tutorial 9ku

tutorial - NFS configuration for central storage

Configuring The NFS Server
1. Edit the /etc/exports file to allow NFS mounts of the /home directory with read/write access.

/home                   *(rw,sync,no_subtree_check)

The option listing for each machine will describe what kind of access that machine will have. Important options are:

ro: The directory is shared read only; the client machine will not be able to write to it. This is the default.

rw: The client machine will have read and write access to the directory.

no_root_squash: By default, any file request made by user root on the client machine is treated as if it is made by user nobody on the server. (Excatly which UID the request is mapped to depends on the UID of user "nobody" on the server, not the client.) If no_root_squash is selected, then root on the client machine will have the same level of access to the files on the system as root on the server. This can have serious security implications, although it may be necessary if you want to perform any administrative work on the client machine that involves the exported directories. You should not specify this option without a good reason.

no_subtree_check: If only part of a volume is exported, a routine called subtree checking verifies that a file that is requested from the client is in the appropriate part of the volume. If the entire volume is exported, disabling this check will speed up transfers.

sync: By default the exportfs command will use async behavior, telling a client machine that a file write is complete - that is, has been written to stable storage - when NFS has finished handing the write over to the filesysytem. This behavior may cause data corruption if the server reboots, and the sync option prevents this.

2. Let NFS read and make /home available to the network with the exportfs command.

# exportfs -a

3. Make sure the required nfs, nfslock, and portmap daemons are running and configured to start after the next reboot.

# chkconfig nfslock on
# chkconfig nfs on
# chkconfig portmap on

# service portmap start
# service nfslock start
# service nfs start

Configuring The NFS Client
1. Make sure the required netfs, nfslock, and portmap daemons are running and configured to start after the next reboot.

# chkconfig nfslock on
# chkconfig netfs on
# chkconfig portmap on

# service portmap start
# service netfs start
# service nfslock start

2) Now mount the NFS (server) /home to this client

# mount server:/home /home/

3) Configure autofs edit your /etc/auto.master file to refer to file /etc/auto.home for mounting information whenever the /home directory is accessed. After five minutes, autofs unmounts the directory.

# vi /etc/auto.master
/home      /etc/auto.home --timeout 600

4) Edit file /etc/auto.home to do the NFS mount whenever the /home directory is accessed.

# vi /etc/auto.home
*   -fstype=nfs,soft,intr,rsize=8192,wsize=8192,nosuid,tcp server:/home/&

Free, facebook, tips, Links, blogging, Downloads, Google, facebookTips, money, news, apps, Social, Media, Website, Tricks, games, Android, software, PIctures, Internet, Security, Web, codes, Review, bloggers, SAMSUNG, Worldwide, Contest, Exitic, Phones, facebookTricks, hacking, London, Olympics, SEO, Youtube, iOS, Adsense, gadgets, iPHONE, widgets, Doodle, twitter, video, Deals, technology, Aircel, Airtel, iPAD, Angry, Birds, BSNL, TechLife, GMAIL, Idea, Microsoft, SmartPhones, Stress, Buster, Windows, Yahoo, Infolinks, Nokia, Scam, Uninor, browsers, Amazon, Euro, CUP, Chat, IDM, JOBS, Modem, Music, Reliance, Results, SSC, Tata, Docomo, bing, freebie, mobile, placements, AIEEE, AlertPay, Chrome, College, Competetive, Exam, Dehradun, Extension, FireFox, GPRS, HTC, IMPACT, Info, MTS, Mark, Zukerberg, Paypal, Promotional, Post, Torrent, UTU, Unlocking, VodaFone, Wall, Paper, apple, books, engineering, iCAR, iTunes, pinterest, rovio, AVG, Admit, Card, Adobe, Affiliate, Marketing, Akhilesh, Amul, Girl, BlackBerry, ChromeBook, Clixsense, Coupon, Digitallife, Discovery, Emoticons, Festival, GATE, GIMP, Income, Tax, International, JSS, JailBreaking, Kindle, Linux, Local, MAX, PAYNE, Mac, Mango, Memory, Speed, Nexus, Online, Shopping, Raakhi, Report, Rising, Stars, Sample, Science, Sony, Syllabus, TabletBooK, Teamviewer, Templates, Dark, Knight, Rises, USA, UPMT, Virgin, Xperia, ZTE, challan, counselling, course, btech, funny, iMOVE, registration

