Categoria: Debian

libgnomevfs-WARNING-Debian-Sid

 

Stasera mentre smanettavo un po su Sid, mi è capitato una cosa stranissima, tutto ad un tratto non sò come e perchè, non

riuscivo ad ottenere i privilegi di root. L’errore nel terminale era il seguente:

(gedit:4397): libgnomevfs-WARNING **: Unable to create ~/.gnome2 directory: No such file or directory
Could not create per-user gnome configuration directory `/root/.gnome2/’: No such file or directory

Dopo un po di sbattimenti sono riuscito a capire e a risolvere il problema, che era dato da una modifica (non so come sia

avvenuta) in /etc/passwd, dove root si trovava in /home/root anzichè in /root. A questo punto non mi rimaneva che dare un:

Ctrl-Alt-F1

nano /etc/passwd

e nella riga dedicata a root cancellare la voce /home. Spero sia utile a qualcuno. Enjoi 😉

 

Debtree-generatore grafico di dipendenze

 

Come da titolo Debtree è un generatore grafico di dipendenze, comodo per chi volesse graficamente farsi un idea sulle

dipendenze di uno specifico programma. Per ottenere il grafico Debtree si appoggia a Graphviz.  Per installarlo:

apt-get install graphviz

git clone git://git.debian.org/~fjp/debtree.git

a questo punto entriamo nella directory debtree, e proviamo a generare un grafico per dpkg:

cd debtree

./debtree --no-recommends --no-alternatives --max-depth=4 dpkg| dot -T png > grafico-dpkg.png

gnome-open grafico-dpkg.png

Oppure in alternativa:

./debtree dpkg > grafico-dpkg.dot

dot -T png -o grafico-dpkg.png grafico-dpkg.dot

gnome-open grafico-dpkg.png

A questo punto abbiamo il nostro grafico.

Enjoy .

 

Shorewall installazione e configurazione



 

Shorewall (Shoreline Firewall) è un firewall che si appoggia al sistema  Netfilter (iptables/ipchains) del kernel Linux, per una più semplice gestione di avanzate configurazioni di rete. Prima di iniziare nell'installazione di shorewall, bisogna prima disinstallare eventualmente l'altro firewall. Esempio: firestarter:

# apt-get remove --purge firestarter

# apt-get install shorewall shorewall-common shorewall-shell shorewall-doc dash

 

1) Partiamo con la configurazione del file interfaces:

# gedit /etc/shorewall/interfaces

all'interno copiamo questo:

