn out code, and second, you need to be able to interface the Pi to external devices. Here we look at the second of those areas and, in particular, investigate how to go beyond using off-the-shelf interfaces like HATs, or even building circuits that others have designed, by designing your own electronic circuits. Using this hands-on guide, you’ll soon be able to connect switches, LEDs and so much more. Here we’ll present circuit diagrams, but if you’re not familiar with them, see our earlier guide (Linux User & Developer 169), which explained how to turn a circuit diagram into a working circuit. Our main emphasis…

Since the processor in the Raspberry Pi can carry out any imaginable logic operation, it might be reasonable to assume that there’s no benefit to be gained from using external logic circuitry. While this would be true if the Pi has sufficient GPIO pins for your application, if you’re getting close to the limit then by using external hardware logic, you can reduce the number of pins needed. Our step-by-step guide provides some examples of how to do this; here we provide an introduction to logic circuitry. LOGIC LEVELS Logic components operate on two voltages that represent the binary values of 0 and 1 although, for some applications, it might be more appropriate to think of them as off and on respectively. In the case of the Pi’s GPIO pins,…

“In a previous article, we looked at using Kivy as a cross-platform graphical interface framework that you can use with your Raspberry Pi. Unfortunately, we did not have the room to really look at any possible uses. This issue, we will look at one possible use, that of displaying photos on some kind of display. This might be something you do at home, with family pictures, or it could be a slideshow for a business or event. If you didn't get a chance to read the previous article, that is okay. We will review enough of the basics that you should be able to get off to a running start now. You will obviously need a physical display attached to your Raspberry Pi to show the images on. There are…