source:http://linuxpoison.blogspot.com/2008/12/135781757113901.html

tutorial - Linux Directory Structure

Directory	Contents
`/`	Root directory—the starting point of the directory tree.
`/bin`	Essential binary files, such as commands that are needed by both the system administrator and normal users. Usually also contains the shells, such as Bash.
`/boot`	Static files of the boot loader.
`/dev`	Files needed to access host-specific devices.
`/etc`	Host-specific system configuration files.
`/home`	Holds the home directories of all users who have an account on the system. Only `root`'s home directory is not located in `/home` but in `/root`.
`/lib`	Essential shared libraries and kernel modules.
`/media`	Mount points for removable media.
`/mnt`	Mount point for temporarily mounting a file system.
`/opt`	Add-on application software packages.
`/root`	Home directory for the superuser `root`.
`/sbin`	Essential system binaries.
`/srv`	Data for services provided by the system.
`/tmp`	Temporary files.
`/usr`	Secondary hierarchy with read-only data.
`/var`	Variable data such as log files.
`/windows`	Only available if you have both Microsoft Windows* and Linux installed on your system. Contains the Windows data.

source:http://linuxpoison.blogspot.com/2008/12/135781757116305.html

tutorial - System Information

File	Description
`/proc/cpuinfo`	This displays processor information, including its type, make, model, and performance.
`/proc/dma`	This shows which DMA channels are currently being used.
`/proc/interrupts`	This shows which interrupts are in use and how many of each have been in use.
`/proc/iomem`	This displays the status of I/O (input/output) memory.
`/proc/ioports`	This shows which I/O ports are in use at the moment.
`/proc/meminfo`	This displays memory status.
`/proc/modules`	This displays the individual modules.
`/proc/mounts`	This displays devices currently mounted.
`/proc/partitions`	This shows the partitioning of all hard disks.
`/proc/version`	This displays the current version of Linux.

source:http://linuxpoison.blogspot.com/2008/12/1357817571833.html

tutorial - OpenSuse Log files

Log File	Description
`~/.xsession-errors`	Messages from the desktop applications currently running. The `~` is the home directory of the current user.
`/var/log/apparmor/`	Log files from AppArmor, see Novell AppArmor Administration Guide (↑Novell AppArmor Administration Guide) for detailed information.
`/var/log/audit/audit.log`	Log file from Audit to track any access to files, directories, or resources of your system and trace system calls.
`/var/log/boot.msg`	Messages from the kernel during the boot process.
`/var/log/mail.*`	Messages from the mail system.
`/var/log/messages`	Ongoing messages from the kernel and system log daemon when running.
`/var/log/NetworkManager`	Log file from NetworkManager to collect problems with network connectivity
`/var/log/samba/`	Directory containing Samba server and client log messages.
`/var/log/SaX.log`	Hardware messages from the SaX display and KVM system.
`/var/log/warn`	All messages from the kernel and system log daemon assigned WARNING level or higher.
`/var/log/wtmp`	Binary file containing user login records for the current machine session. View it with last.
`/var/log/Xorg.*.log`	Various start-up and runtime logs from the X Window system. It is useful for debugging failed X start-ups.
`/var/log/YaST2/`	Directory containing YaST's actions and their results.
`/var/log/zypper.log`	Log file of zypper.

source:http://linuxpoison.blogspot.com/2008/12/135781757114283.html

tutorial - Using .htaccess for password protecting web directory

Htaccess can be used to password-protect directories on your web site. All files and any subdirectories within a directory protected by htaccess will also be protected.

1) Create a file named .htaccess under the directory which you want to protect

# cd /srv/www/htdocs/protect/
# pwd
/srv/www/htdocs/protect

Use your favourite editor to create a file called .htaccess

# touch .htaccess

2) Add the required lines to this .htaccess file

AuthUserFile /etc/apache/.htpasswd
AuthName "Auth required"
AuthType Basic
Require valid-user

It's good idea to place the password file at some secure place (/etc/apache) folder

3) Create the .htpasswd file and add the users/passwd

# cd /etc/apache
# htpasswd2 -c .htpasswd nikesh
New password:
Re-type new password:
Adding password for user nikesh
#

This will add the user "nikesh" and password into the .htpasswd file, you can open and check the entry (you won't be able to read the password)

To delete the user entry: # htpasswd2 -D .htpasswd nikesh
To add new user: # htpasswd2 .htpasswd user

4) Configure the apache configuration file (httpd.conf)

Alias /protect "/srv/www/htdocs/protect/"

        Options Indexes MultiViews FollowSymLinks
        AllowOverride AuthConfig
        Order allow,deny
        Allow from all

When you set up .htaccess files it will be effective for the directory that they are placed in as well as any subdirectories. If you wanted to set up a direcotory so that it could execute CGI scripts you could use a .htaccess file to do that.