# Shorewall version 3.0 – Sample Interfaces File for one-interface configuration.
#
# /etc/shorewall/interfaces
#
# You must add an entry in this file for each network interface on your
# firewall system.
#
# Columns are:
#
# ZONE Zone for this interface. Must match the name of a
# zone defined in /etc/shorewall/zones. You may not
# list the firewall zone in this column.
#
# If the interface serves multiple zones that will be
# defined in the /etc/shorewall/hosts file, you should
# place "-" in this column.
#
# If there are multiple interfaces to the same zone,
# you must list them in separate entries:
#
# Example:
#
# loc eth1 –
# loc eth2 –
#
# INTERFACE Name of interface. Each interface may be listed only
# once in this file. You may NOT specify the name of
# an alias (e.g., eth0:0) here; see
# https://www.shorewall.net/FAQ.htm#faq18
#
# You may specify wildcards here. For example, if you
# want to make an entry that applies to all PPP
# interfaces, use 'ppp+'.
#
# There is no need to define the loopback interface (lo)
# in this file.
#
# BROADCAST The broadcast address for the subnetwork to which the
# interface belongs. For P-T-P interfaces, this
# column is left blank.If the interface has multiple
# addresses on multiple subnets then list the broadcast
# addresses as a comma-separated list.
#
# If you use the special value "detect", the firewall
# will detect the broadcast address for you. If you
# select this option, the interface must be up before
# the firewall is started, you must have iproute
# installed.
#
# If you don't want to give a value for this column but
# you want to enter a value in the OPTIONS column, enter
# "-" in this column.
#
# OPTIONS A comma-separated list of options including the
# following:
#
# dhcp – Specify this option when any of
# the following are true:
# 1. the interface gets its IP address
# via DHCP
# 2. the interface is used by
# a DHCP server running on the firewall
# 3. you have a static IP but are on a LAN
# segment with lots of Laptop DHCP
# clients.
# 4. the interface is a bridge with
# a DHCP server on one port and DHCP
# clients on another port.
#
# norfc1918 – This interface should not receive
# any packets whose source is in one
# of the ranges reserved by RFC 1918
# (i.e., private or "non-routable"
# addresses. If packet mangling or
# connection-tracking match is enabled in
# your kernel, packets whose destination
# addresses are reserved by RFC 1918 are
# also rejected.
#
# routefilter – turn on kernel route filtering for this
# interface (anti-spoofing measure). This
# option can also be enabled globally in
# the /etc/shorewall/shorewall.conf file.
#
# logmartians – turn on kernel martian logging (logging
# of packets with impossible source
# addresses. It is suggested that if you
# set routefilter on an interface that
# you also set logmartians. This option
# may also be enabled globally in the
# /etc/shorewall/shorewall.conf file.
#
# blacklist – Check packets arriving on this interface
# against the /etc/shorewall/blacklist
# file.
#
# maclist – Connection requests from this interface
# are compared against the contents of
# /etc/shorewall/maclist. If this option
# is specified, the interface must be
# an ethernet NIC and must be up before
# Shorewall is started.
#
# tcpflags – Packets arriving on this interface are
# checked for certain illegal combinations
# of TCP flags. Packets found to have
# such a combination of flags are handled
# according to the setting of
# TCP_FLAGS_DISPOSITION after having been
# logged according to the setting of
# TCP_FLAGS_LOG_LEVEL.
#
# proxyarp –
# Sets
# /proc/sys/net/ipv4/conf/<interface>/proxy_arp.
# Do NOT use this option if you are
# employing Proxy ARP through entries in
# /etc/shorewall/proxyarp. This option is
# intended soley for use with Proxy ARP
# sub-networking as described at:
#
#
# routeback – If specified, indicates that Shorewall
# should include rules that allow
# filtering traffic arriving on this
# interface back out that same interface.
#
# arp_filter – If specified, this interface will only
# respond to ARP who-has requests for IP
# addresses configured on the interface.
# If not specified, the interface can
# respond to ARP who-has requests for
# IP addresses on any of the firewall's
# interface. The interface must be up
# when Shorewall is started.
#
# arp_ignore[=<number>]
# – If specified, this interface will
# respond to arp requests based on the
# value of <number>.
#
# 1 – reply only if the target IP address
# is local address configured on the
# incoming interface
#
# 2 – reply only if the target IP address
# is local address configured on the
# incoming interface and both with the
# sender's IP address are part from same
# subnet on this interface
#
# 3 – do not reply for local addresses
# configured with scope host, only
# resolutions for global and link
# addresses are replied
#
# 4-7 – reserved
#
# 8 – do not reply for all local
# addresses
#
# If no <number> is given then the value
# 1 is assumed
#
# WARNING — DO NOT SPECIFY arp_ignore
# FOR ANY INTERFACE INVOLVED IN PROXY ARP.
#
# nosmurfs – Filter packets for smurfs
# (packets with a broadcast
# address as the source).
#
# Smurfs will be optionally logged based
# on the setting of SMURF_LOG_LEVEL in
# shorewall.conf. After logging, the
# packets are dropped.
#
# detectnets – Automatically taylors the zone named
# in the ZONE column to include only those
# hosts routed through the interface.
#
# upnp – Incoming requests from this interface
# may be remapped via UPNP (upnpd).
#
# WARNING: DO NOT SET THE detectnets OPTION ON YOUR
# INTERNET INTERFACE.
#
# The order in which you list the options is not
# significant but the list should have no embedded white
# space.
#
# Example 1: Suppose you have eth0 connected to a DSL modem and
# eth1 connected to your local network and that your
# local subnet is 192.168.1.0/24. The interface gets
# it's IP address via DHCP from subnet
# 206.191.149.192/27. You have a DMZ with subnet
# 192.168.2.0/24 using eth2.
#
# Your entries for this setup would look like:
#
# net eth0 206.191.149.223 dhcp
# local eth1 192.168.1.255
# dmz eth2 192.168.2.255
#
# Example 2: The same configuration without specifying broadcast
# addresses is:
#
# net eth0 detect dhcp
# loc eth1 detect
# dmz eth2 detect
#
# Example 3: You have a simple dial-in system with no ethernet
# connections.
#
# net ppp0 –
#
# For additional information, see
#
#
###############################################################################
#ZONE INTERFACE BROADCAST OPTIONS
net eth0   detect      routefilter,dhcp,tcpflags,logmartians,nosmurfs
#LAST LINE — ADD YOUR ENTRIES BEFORE THIS ONE — DO NOT REMOVE

