- wlug - University of Waikato Mail Lists

postmarketOS Pursues A Linux-Based, LTS OS For Android Phones
by Peter Reutemann 20 Aug '17

20 Aug '17

'Buy an iPhone and you might get 4-5 years of official software updates. Android phones typically get 1-3 years of updates... if they get any updates at all. But there are ways to breathe new life into some older Android phones. If you can unlock the bootloader, you may be able to install a custom ROM like LineageOS and get unofficial software updates for a few more years. The folks behind postmarketOS want to go even further: they're developing a Linux-based alternative to Android with the goal of providing up to 10 years of support for old smartphones... Right now postmarketOS is a touch-friendly operating system based on Alpine Linux that runs on a handful of devices including the Samsung Galaxy Nexus, Google Nexus 4, 5, and 7 (2012), and several other Samsung, HTC, LG, Motorola, and Sony smartphones. There are also ports for some non-Android phones such as the Nokia N900 and work-in-progress builds for the BlackBerry Bolt Touch 9900 and Jolla Phone. Note that when I say the operating system runs on those devices, I basically mean it boots. Some phones only have network access via a USB cable, for instance. None of the devices can actually be used to make phone calls. But here's the cool thing: the developers are hoping to create a single kernel that works with all supported devices, which means that postmarketOS would work a lot like a desktop operating system, allowing you to install the same OS on any smartphone with the proper hardware. One postmarketOS developer complains that Android's architecture "is based on forking (one might as well say copy-pasting) the entire code-base for each and every device and Android version. And then working on that independent, basically instantly incompatible version. Especially adding device-specific drivers plays an important role... Here is the solution: Bend an existing Linux distribution to run on smartphones. Apply all necessary changes as small patches and upstream them, where it makes sense."' -- source: https://linux.slashdot.org/story/17/08/19/2359258 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Intro To SELinux
by Lawrence D'Oliveiro 18 Aug '17

18 Aug '17

Came across this video recently <https://www.youtube.com/watch?v=cNoVgDqqJmM> from the Red Hat Summit a couple of years ago, which gives a simplified intro to Security-Enhanced Linux (SELinux), which is a set of high-security “mandatory access control” features added to the Linux kernel. There are still some people who get conniptions when they hear that SELinux was originally created by the US National Security Agency. But the code has been through a lot of independent peer review in the time (close to two decades) since then, so rest assured you can have high confidence in it. But it can be a very complex and intimidating piece of software: particularly if you get something wrong and then some service gets denied access to some file or other for mysterious reasons that you cannot fathom. Luckily, there are tools available to help you diagnose such problems. The video talks only about RHEL, but I think those tools are not distro-specific. For a start, SELinux can be set in one of three operating modes: “enabled” (actively blocking/enabling access according to set policy); “disabled” (not active), and “permissive” (where it logs only the actions it would take, without actually blocking any access). The last one is particularly useful for seeing what you would need to fix before you actually enable SELinux, before anything actually breaks. Related to this, each system log message denying access to something also shows a command that you can use to get more detailed information about why that access was blocked, and various things you might do to enable it if that’s what you want. RHEL itself allows you to set two levels of operation of SELinux: “targeted” mode (where a particular critical set of services is controlled by SELinux, while every thing else operates as though it were not there) and “multi-level/multi-category” mode, which is the one that probably justifies the reputation of SELinux for being complex and intimidating, and which is likely only of interest to certain Government employees who don’t like to talk about their job. And which is not addressed in the talk: it only describes “targeted” operation. The video goes step-by-step through a couple of scenarios with using SELinux to control the behaviour of Apache: granting users the ability to set up their own “public_html” directories, and moving a web page created by a staffer into the server area. It shows the mistakes you might make, how they manifest themselves in the logs, and how you correct them. He makes it seem so simple, you feel tempted to actually try SELinux for yourself. Go watch the video.

1 0

Intro To systemd
by Lawrence D'Oliveiro 18 Aug '17

18 Aug '17

Came across this YouTube video recently <https://www.youtube.com/watch?v=S9YmaNuvw5U> from the Red Hat Summit a couple of years ago, which gives a good intro to systemd, with Lennart Poettering as co-presenter. The video explains what a “service” is, and compares how much simpler it is to define a service (usually just a few lines of declarative config) versus the hundreds of lines of shell script it typically takes to set things up under the ancient sysvinit system. Not only that, but it is possible to customize the standard service definitions without having to copy and paste the entire existing definition file: you just create a few lines of additional/overriding definition in a “drop-in” file that you place in /etc, that matches the name of the original service definition. There is even a command, “systemd-delta”, which lets you immediately see all the places where your entire systemwide configuration has been so customized. Lennart mentions that speeding up boot was never a specific design goal, it just naturally came out of the parallelization of service startup. Because systemd lets you think in terms of “services” rather than “processes”, it achieves something that was difficult to ensure before, namely reliable shutdown of a service. Consider Apache, which typically spawns a whole lot of processes, and then if you run CGI scripts, they require additional processes. Nevertheless, shutting down httpd.service with systemd will ensure that all those processes are terminated. Another important feature of systemd is the logging. Here again systemd had a goal of achieving something that was difficult before, namely capturing all log messages from the earliest possible stages of the boot process, including the initrd stage. And also because the systemd journal mechanism has access to kernel information about the processes doing the logging, it can include information in the log entries that those processes cannot forge. Me, I like the fact that the log timestamps are stored in UTC, so you can display them in whatever timezone you wish. There is more, of course: “slices” are how systemd is able to strictly limit the resource usage of services (important to the RHEL-using, Java-suffering audience), and “sockets” are how the functionality of inetd/xinetd is carried over to the systemd world, so that services can be started on demand, instead of having to run all the time. Watch the video to learn more.

1 0

Do not rely on journald to continue logging after a stop+start
by Bryan Baldwin 17 Aug '17

17 Aug '17

Whilst investigating a problem where services logging to sterr go silent after journald is stopped and started, but not when "restarted", Evgeny Vereshchagin suggests not relying on journald. In spite of its man page, it seems that "restart" isn't quite the same thing as stop+start to journald. Vereshchagin also confirms that is isn't currently possible to prevent a manual stop without also preventing a "restart", and that these shortcomings in using journald should get added to the documentation. https://github.com/systemd/systemd/issues/6620#issuecomment-322718725

1 0

Mageia 6: is it the rise of Phoenix?
by Peter Reutemann 17 Aug '17

17 Aug '17

'There is no secret that I always preferred distributions with the DEB package format. However, there is an exception. Mageia was the distribution that I ran for quite long time on various laptops. Unfortunately, the issues with outdated packages made me leave this distribution behind some time ago. Just as a reminder, Mageia is an off-spring from the famous Mandriva family that survived when the Mandriva tree crashed. And to fill out the whole forest, OpenMandriva is another off-spring, and my recent test showed that it is far below the mother quality. Coming back to Mageia, it has been a long time since the previous version of this operating system was released. Mageia 5.0 was the “most recent release” for 1.5 years, and 5.1 was merely an update to it. Mageia 6 was released just few weeks ago, in July 2017. It is a good time to check it out now.' -- source: http://linuxblog.darkduck.com/2017/08/mageia-6-is-it-rise-of-phoenix.html Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

How To List The Dependencies Of A Package In Linux
by Peter Reutemann 17 Aug '17

17 Aug '17

'The other day I was trying to figure out if there is any easy way to find or list the dependencies of a package in Linux. I have been using Linux as my primary OS for few years now, yet I couldn’t how to find the dependencies for a certain package. Fortunately, I found a workaround after a few google searches and wanted to share it with our readers. So, here you go.' -- source: https://www.ostechnix.com/list-dependencies-package-linux/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

When The Cookie Meets The Blockchain
by Lawrence D'Oliveiro 17 Aug '17

17 Aug '17

Cryptocurrencies like Bitcoin are supposed to allow for completely anonymous financial transactions. However, if you use them at an online shopping site, such places often have enough tracking information in place to link you to a particular currency transaction anyway. <http://freedom-to-tinker.com/2017/08/17/when-the-cookie-meets-the-blockchai…>

2 2

Learn the basics of the ZSH shell
by Peter Reutemann 16 Aug '17

16 Aug '17

'Bash isn't bad. It gets the job done just fine, but have you ever considered what it'd be like if Bash had some extra features to make it more convenient to work with? That's more-or-less what ZSH is. It includes all of the features that you'd expect from Bash, but it also has some really nice additions to make your life easier. Actually, you'll be amazed at how much easier they make working in the command line. ' -- source: https://linuxconfig.org/learn-the-basics-of-the-zsh-shell Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

How to secure your LAMP server
by Peter Reutemann 16 Aug '17

16 Aug '17

'The LAMP stack which stands for Linux, Apache, MySQL/MariaDB and PHP/Python/Perl is a very popular combination of free and open-source software used to run millions of websites today. Although many opt for the much efficient LEMP stack based on Nginx instead of Apache, there are still a significant number of users that choose LAMP for their projects. In fact, more than 30% of the active websites today run on top of LAMP. The stack is considered as reliable and very suitable for running high-performance high-availability web applications. In this tutorial we are going to show you how to secure the LAMP stack on your Linux VPS.' -- source: https://www.rosehosting.com/blog/how-to-secure-your-lamp-server/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Email Provider ProtonMail Says It Hacked Back, Then Walks Claim Back
by Peter Reutemann 16 Aug '17

16 Aug '17

'On Wednesday, encrypted email provider ProtonMail claimed it had hacked someone who was impersonating its service in phishing emails, and the company then swiftly deleted the tweet. Early Wednesday morning, the security researcher known as x0rz tweeted out a series of screenshots allegedly showing someone sending emails that directed targets to a fake ProtonMail login screen. "You have an overdue invoice," the message read. In response, ProtonMail said it had taken action. "We also hacked the phishing site so the link is down now," ProtonMail tweeted. Depending on the context and what exactly the retaliating organization did, hacking back can be illegal. Hacking could violate the Computer Fraud and Abuse Act, or perhaps even wiretapping legislation. A recently proposed bill would attempt to legalize the practice. ProtonMail swiftly deleted its tweet, but not before x0rz could grab and subsequently tweet a screenshot. x0rz then deleted his own tweet at the request of ProtonMail.' -- source: https://it.slashdot.org/story/17/08/16/2021257/email-provider-protonmail-sa… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0