Here the most important part is the option "AuthConfig" for "AllowOverride", if for some reason you don't want to use the .htaccess file, just place the option "None" for "AllowOverride".

5) After doing all the required changes, restart the apache server.

Now, just browse to the directory path that you have protected and see if you are getting the username/password dialog, provide the correct values and see if you are allow to enter.

Below are the most common problems experienced by users attempting to setup htaccess.

   1. Permissions on both .htaccess and .htpasswd - Both the .htaccess and .htpasswd files need to be world readable.
   2. Fully qualified path to .htpasswd incorrect - The correct fully qualified path to a valid .htpasswd file must appear beside AuthUserFile in the .htaccess file.
   3. The username doesn’t exist in .htpasswd

source:http://linuxpoison.blogspot.com/2008/12/135781757111257.html

tutorial - Creating Recycle Bin for Samba storage

I assume that you have successfully configure the samba server, if not, here is a quick and dirty samba configuration guide - here

Samba is mainly used to share the files between Linux and windows and many times it happens that user deletes the file from the samba server and later wants to get back deleted files which is not possible with the default configuration of samba server.

The best option is to have a "Recycle bin" for every users on the samba server.
Here is an example of modifying the home directories of your users in samba configuration file

[homes]
comment = Home Directory
valid users = %S
browsable = no
guest ok = no
read only = no
vfs object = recycle
recycle:repository = RecycleBin
recycle:keeptree = yes
recycle:exclude = *.tmp, *.bak

The “vfs object” line calls in the plug-in that enables recycle bin capability. On the other lines, you’re setting the name of the recycle bin directory, telling Samba to preserve the whole structure of any directories that a user may delete, and finally, telling it to not keep certain types of files.

source:http://linuxpoison.blogspot.com/2008/12/13578175713632.html

tutorial - A script for managing file archives of various types

atool is a script for managing file archives of various types (tar, tar+gzip, zip etc).

The main command is aunpack which extracts files from an archive. Did you ever extract files from an archive, not checking whether the files were located in a subdirectory or in the top directory of the archive, resulting in files scattered all over the place? aunpack overcomes this problem by first extracting to a new directory. If there was only a single file in the archive, that file is moved to the original directory. aunpack also prevents local files from being overwritten by mistake.

The other commands provided are apack (to create archives), als (to list files in archives), and acat (to extract files to standard out). As atool invokes external programs to handle the archives, not all commands may be supported for a certain type of archives.

atool identifies archives by their file extension. Sometimes this is not possible - for instance rar archives usually have varying numeric file extensions. In those cases when atool can't identify the format, file is used instead. (atool can be configured not to use file.)

atool is written in Perl by Oskar Liljeblad and is free software (GNU General Public License ).

Download
The latest version of atool is 0.35.0, which was released on 2008-06-08:
Source code tarball
Debian package (all architectures)
RPM package (all architectures)

Building from source
To build all files, simply run: ./configure
The configure script accepts a few options - use the following command to show them: ./configure --help

Installation
Installing atool is a matter of copying the atool file to some appropriate directory for executable files, usually /usr/local/bin. After that, symbolic links for apack, aunpack, als and acat to atool should be created in the same directory. All this can be done automaticly by running: make install

Usage and Configuration
A list of options that atool accepts can be displayed by running atool with the --help option: atool --help
Please see the manual page for atool for full use and configuration information. This document can usually be viewed this way: man ./atool.1

source:http://linuxpoison.blogspot.com/2008/12/135781757118843.html

tutorial - Firewall for Ubuntu - Gufw

iptables is already a very powerful tool by itself, but it's syntax can get awkward at times and hard to figure out, so Ubuntu developers decided to make ufw ("The reason ufw was developed is that we wanted to create a server-level firewalling utility that was a little bit more for `human beings`."), which was to be simpler. Now, on the graphical side of things, Firestarer already existed. But why not make an even easier to use GUI for desktop `human beings`, powered by ufw? This is where Gufw comes in.