 

Attenzione:Se al posto del router abbiamo un modem cambiare eth0 con ppp0. In ogni caso cercare di adattarlo alle nostre esigenze e configurazione.

 

2) Configurazione del file policy:

# gedit /etc/shorewall/policy

all'interno copiamo questo:

# Shorewall version 3.0 – Sample Policy File for one-interface configuration.
#
# /etc/shorewall/policy
#
# THE ORDER OF ENTRIES IN THIS FILE IS IMPORTANT
#
# This file determines what to do with a new connection request if we
# don't get a match from the /etc/shorewall/rules file . For each
# source/destination pair, the file is processed in order until a
# match is found ("all" will match any client or server).
#
# INTRA-ZONE POLICIES ARE PRE-DEFINED
#
# For $FW and for all of the zoned defined in /etc/shorewall/zones,
# the POLICY for connections from the zone to itself is ACCEPT (with no
# logging or TCP connection rate limiting but may be overridden by an
# entry in this file. The overriding entry must be explicit (cannot use
# "all" in the SOURCE or DEST).
#
# Columns are:
#
# SOURCE Source zone. Must be the name of a zone defined
# in /etc/shorewall/zones, $FW or "all".
#
# DEST Destination zone. Must be the name of a zone defined
# in /etc/shorewall/zones, $FW or "all"
#
# POLICY Policy if no match from the rules file is found. Must
# be "ACCEPT", "DROP", "REJECT", "CONTINUE" or "NONE".
#
# ACCEPT – Accept the connection
# DROP – Ignore the connection request
# REJECT – For TCP, send RST. For all other,
# send "port unreachable" ICMP.
# QUEUE – Send the request to a user-space
# application using the QUEUE target.
# CONTINUE – Pass the connection request past
# any other rules that it might also
# match (where the source or
# destination zone in those rules is
# a superset of the SOURCE or DEST
# in this policy).
# NONE – Assume that there will never be any
# packets from this SOURCE
# to this DEST. Shorewall will not set
# up any infrastructure to handle such
# packets and you may not have any
# rules with this SOURCE and DEST in
# the /etc/shorewall/rules file. If
# such a packet _is_ received, the
# result is undefined. NONE may not be
# used if the SOURCE or DEST columns
# contain the firewall zone ($FW) or
# "all".
#
# If this column contains ACCEPT, DROP or REJECT and a
# corresponding common action is defined in
# /etc/shorewall/actions (or
# /usr/share/shorewall/actions.std) then that action
# will be invoked before the policy named in this column
# is enforced.
#
# LOG LEVEL If supplied, each connection handled under the default
# POLICY is logged at that level. If not supplied, no
# log message is generated. See syslog.conf(5) for a
# description of log levels.
#
# Beginning with Shorewall version 1.3.12, you may
# also specify ULOG (must be in upper case). This will
# log to the ULOG target and sent to a separate log
# through use of ulogd
# ).
#
# If you don't want to log but need to specify the
# following column, place "-" here.
#
# LIMIT:BURST If passed, specifies the maximum TCP connection rate
# and the size of an acceptable burst. If not specified,
# TCP connections are not limited.
#
# See for additional information.
#
###############################################################################
#SOURCE DEST POLICY LOG LEVEL LIMIT:BURST
$FW net ACCEPT
net all DROP info
# The FOLLOWING POLICY MUST BE LAST
all all REJECT info
#LAST LINE — ADD YOUR ENTRIES ABOVE THIS LINE — DO NOT REMOVE

 

 

3) Creazione del file di configurazione zones:

# gedit /etc/shorewall/zones

all'interno copiamo questo:

# Shorewall version 3.0 – Sample Zones File for one-interface configuration.
#
# /etc/shorewall/zones
#
# This file determines your network zones.
#
# Columns are:
#
# ZONE Short name of the zone (5 Characters or less in length).
# The names "all" and "none" are reserved and may not be
# used as zone names.
#
# Where a zone is nested in one or more other zones,
# you may follow the (sub)zone name by ":" and a
# comma-separated list of the parent zones. The parent
# zones must have been defined in earlier records in this
# file.
#
# Example:
#
# #ZONE TYPE OPTIONS
# a ipv4
# b ipv4
# c:a,b ipv4
#
# Currently, Shorewall uses this information only to reorder the
# zone list so that parent zones appear after their subzones in
# the list. In the future, Shorewall may make more extensive use
# of that information.
#
# TYPE ipv4 – This is the standard Shorewall zone type and is the
# default if you leave this column empty or if you enter
# "-" in the column. Communication with some zone hosts
# may be encrypted. Encrypted hosts are designated using
# the 'ipsec'option in /etc/shorewall/hosts.
# ipsec – Communication with all zone hosts is encrypted
# Your kernel and iptables must include policy
# match support.
# firewall
# – Designates the firewall itself. You must have
# exactly one 'firewall' zone. No options are
# permitted with a 'firewall' zone. The name that you
# enter in the ZONE column will be stored in the shell
# variable $FW which you may use in other configuration
# files to designate the firewall zone.
#
# OPTIONS, A comma-separated list of options as follows:
# IN OPTIONS,
# OUT OPTIONS reqid=<number> where <number> is specified
# using setkey(8) using the 'unique:<number>
# option for the SPD level.
#
# spi=<number> where <number> is the SPI of
# the SA used to encrypt/decrypt packets.
#
# proto=ah|esp|ipcomp
#
# mss=<number> (sets the MSS field in TCP packets)
#
# mode=transport|tunnel
#
# tunnel-src=<address>[/<mask>] (only
# available with mode=tunnel)
#
# tunnel-dst=<address>[/<mask>] (only
# available with mode=tunnel)
#
# strict Means that packets must match all rules.
#
# next Separates rules; can only be used with
# strict..
#
# Example:
# mode=transport,reqid=44
#
# The options in the OPTIONS column are applied to both incoming
# and outgoing traffic. The IN OPTIONS are applied to incoming
# traffic (in addition to OPTIONS) and the OUT OPTIONS are
# applied to outgoing traffic.
#
# If you wish to leave a column empty but need to make an entry
# in a following column, use "-".
#
# THE ORDER OF THE ENTRIES IN THIS FILE IS IMPORTANT IF YOU HAVE NESTED OR
# OVERLAPPING ZONES DEFINED THROUGH /etc/shorewall/hosts.
#
# See
###############################################################################
#ZONE TYPE OPTIONS IN OUT
# OPTIONS OPTIONS
fw firewall
net ipv4
#LAST LINE – ADD YOUR ENTRIES ABOVE THIS ONE – DO NOT REMOVE

 

 

4) Configurazione del file rules.

# gedit /etc/shorewall/rules

all'interno copiamo questo:

Leggi tutto “Shorewall installazione e configurazione”

Cifrare documenti con Encfs

 

Esiste un altro modo oltre a questo per proteggere i nostri dati sensibili, e cioè utilizzare in coppia encfs e fuse per criptare una directory. Quindi installiamo:

# apt-get install encfs fuse-utils

carichiamo il modulo:

#modprobe fuse

per farlo caricare all'avvio del sistema:

#sh -c "echo fuse >> /etc/modules"

aggiungiamo il nostro utente al gruppo fuse

#adduser Utente fuse

verifichiamo:

DebianBox:/home/edmond# grep "fuse" "/etc/group"
fuse:x:118:edmond

Quindi iniziamo a creare la cartella da criptare, che chiamerò secret:

mkdir /home/Utente/.secret

mkdir /home/Utente/secret

a questo punto usiamo encfs per il montaggio:

encfs /home/Utente/.secret /home/Utente/secret

 

digitiamo p oppure x e scegliamo la password per encfs.