Gufw is an easy to use Ubuntu / Linux firewall, powered by ufw.

Gufw is an easy, intuitive, way to manage your Linux firewall. It supports common tasks such as allowing or blocking pre-configured, common p2p, or individual ports port(s), and many others! Gufw is powered by ufw , runs on Ubuntu, and anywhere else Python, GTK, and Ufw are available.

You can install it on ubuntu with this deb package: here

source:http://linuxpoison.blogspot.com/2008/12/13578175716151.html

tutorial - Creating executable of Shell Script

Many times it happen that shell scripts that we write contains sensitive information like password or some sort of keys or path to some sensitive files and if you running such script it become very easy for the normal user to have a look inside the script and get the sensitive information from the code.
There is a program called "shc" which can provide the protection from such cases that developer wants.

shc itself is not a compiler such as cc, it rather encodes and encrypts a shell script and generates C source code with the added expiration capability. It then uses the system compiler to compile a stripped binary which behaves exactly like the original script. Upon execution, the compiled binary will decrypt and execute the code with the shell -c option. Unfortunatelly, it will not give you any speed improvement as a real C program would.

shc's main purpose is to protect your shell scripts from modification or inspection. You can use it if you wish to distribute your scripts but don't want them to be easily readable by other people.

Download shc (here) and untar it:

tar -xzvf shc-X.X.tgz
cd shc-X.X/
make
make install

This will install the shc binary on your box.

Create a file called: script.sh and add the following contents for testing purpose

############################### script.sh ##############################
#!/bin/sh
echo "This is a test shell script by Nikesh"
############################### script.sh ##############################

Now run the command:
shc -f script.sh

The switch "-f" specifies the source script to encrypt. The above command will create two files: script.sh.x.c and script.sh.x. The encrypted shell script is: script.sh.x. Run that binary and see the output:

./script.sh.x
This is a test shell script by Nikesh
Now you can distibute the script.sh.x without any fear

You can also specify a time limit on the shell script so that it will no longer execute after a certain date (expire) and you can specify a custom message to echo back to the user.

shc -e 09/12/2008 -m "Licence expire, please contact author - Nikesh" -f script.sh
./script.sh.x
./script.sh.x has expired!
Licence expire, please contact author - Nikesh

Check out the man pages for more info on "shc".

source:http://linuxpoison.blogspot.com/2008/12/135781757114982.html

tutorial - Quick and Easy VNC Server setup

VNC, or Virtual Networked Computing, is a way of controlling a remote computer just as though you are sitting in front of it. In the Windows world it is also known as remote desktop but it's normally referred to as VNC in the Linux world. All that happens is that you connect using a VNC client to a remote computer running the VNC server, then an image of the remote desktop is transmitted to your local computer and you can see and control the desktop just as though you are there since all keyboard and mouse commands are sent from your client machine to the server.

Step:1: Installation
First check if you already have them installed on your system, open a terminal and type:
$ rpm -qa | grep vnc
vnc-server-4.1.2-9.el5
If you get an output something like this then you're all ready, if not you need to install them via yum.

Step 2 : Start the VNC server.
$ vncserver
......

New 'server:1 (user)' desktop is server:1

This will ask for password, you need to remember this password and need to provide it at the time of connecting to the server through VNC client.

Step 3 : Connecting from VNC client
From client run vncviewer (dont run remote desktop connection from winxp or win2003 .they are using different protocol.)

In server enter : server:1

enter password: **********

And you will see the screen with one terminal open because by default vnc starts twm desktop.

For getting your gnome desktop

Go to folder /user/.vnc/ (user home directory) and open file xstartup using vi editor and uncomment or add the following lines

unset SESSION_MANAGER

exec /etc/X11/xinit/xinitrc

Restart the vncserver and connect to it using vncviewer, you should now see your default desktop, something like ..

source:http://linuxpoison.blogspot.com/2008/12/13578175717167.html

tutorial - Read - Write support for NTFS partition on OpenSuse 11.x

The ntfs-3g driver is an open source, GPL licensed, third generation Linux NTFS driver which was implemented by the Linux-NTFS project. It provides full read-write access to NTFS, excluding access to encrypted files, writing compressed files, changing file ownership, access right.

Technically it's based on and a major improvement to the third generation Linux NTFS driver, ntfsmount. The improvements includes functionality, quality and performance enhancements.

First, of course install the drivers for reading - writing NTFS, if you have NTFS partitions, you can install it from the openSUSE installation CD/DVD or from the repository OSS using YAST, search for "ntfs" and install all the necessary package (below)

Now, just start from the root tool, ntfs-config and enable them to write support for NTFS partitions on your computer, this tool will detect the ntfs partition on your drive.

Or open as root with your favourite editor /etc/fstab, find the line of the partition that you want to enable write, in my case is this:

/dev/sda1 /mnt/c ntfs defaults 0 0

Now, replace the ntfs and default part of the above line with following:

ntfs-3g defaults, users

In my case, then you'll get:

/dev/sda1 /mnt/c ntfs-3g defaults,users

Restart you machine and check if you are able to read/write to NTFS partition.

source:http://linuxpoison.blogspot.com/2009/01/135781757119939.html

tutorial - Ext4 support on OpenSuse 11.1

Kernel 2.6.28 Released

Torvald released the final version of Linux Kernel 2.6.28. It's not a big change since RC 9, but it finally appeared as final after lots of discussion on LKML whether to postpone the release or release earlier and make the merge window longer as the developers goes on long holidays.

Here's some summary of Kernel 2.6.28 (taken from KernelNewbies): Linux 2.6.28 adds the first version of Ext4 as a stable filesystem, the much-expected GPU memory manager which will be the foundation of a renewed graphic stack, support for Ultra Wide Band (Wireless USB, UWB-IP), memory management scalability and performance improvements, a boot tracer, disk shock protection, the phonet network protocol, support of SSD discard requests, transparent proxy support, several new network drivers, controlable IO CPU affinity, high-resolution poll()/select(), support of a minimal "dummy" policy in SELinux, tracing improvements, x86 x2APIC support, a fb driver for VIA UniChrome devices, Mitac Mio A701 ARM-based smartphone support, some new drivers, improved device support, and many other small improvements and fixes.

More on the detailed can be viewed at KernelNewbies. The official announcement are here and here

Kernel Compilation:

1) Make sure you have all the required lib for kernel compilation
2) Download the latest kernel from www.kernel.org (2.6.28)
3) Untar the kernel source and move the folder (linux-2.6.28) under /usr/src/
4) Fire Following commands from /usr/src/linux-2.6.28 folder

# make xconfig

This will open a window where you can search for "ext4", select the ext4 options and save the changes (shown below)

# make rpm

5) This is will take some time for source compilation and making rpm file
Now go to — /usr/src/packages/RPMS/i386 where you will find the rpm file, install this rpm file using following command...

# rpm -ivh kernel-2.6.289pae-1.i386.rpm
[DO NOT UPGRADE YOUR EXISTING KERNEL BY USING rpm -Uvh, instead install the new kernel using rpm -ivh]

This will install all the required files like vmlinuz,system.map, etc .. into your /boot folder

# mkinitrd -- This will create /boot/initrd-2.6.28-9-pae file which is required during booting of new kernel and you should see something like ...

Kernel image:   /boot/vmlinuz-2.6.28-9-pae
Initrd image:   /boot/initrd-2.6.28-9-pae
Root device:    /dev/disk/by-id/ata-ST3802110A_9LR2AE39-part2 (/dev/sda2) (mounted on / as ext3)
Resume device:    /dev/disk/by-id/ata-ST3802110A_9LR2AE39-part7 (/dev/sda7)
Kernel Modules:    scsi_mod libata sata_sil hwmon thermal_sys processor thermal pata_atiixp ata_generic ide-core atiixp ide-pci-generic fan jbd mbcache ext3 edd crc-t10dif sd_mod usbcore ohci-hcd uhci-hcd ehci-hcd hid usbhid
Features:       block usb resume.userspace resume.kernel
Bootsplash:    openSUSE (1024x768)
51347 blocks

6) Go to and edit the following file to add the new kernel to boot menu
# vi /boot/grub/menu.lst and add the following lines to it

title openSUSE 11.1 (2.6.28)
root (hd0,5)
kernel /boot/vmlinuz-2.6.28-9-pae root=/dev/sda2 vga=0×317 resume=/dev/sda7 splash=silent showopts
initrd /boot/initrd-2.6.28-9-pae

You can also install new kernel using Yast tool (system -> Boot Loader).