Ipotizzando di avere un documento importantissimo da nascondere:

cp topsecret.txt /home/Utente/secret

e poi smontiamo:

fusermount -u /home/utente/secret

a questo punto il documento sarà al sicuro, infatti al comando

ls /home/Utente/secret

non apparirà nulla. Mentre se noi rimontiamo ci apparirà 🙂

 

edmond@DebianBox:~$ encfs /home/edmond/.secret /home/edmond/secret
Password di EncFS:
edmond@DebianBox:~$ ls /home/edmond/secret
topsecret.txt

La sicurezza non è mai troppa 😉
 

Montare immagini (ISO,BIN,CUE,NRG,MDF,IMG/CCD,DAA) in Debian

Avere la possibilità di montare un file di immagine senza masterizzarlo a volte risulta molto comodo.

Ci sono diversi formati, e montarli è abbastanza semplice.

Immagine ISO:

mount -t iso9660 -o loop archivio.iso /directory/di/montaggio

 

Immagine BIN e Cue

Per poter montare questo tipo di immagine prima bisogna convertirla in ISO.

apt-get install bchunk

bchunk archivio.bin archivio.cue nuovoarchivio.iso

Una volta trasformato in ISO:

mount -t iso9660 -o loop archivio.iso /directory/di/montaggio

 

Immagine NRG

Non c’è bisogno di convertirla in ISO

mount -t iso9660 -o loop,offset=307200 immagine.nrg /directory/di/montaggio

Se si volesse convertire:

apt-get install nrg2iso

nrg2iso archivo.nrg nuovoarchivio.iso

 

Immagine MDFe MDS

Anche qua bisogna prima convertire in Iso

apt-get install mdf2iso

mdf2iso archivio.mdf nuovaimmagine.iso

 

Immagine IMG

Convertiamo in ISO

apt-get install ccd2iso

ccd2iso immagine.img immagine.iso

 

Immagine DAA

Il formato DAA è quello che utilizza  Poweriso. Anche in questo caso bisogna prima convertirlo in ISO.

wget https://poweriso.com/poweriso.tar.gz

tar -zxvf poweriso.tar.gz

convertiamo in ISO con:

./poweriso convert immagine.daa -o nuovaimmagine.iso

Tutti i formati di immagine convertiti in ISO, si montano con:

mount -t iso9660 -o loop archivio.iso /directory/di/montaggio

 

 

Script per Gmail

 

Per scaricare la posta da Gmail io uso uno script per me utilissimo, dato che non sono interessato ad usare client di posta, ma al massimo i plugins per iceweasel-firefox. La particolarità di questo script è che una volta controllato il numero di nuove mail ricevute, si accende il led num lock (oppure caps lock o skroll lock) e lampeggia tante volte, quanto sono le email ricevute. L’unica dipendenza che serve è blinkd, presente nei repository.

apt-get install blinkd

Questo lo script:

#!/bin/bash
cd /tmp
username=Vostro_Username_Google_Senza_@gmail.com
password=$( zenity --entry --title="Password Gmail" --text="Inserisci password :" --hide-text )
if [[ -z $password ]]
then exit
fi
if [[ $password == "0" ]]
then password=$( zenity --entry --title="Password Gmail" --text="Inserisci password :" )
fi
sleep 15
function get_rss
{
wget -q -O .gmail_rss https://$username:$password@mail.google.com/mail/feed/atom --no-check-certificate
fc=$( cat .gmail_rss | grep "fullcount" | grep -o [1-9] )
}
while true
do
get_rss
if ! [[ fc == "0" ]]
then
    until [[ $fc == "" ]]
    do
    blink -n -r $fc
    get_rss
    sleep 15
    done
blink
fi
sleep 5m
done
rm -f .gmail_rss

chmod +x nome_script

 

Naturalmente per visualizzare il file .gmail_rss in /tmp bisogna visualizzare i file nascosti.

Lo script verifica la presenza di nuove mails ogni 10 minuti, per cambiare basta modificare "sleep 10m"

Il led che lampeggia è il num lock, per modificarlo basta sostituire blink -n -r $fc con blink -c -r $fc e si passa al capslock.

Queste le altre opzioni:

  -c,   –capslockled   use Caps-Lock LED
  -h,   –help          display this help and exit
  -m s, –machine=s     let keyboard of machine s blink
  -n,   –numlockled    use Num-Lock LED
  -r n, –rate=n        set blink rate to n
  -s,   –scrolllockled use Scroll-Lock LED
  -t n, –tcp-port=n    use tcp port n
  -v,   –version       output version information and exit

Per fermare o far partire i demoni  /etc/init.d/blinkd stop-start-restart.

Per altro man blinkd.

 

Linux-Debian fonts extra

 

Per chi volesse fonts supplementari non deve fare altro che installare i seguenti:

apt-get install msttcorefonts ttf-gentium ttf-dustin ttf-georgewilliams ttf-sjfonts sun-java6-fonts ttf-larabie-deco ttf-larabie-straight ttf-larabie-uncommon

 

Per chi volesse esagerare circa 300 mega di fonts.

apt-get install msttcorefonts gsfonts* t1-xfree86-nonfree ttf-alee ttf-ancient-fonts ttf-arabeyes ttf-arhangai ttf-arphic-bkai00mp ttf-arphic-bsmi00lp ttf-arphic-gbsn00lp ttf-arphic-gkai00mp ttf-atarismall ttf-dustin ttf-f500 ttf-isabella ttf-larabie-deco ttf-larabie-straight ttf-larabie-uncommon ttf-staypuft ttf-summersby ttf-xfree86-nonfree xfonts* gsfonts-x11 gsfonts ttf-bpg-georgian-fonts ttf-sjfonts ttf-gentium ttf-georgewilliams ttf-georgewilliams sun-java6-fonts

Successivamente per rivederli basta:

apt-get install gnome-specimen

che troveremo sotto Applicazioni-Grafica

 

 

AMSN, loading TkCximage failed

              

 

AMSN, loading TkCximage failed ecc. ecc. è un problema che ho avuto oggi mentre aggiornavo alla 0.97.2.

Per completezza debbo dire che ho installato un’ altra Debian Lenny su una delle tante partizioni dei miei 2

hard disk, ed ho anche installato amsn dai repository, e tutto funzionava. Quindi aggiornando a l’ultima

versione amsn non partiva più dandomi quell’errore. La soluzione è semplice, non si è tirato dietro i pacchetti:

tcl tcl8.4 tk tk8.4

 Questo l’errore datomi per intero:

Loading TkCximage failed. This module is needed to run aMSN. Please compile aMsn first, instructions on how to compile are located in the file INSTALL

 

Usb wireless WG111v3 e Linux

 

Io possiedo un paio di chiavette wireless tra cui una WG111v3 Netgear, e come spesso succede nel mondo Linux non esistono driver. Quindi per farla funzionare bisogna rivolgersi a ndiswrapper ed usare i driver di windows scaricabili da qua.

apt-get install ndiswrapper-utils-1.9

 

dopodichè scompattare e  portarsi nella cartella wg111 ed installare i driver

 ndiswrapper -i WG111v3.inf

 a questo punto basta caricare il modulo

modprobe ndiswrapper

controlliamo con

ndiswrapper -l

ed otterremo qualcosa di simile

DebianBox:/home/edmond# ndiswrapper -l
wg111v3 : driver installed
device (0846:4260) present

nel caso ci trovassimo di fronte ad un errore simile

FATAL: Module ndiswrapper not found.

possiamo risolvere il problema con module-assistant

apt-get install module-assistant ndiswrapper-source

compiliamo i moduli di ndiswrapper

m-a a-i ndiswrapper

ricarichiamo il modulo

modprobe ndiswrapper

adesso tutto dovrebbe funzionare.

 

Cambiare MAC address con Linux

 

Per cambiare il nostro MAC address non bisogna fare altro che eseguire 3 semplici passaggi.

Per prima cosa bisogna ricordarsi che i numeri e le lettere ammessi sono: 1 2 3 4 5 6 7 8 9 0 a b c d e f

Dopodiche ci si costruisce a piacere un MAC address tipo questo 1a:2b:3c:4d:5e:6f

Quindi da root

ifconfig eth0 down
ifconfig eth0 hw ether 1a:2b:3c:4d:5e:6f
ifconfig etho up

Per controllare il nuovo MAC address

ifconfig