7) Now install the grub using following command
# grub-install /dev/sda
[Check you drive here or install it using YAST tool]

How to use Ext4

One very important thing to keep in mind is that there is NOT Ext4 GRUB support. Well, that wasn't exactly true: There is grub support, but the grub versions used by your current distro don't support it. There's support in the GRUB2 development branch, but only from this commit and ahead. There're available grub2 packages in Ubuntu and debian-derived distros as the grub-pc package. In the 0.9x branch, there's not official support, but there's a Google SoC project that developed support for it, and Google finds patches. So choose yourself. The next release of distros based in Linux 2.6.28 will probably have support in one way or another. The safe option is to keep your /boot directory in a partition formatted with Ext3.

You also need an updated e2fsprogs tool, of course, the latest stable version -1.41.3- is recommended.

Creating a new Ext4 filesystem from the scratch
The easiest one, recommended for new installations. Just update your e2fsprogs package to Ext4, and create the filesystem with mkfs.ext4.

Migrate existing Ext3 filesystems to Ext4
You need to use the tune2fs and fsck tools in the filesystem, and that filesystem needs to be unmounted. Run:

tune2fs -O extents,uninit_bg,dir_index /dev/yourfilesystem

After running this command you MUST run fsck. If you don't do it, Ext4 WILL NOT MOUNT your filesystem. This fsck run is needed to return the filesystem to a consistent state. It WILL tell you that it finds checksum errors in the group descriptors - it's expected, and it's exactly what it needs to be rebuilt to be able to mount it as Ext4, so don't get surprised by them. Since each time it finds one of those errors it asks you what to do, always say YES. If you don't want to be asked, add the "-p" parameter to the fsck command, it means "automatic repair":

fsck -pf /dev/yourfilesystem

There's another thing that must be mentioned. All your existing files will continue using the old indirect mapping to map all the blocks of data. The online defrag tool will be able to migrate each one of those files to a extent format (using a ioctl that tells the filesystem to rewrite the file with the extent format; you can use it safely while you're using the filesystem normally)

Finally do not forget to modify /etc/fstab.

source:http://linuxpoison.blogspot.com/2009/01/135781757114385.html

tutorial - My Desktop - OpenSuSe 11.1

source:http://linuxpoison.blogspot.com/2009/01/13578175714758.html

tutorial - How to secure PHP with Suhosin

Suhosin is an advanced protection system for PHP installations. It was designed to protect servers and users from known and unknown flaws in PHP applications and the PHP core. Suhosin comes in two independent parts, that can be used separately or in combination. The first part is a small patch against the PHP core, that implements a few low-level protections against bufferoverflows or format string vulnerabilities and the second part is a powerful PHP extension that implements all the other protections.

Features:

Engine Protection (only with patch)
Protects the internal memory manager against bufferoverflows with Canary and SafeUnlink Protection
Protects Destructors of Zend Hashtables
Protects Destructors of Zend Linked-Lists
Protects the PHP core and extensions against format string vulnerabilities
Protects against errors in certain libc realpath() implementations

Misc Features
Protection Simulation mode
Adds the functions sha256() and sha256_file() to the PHP core
Adds support for CRYPT_BLOWFISH to crypt() on all platforms
Transparent protection of open phpinfo() pages
EXPERIMENTAL SQL database user protection

Runtime Protection
Transparent Cookie Encryption
Protects against different kinds of (Remote-)Include Vulnerabilities
disallows Remote URL inclusion (optional: black-/whitelisting)
disallows inclusiong of uploaded files
optionally stops directory traversal attacks
Allows disabling the preg_replace() /e modifier
Allows disabling eval()
Protects against infinite recursion through a configureabel maximum execution depth
Supports per Virtual Host / Directory configureable function black- and whitelists
Supports a separated function black- and whitelist for evaluated code
Protects against HTTP Response Splitting Vulnerabilities
Protects against scripts manipulating the memory_limit
Protects PHP‘s superglobals against extract() and import_request_vars()
Adds protection against newline attacks to mail()
Adds protection against \0 attack on preg_replace()

Session Protection
Transparent encryption of session data
Transparent session hijacking protection
Protection against overlong session identifiers
Protection against malicious chars in session identifiers

Filtering Features
Filters ASCIIZ characters from user input
Ignores GET, POST, COOKIE variables with the following names:
GLOBALS, _COOKIE, _ENV, _FILES, _GET, _POST, _REQUEST
_SERVER, _SESSION, HTTP_COOKIE_VARS, HTTP_ENV_VARS
HTTP_GET_VARS, HTTP_POST_VARS, HTTP_POST_FILES
HTTP_RAW_POST_DATA, HTTP_SERVER_VARS, HTTP_SESSION_VARS
Allows enforcing limits on REQUEST variables or separated by type (GET, POST, COOKIE)
Supports a number of variables per request limit
Supports a maximum length of variable names [with and without indicies]
Supports a maximum length of array indicies
Supports a maximum length of variable values
Supports a maximum depth of arrays
Allows only a configureable number of uploaded files
Supports verification of uploaded files through an external script
Supports automatic banning of uploaded ELF executables
Supports automatic banning of uploaded binary files
Supports automatic stripping of binary content in uploaded files
Configureable action on violation
just block violating variables
send HTTP response code
redirect the browser
execute another PHP script

Logging Features
Supports multiple log devices (syslog, SAPI module error log, external logging script)
Supports freely configureable syslog facility and priority
Supports log device separated selection of alert types to log
Alerts contain filename and linenumber that triggered it
Alerts contain the IP address of the user triggering it
The IP Address can also be extracted from X-Forwarded-For HTTP headers (f.e. for reverse proxy setups)

Installation and Configuration

# cd / tmp
# wget http://download.suhosin.org/suhosin-0.9.27.tgz
# tar xzf suhosin-0.9.23.tgz
# cd suhosin-0.9.23
# ./configure
# make
# make install

The next step is to enable the module in php.ini, editing /etc/php5/apache2/php.ini and adding this line:

extension = suhosin.so

Now just restart Apache and suhosin begin to do it's dirty work:)
For more detail configuration, check here

source:http://linuxpoison.blogspot.com/2009/01/13578175715980.html

tutorial - openSUSE Network Installation/Upgrade Without CD/DVD

Installing or upgrading the opensuse is fairly easy using CD, or net boot CD but many times it happen the we need to install or upgrade the OS using these media, to solve this problem we got a script called setupgrubfornfsinstall

setupgrubfornfsinstall is a dialog based shell script to prepare remote network installations. The script downloads kernel and initrd of the distribution and creates a boot loader entry for them.

Features:
browse installation sources offered via SLP in your LAN
browse nfs exports (special config file needed then)
support for nfs, ftp and http
install openSUSE from download.opensuse.org
install Fedora from download.fedora.redhat.com
supports both grub and lilo (the latter mostly untested nowadays though)
qemu/kvm support, just run setupgrubfornfsinstall with option —qemu.
supports ssh/vnc installation parameters (SUSE only)

1) Preparing network installation source. use http installation source by mount openSUSE ISO image into apache root folder directory (/srv/www/htdocs/11.1) so, in this case URL becomes - http://172.19.12.36/11.1

2) Download the script, rename it to setupgrubfornfsinstall.sh , make it executable
# chmod +x setupgrubfornfsinstall.sh

3) execute the script
# ./setupgrubfornfsinstall.sh and follow the instruction

4) Choose either x86 or x86_64 architecture.

5) Choose installation source

6) Specify the URL for you Apache where we have set-up the installation folder

7) Select the proper resolution for installation

And after few more wizard, reboot your computer and choose network installation from GRUB menu and it will start the installation from the specified URL.

source:http://linuxpoison.blogspot.com/2009/01/135781757117113.html

tutorial - Website downloader for Linux - HTTrack

HTTrack is a free (GPL, free / free software) and easy-to-use offline browser utility.

It allows you to download a World Wide Web site from the Internet to a local directory, building recursively all directories, getting HTML, images, and other files from the server to your computer. HTTrack arranges the original site's relative link-structure. Simply open a page of the "mirrored" website in your browser, and you can browse the site from link to link, as if you were viewing it online. HTTrack can also update an existing mirrored site, and resume interrupted downloads. HTTrack is fully configurable, and has an integrated help system.

HTTrack uses a web crawler to download a website. Some parts of the website may not be downloaded by default due to the robots exclusion protocol unless disabled during the program. HTTrack can follow links that are generated with basic JavaScript and inside Applets or Flash, but not complex links (generated using functions or expressions) or server-side image maps.

OpenSuse user can use "1 click" installaer to install HTTrack - here
Fedora user can install - yum install httrack
Others can download the source code

This video demonstrates the power of HTTrack ...

source:http://linuxpoison.blogspot.com/2009/01/135781757114746.html

tutorial - Write your own kernel module and insert it into running kernel

So, you want to write a kernel module. You know C, you've written a few normal programs to run as processes, and now you want to get to where the real action is, to where a single wild pointer can wipe out your file system and a core dump means a reboot.

kernel Modules are pieces of code that can be loaded and unloaded into the kernel upon demand. They extend the functionality of the kernel without the need to reboot the system. For example, one type of module is the device driver, which allows the kernel to access hardware connected to the system.

1) Check if you have all the required tools and lib (Linux Kernel headers)for building the kernel modules for this you need - kernel-headers, you can check if it's install or not by using command: # rpm -qa | grep kernel-headers, if installed, Typing the following command ...

# ls -d /lib/modules/$(uname -r)/build
Output (OpenSuse 11.1) : /lib/modules/2.6.27.7-9-pae/build

else install the kernel-header from your installation CD/DVD

2) Now, start with the famous "hello World" program, create c file call - hello.c

/*************************************************************/
#include <linux/module.h>
#include <linux/kernel.h>

int init_module(void)
{
    printk(KERN_INFO "Hello world.\n");
    return 0;
}
void cleanup_module(void)
{
    printk(KERN_INFO "Goodbye world\n");
}

/*************************************************************/

3) Create the make file: vi Makefile

obj-m += hello.o
all:
make -C /lib/modules/$(shell uname -r)/build M=$(PWD) modules
clean:
make -C /lib/modules/$(shell uname -r)/build M=$(PWD) clean

save and close

4) Now compile the module to create - hello.ko using command : # make and you should see something like ...

make -C /lib/modules/2.6.27.7-9-pae/build M=/root/kernel modules
make[1]: Entering directory `/usr/src/linux-2.6.27.7-9-obj/i386/pae'
make -C ../../../linux-2.6.27.7-9 O=/usr/src/linux-2.6.27.7-9-obj/i386/pae/. modules
CC [M] /root/kernel/hello.o
Building modules, stage 2.
MODPOST 1 modules
CC /root/kernel/hello.mod.o
LD [M] /root/kernel/hello.ko
make[1]: Leaving directory `/usr/src/linux-2.6.27.7-9-obj/i386/pae'

you should see lot of news files get created inside the directory, check it "ls" command

5) Load/insert our kernel module into the running kernel (hello.ko) using command: # insmod hello.ko

6) Now let check the information about our module (hello.ko) using command:
# modinfo hello.ko, you should see something like ...

filename:       hello.ko
srcversion:     A59CC2D814343F3CA40CADF
depends:        built-in
vermagic:       2.6.27.7-9-pae SMP mod_unload modversions 586

7) To list the module currently running inside the kernel : # lsmod

8) To remove the "hello.ko" module: # rmmod hello.ko

9) Check the output of our module by looking at the /var/log/message file, you should find the entries like ..

Jan 11 12:31:48 poison kernel: Hello world.
Jan 11 12:32:26 poison kernel: Goodbye world

source:http://linuxpoison.blogspot.com/2009/01/13578175712252.html

tutorial - How to change DMA settings on Ubuntu

One really common solution to slow, and unreliable playback of DVD is the settings related to DMA which is turn "off" by default.

DMA stands for: Direct Memory Access. DMA allows a piece of hardware to talk directly with the RAM, reading and/or writing independent of the CPU (Central Processing Unit). In other words the hardware can use the system memory, bypassing the CPU, allowing the device to read and write much faster.

By default Ubuntu has DMA turned off (set to 0), this can be changed in the /etc/hdparm.conf file, like so:

1. First make a backup of your hdpram file: