Cafehack Group

PAC Manager - Trình quản lý terminal trên linux tốt nhất.

2013-06-23T09:43:00.003-07:00

1. Giới thiệu:

Đối vơí một system admin, thông thường sử dụng một số tools sau:
- Terminator để quản lý ssh hoặc thâm chí dùng các terminal mặc định trên Linux/Unix.
- Remmina hoặc gtk-rdp để remote vào các máy chủ Windows qua RDP.
- Filezilla hoặc truy cập trực tiếp từ file explorer như Nautilus.

Phải dùng khá nhiều tools và việc quản lý khá rắc rối, nhất là khi phải quản trị quá nhiều hệ thống. Rất may, David Torrejón Vaquerizas đã cho ta một công cụ rất tiện lợi, mạnh mẽ và nhiều tính năng nâng cao: PAC Manager.
Trong các phần sau đây, tôi sẽ lần lượt hướng dẫn các bạn cài đặt cũng như sử dụng các tính năng nâng cao của Pac Manager.

2. Cài đặt PAC Manager:

Việc cài đặt PAC Manager khá đơn giản. David Torrejón Vaquerizas cung cấp gói cài đặt dạng RPM và DEB cho các nền tảng Redhat và Debian. Ngoài ra, các bạn có thể tự biên dịch từ mã nguồn của PAC Manager.
Trang chủ của dự án: https://sites.google.com/site/davidtv/
Trang sourceforge của dự án: http://sourceforge.net/projects/pacmanager/

3. Các chức năng chính:

Đây là các tính năng chính được trích dẫn từ trang chủ của PAC Manager:

PAC is a Perl/GTK Gnome replacement for SecureCRT/Putty/etc... It provides a GUI to configure SSH/Telnet connections: users, passwords, EXPECT regular expressions, macros, etc. You like 'SSHMenu'? If so, you must check this tool. Just let me know how do you feel about it!

Unique Linux application to impletement almost every SecureCRT's functionality.

Remote and local macros.

Remotely send commands with EXPECT regexp.

Cluster connections!! Connections on same cluster share keystrokes!!

Proxy support.

KeePassX support!

Serial/tty connection via cu/tip/remote-tty connections!!

RDP (via rdesktop) and VNC (via vncviewer) support!!

Pre/post connections local executions.

Line-send dealy capabilities.

TABS OR WINDOWS for connections!!

Quick access to configured connections via tray menu icon.

Wake-On-LAN features!

Many many more I just forgot, and many many more to come (ASA I find time!)

FREE (GNU GPLv3)

Trong đó, cá nhân tôi thấy có một số tính năng nâng cao tuyệt vời nhất:
- Tự động gửi character để giữ kết nối: tính năng đặc biệt hữu ích cho những ai đã từng phải chịu bực mình với tính trạng sau một thời gian thì bị đá văng ra do session timeout.
- Cho phép chạy script: khi đăng nhập/logout....và khi đang kết nối muốn chạy script nào đó chỉ việc right click và chọn script.
- Cluster Connections: tính năng cho phép bạn chạy lệnh gửi đến nhiều connections cùng lúc. Tính năng này đặc biệt hữu ích nếu bạn thường xuyên phải chạy một vài lệnh cho rất nhiều hệ thống.

How to add kernel module to RHEL/Centos to fix unsupport driver

2012-04-12T10:15:00.002-07:00

When you setup RHEL/Centos on Server, may be some driver is missing or not support.

One easy solution is rebuild ISO to add new module. This article may help you.

- Prerequires:

+ RHEL/Centos DVD (or ISO).

+ Kernel module.

- First: Build kernel module.

- Second: Mount DVD to disk and copy entire disk to new location.

mkdir ~/rebuild/ISO
mount /dev/cdrom ~/rebuild/ISO
rsync -a ~/rebuild/ISO ~/rebuild/BUILD

- Third: add module to initrd.img

Copy initrd.img to /tmp and move to this directory, then:

gzip -dc initrd.img > initrd.unc.img
cpio -id < initrd.unc.img
cd modules
zcat modules.cgz | cpio -idvm

Copy module to modules/2.6.18-128.el5/x86_64 ( in case i use 64bit) then repacked:

find 2.6.18-128.el5 | cpio -H newc -ov | gzip -9 -c - > modules.cgz
sync

Edit pci.ids, module-info and modules.dep (if necessary). Then create initrd.img:

cd ..
find . | cpio -H newc -ov | gzip -9 -c - > initrd.img

- Final: replace with your new initrd.img, and move to ~/build/BUILD to rebuild ISO

mkisofs -o ../custom.iso -b isolinux/isolinux.bin -c isolinux/boot.cat -no-emul- boot -boot- load-size 4 -boot-info-table -v -r -l -L -T -J -V "CUSTOM.X.X" .

Ten Commands Every Linux Developer Should Know

2011-11-17T19:58:00.000-08:00

A few simple utilities can make it easier to figure out and maintain other people's code.
This article presents a list of commands you should be able to find on any Linux installation. These are tools to help you improve your code and be more productive. The list comes from my own experience as a programmer and includes tools I've come to rely on repeatedly. Some tools help create code, some help debug code and some help reverse engineer code that's been dumped in your lap.

1. ctags
Those of you addicted to integrated development environments (IDEs) probably never heard of this tool, or if you did you probably think it's obsolete. But a tags-aware editor is a productive programming tool.

Tagging your code allows editors like vi and Emacs to treat your code like hypertext (Figure 1). Each object in your code becomes hyperlinked to its definition. For example, if you are browsing code in vi and want to know where the variable foo was defined, type :ta foo. If your cursor is pointing to the variable, simply use Ctrl-right bracket.

Figure 1. gvim at Work with Tags

The good news for the vi-impaired is ctags is not only for C and vi anymore. The GNU version of ctags produces tags that can be used with Emacs and many other editors that recognize tag files. In addition, ctags recognizes many languages other than C and C++, including Perl and Python, and even hardware design languages, such as Verilog. It even can produce a human-readable cross-reference that can be useful for understanding code and performing metrics. Even if you're not interested in using ctags in your editor, you might want to check out the human-readable cross-reference by typing ctags -x *.c*.

What I like about this tool is that you get useful information whether you input one file or one hundred files, unlike many IDEs that aren't useful unless they can see your entire application. It's not a program checker, so garbage in, garbage out (GIGO) rules apply.

2. strace
strace lets you decipher what's going on when you have no debugger nor the source code. One of my pet peeves is a program that doesn't start and doesn't tell you why. Perhaps a required file is missing or has the wrong permissions. strace can tell you what the program is doing right up to the point where it exits. It can tell you what system calls the program is using and whether they pass or fail. It even can follow forks.

strace often gives me answers much more quickly than a debugger, especially if the code is unfamiliar. On occasion, I have to debug code on a live system with no debugger. A quick run with strace sometimes can avoid patching the system or littering my code with printfs. Here is a trivial example of me as an unprivileged user trying to delete a protected file:

strace -o strace.out rm -f /etc/yp.conf
The output shows where things went wrong:

lstat64("/etc/yp.conf", {st_mode=S_IFREG|0644,
st_size=361, ...}) = 0
access("/etc/yp.conf", W_OK) = -1 EACCES
(Permission denied)
unlink("/etc/yp.conf") = -1 EACCES (Permission
denied)
strace also lets you attach to processes for just-in-time debugging. Suppose a process seems to be spending a lot of time doing nothing. A quick way to find out what is going on is to type strace -c -p mypid. After a second or two, press Ctrl-C and you might see a dump something like this:

% time seconds usecs/call calls errors syscall
------ ----------- ----------- --------- --------- ----------------
91.31 0.480456 3457 139 poll
6.66 0.035025 361 97 write
0.91 0.004794 16 304 futex
0.52 0.002741 14 203 read
0.31 0.001652 3 533 gettimeofday
0.26 0.001361 4 374 ioctl
0.01 0.000075 8 10 brk
0.01 0.000064 64 1 clone
0.00 0.000026 26 1 stat64
0.00 0.000007 7 1 uname
0.00 0.000005 5 1 sched_get_priority_max
0.00 0.000002 2 1 sched_get_priority_min
------ ----------- ----------- --------- --------- ----------------
100.00 0.526208 1665 total
In this case, it's spending most of its time in the poll system call—probably waiting on a socket.
3. fuser
The name is a mnemonic for file user and tells what processes have opened a given file. It also can send a signal to all those processes for you. Suppose you want to delete a file but can't because some program has it open and won't close it. Instead of rebooting, type fuser -k myfile. This sends a SIGTERM to every process that has myfile opened.

Perhaps you need to kill a process that forked itself all over the place, intentionally or otherwise. An unenlightened programmer might type something like ps | grep myprogram. This inevitably would be followed by several cut-and-paste operations with the mouse. An easier way is to type fuser -k ./myprogram, where myprogram is the pathname of the executable. fuser typically is located in /sbin, which generally is reserved for system administrative tools. You can add /usr/sbin and /sbin to the end of your $PATH.

4. ps
ps is used to find process status, but many people don't realize it also can be a powerful debugging tool. To get at these features, use the -o option, which lets you access many details of your processes, including CPU usage, virtual memory usage, current state and much more. Many of these options are defined in the POSIX standard, so they work across platforms.

To look at your running commands by pid and process state, type ps -e -o pid,state,cmd. The output looks like this:

4576 S /opt/OpenOffice.org1.1.0/program/soffice.bin -writer
4618 D dd if /dev/cdrom of /dev/null
4619 S bash
4645 R ps -e -o pid,state,cmd
Here you can see my dd command is in an uninterruptible sleep (state D). Basically, it is blocking while waiting for /dev/cdrom. My OpenOffice.org writer is sleeping (state S) while I type my example, and my ps command is running (state R).

For an idea of how a running program is performing, type:

ps -o start,time,etime -p mypid
This shows the basic output from the time command, discussed later, except you don't have to wait until your program is finished.

Most of the information that ps produces is available from the /proc filesystem, but if you are writing a script, using ps is more portable. You never know when a minor kernel rev will break all of your scripts that are mining the /proc filesystem. Use ps instead.

5. time
The time command is useful for understanding your code's performance. The most basic output consists of real, user and system time. Intuitively, real time is the amount of time between when the code started and when it exited. User time and system time are the amount of time spent executing application code versus kernel code, respectively.

Two flavors of the time command are available. The shell has a built-in version that tells you only scheduler information. A version in /usr/bin includes more information and allows you to format the output. You easily can override the built-in time command by preceding it with a backslash, as in the examples that follow.

A basic knowledge of the Linux scheduler is helpful in interpreting the output, but this tool also is helpful for learning how the scheduler works. For example, the real time of a process typically is larger than the sum of the user and system time. Time spent blocking in a system call does not count against the process, because the scheduler is free to schedule other processes during this time. The following sleep command takes one second to execute but takes no measurable system or user time:

\time -p sleep 1
real 1.03
user 0.00
sys 0.00
The next example shows how a task can spend all of its time in user space. Here, Perl calls the log() function in a loop, which requires nothing from the kernel:

\time perl -e 'log(2.0) foreach(0..0x100000)'
real 0.40
user 0.20
sys 0.00
This example shows a process using a lot of memory:

\time perl -e '$x = 'a' x 0x1000000'

0.06user 0.12system 0:00.22elapsed 81%CPU
(0avgtext+0avgdata 0maxresident)k
0inputs+0outputs (309major+8235minor)pagefaults
0swaps
The useful information here is listed as pagefaults. Although the GNU time command advertises a lot of information, the 2.4 series of the Linux kernel stores only major and minor page-fault information. A major page fault is one that requires I/O; a minor page fault does not.

6. nm
This command allows you to retrieve information on symbol names inside an object file or executable file. By default, the output gives you a symbol name and its virtual address. What good is that? Suppose you are compiling code and the compiler complains that you have an unresolved symbol _foo. You search all of your source code and cannot find anywhere where you use this symbol. Perhaps it got pulled in from some template or a macro buried in one of the dozens of include files that compiled along with your code. The command:

nm -guA *.o | grep foo
shows all the modules that refer to foo. If you want to find out what library defines foo, simply use:

nm -gA /usr/lib/* | grep foo
The nm command also understands how to demangle C++ names, which can be handy when mixing C and C++. For example, forgetting to declare a C function with extern"C" produces a link time error something like this:

undefined reference to `cfunc(char*)'
In a large project with poorly defined headers, you might have a hard time tracking down the offending module. In this case, you can look for all the unresolved symbols in each object file with demangling turned on as follows:

nm -guC *.o
extern-c.o:cfunc
no-extern-c.o:cfunc(char*)
The first module is correct; the second is not.

7. strings
This command looks for ASCII strings embedded in binary files. It can be used for good or for evil. The good uses include trying to figure out what library is producing that cryptic string on stdout every once in a while, for example:

strings -f /usr/lib/lib* | grep "cryptic message"
On the evil side, the character strings can be used to probe your format strings looking for clues and vulnerabilities. This is why you should never put passwords and logins in your programs. It might be wise to examine your own programs with this tool and see what a clever programmer can see. The version of strings that comes with the GNU binutils has many useful options.

8. od, xxd
These two commands do basically the same thing, but each offers slightly different features. od is used to convert a binary file to whatever format you like. When dealing with programs that generate raw binary files, od can be indispensable. Although the name stands for octal dump, it can dump data in decimal and hexadecimal as well. od dumps integers, IEEE floats or plain bytes. When looking at multibyte integers or floats, the host byte order affects the output.

xxd also dumps binary files but does not try to interpret them as integers or floats, so the host byte order does not affect the output, which can be confusing or helpful depending on the file. Let's create a four-byte file on an Intel machine:

$ echo -n abcd > foo.bin
$ od -tx4 foo.bin
0000000 64636261
0000004

$ xxd -g4 foo.bin
0000000: 61626364 abcd
The output of od is a byte-swapped 32-bit integer, and the output of xxd is a group of four bytes in the same byte order as they appear in the file. If you're looking for the string abcd, xxd is the command for you. But, if you're looking for the 32-bit number 0x64636261, od is the right command.

xxd also knows a few cool tricks that od doesn't, including the ability to format the output in binary and to translate a binary file into a C array. Suppose you have a binary file that you want to encode inside an array in your C program. One way to do this is by creating a text file as follows:

$ xxd -i foo.bin

unsigned char foo_bin[] = {
0x61, 0x62, 0x63, 0x64
};

unsigned int foo_bin_len = 4;
9. file
UNIX and Linux have never enforced any policy of filename extensions. Naming conventions have evolved, but they are guidelines, not policies. If you want to name your digital picture image00.exe, go ahead. Your Linux photo application gladly accepts the file no matter what the name is, although it may be hard to remember.

The file command can help when you have to retrieve a file from a brain-dead Web browser, which mangles the name—say a file that should have been named foo.bar.hello.world.tar.gz comes out as foo.bar. The file command can help like this:

$ file foo.bar

foo.bar: gzip compressed data,
was "foo.bar.hello.world.tar", from Unix
Perhaps you received a distribution with a bin directory full of dozens of files, some of which are executables and some are scripts. Suppose you want to pick out all the shell scripts. Try this:

$ file /usr/sbin/* | grep script

/usr/sbin/makewhatis: a /bin/bash script text
executable

/usr/sbin/xconv.pl: a /usr/bin/perl script
text executable
The file command identifies all the files in the bin directory, and the grep command filters out everything not a script. Here are some more examples:

file core.4867

core.4867: ELF 32-bit LSB core file Intel 80386,
version 1 (SYSV), SVR4-style, from 'abort'

file /boot/initrd-2.4.20-6.img

/boot/initrd-2.4.20-6.img: gzip compressed data,
from Unix, max compression

file -z /boot/initrd-2.4.20-6.img

/boot/initrd-2.4.20-6.img: Linux rev 1.0 ext2
filesystem data (gzip compressed data, from Unix,
max compression)
Just as you shouldn't judge a book by its cover, you shouldn't assume the contents of a file based on its name.

10. objdump
This is a more advanced tool and is not for the faint of heart. It's sort of a data-mining tool for object files. A treasure trove of information is encoded inside your object code, and this tool lets you see it. One useful thing this tool can do is dump assembly code mixed with source lines, something gcc -S doesn't do for some reason. Your object code must be compiled with debug (-g) for this to work:

objdump --demangle --source myobject.o
objdump also can help extract binary data from a core file for postmortem debug when you don't have access to a debugger. A complete example is too long for this article, but you need the virtual address from nm or obdump -t. Then, you can dump the file offsets for each virtual address with objdump -x. Finally, objdump is able to read from non-ELF file formats that gdb and other tools can't touch.
Author: John Fusco

Performance Analysis of OpenVPN on a Consumer Grade Router

2011-10-08T03:15:00.000-07:00

Author: Michael Hall

Abstract:

Virtual Private Networks (VPNs) offer an alternative solution using Internet Protocol (IP) tunnels to create secure, encrypted communication between geographically distant networks using a common shared medium such as the Internet. They use tunneling to establish end-to-end connectivity. OpenVPN is a cross-platform, secure, highly configurable VPN solution. Security in OpenVPN is handled by the OpenSSL cryptographic library which provides strong security over a Secure Socket Layer (SSL) using standard algorithms such as Advanced Encryption Standard (AES), Blowfish, or Triple DES (3DES). The Linksys WRT54GL router is a consumer-grade router made by Linksys, a division of Cisco Systems, capable of running under Linux. The Linux-based DD-WRT open-source router firmware can run OpenVPN on the Linksys WRT54GL router. For this case study, the performance of OpenVPN is measured and analyzed using a 2^k-p fractional factorial design for 5 minus 1 factors where k = 5 and p = 1. The results show that the throughput is mainly limited by the encryption cipher used, and that the round-trip time (RTT) is mostly dependent on the transport protocol selected.

Keywords: Virtual Private Network, Performance Analysis, WRT54GL, DD-WRT, OpenVPN, OpenSSL, Experimental Design, Fractional Factorial Design

1 Introduction

In the past, enterprises have used leased lines over long distances for secure communication between two networks. Typically this is done in order to communicate data, voice, or other traffic between two geographically-separated sites of a company or with a valued business partner. Leased lines provide dedicated bandwidth and a private link between the two locations. Running leased lines are not always possible or practical for all enterprises and everyday users due to cost, space, and time of installation [Joha08]. Thus, an alternative solution is needed.

Virtual Private Networks (VPNs) were created to address this problem by using the Internet to facilitate communications. Internet access is cheap; however, it is insecure and often bandwidth limited. VPNs are designed to create secure, encrypted Internet Protocol (IP) tunnels to communicate between geographically-distant networks across the Internet. This solution is cost-effective for and available to companies and individuals alike and provides secure access to resources on the remote network.

For this case study, the performance of OpenVPN running under Linux on the Linksys WRT54GL router is analyzed. The sections that follow give background information on VPNs, and describe the VPN solution and router used in this case study.

1.1 Background

Tunneling is a method by which data is transferred across a network between two endpoints. VPNs use tunnels to establish end-to-end connectivity. A packet or frame destined to a remote network is first encapsulated by adding additional header information and is then sent across the network to the remote endpoint. At the endpoint, the header information is removed and the packet is sent out onto the remote network [Joha08]. This process is shown in Figure 1.

Figure 1: VPN tunnel between two endpoints across an network [Joha08]

There are tradeoffs to using a VPN solution compared to dedicated lines. A VPN offers benefits such as flexibility, transparency, security, and cost. However, it has some drawbacks such as availability and bandwidth [Kolesnikov02]. A VPN connection is very flexible because a user can connect to the remote network from anyplace with an Internet connection. Transparency is achieved through tunneling which allows arbitrary traffic to traverse the VPN. For VPNs, security is provided using authentication and encryption. Authentication restricts access to the network by allowing only authorized users to connect. Encryption provides privacy by scrambling the data in the tunnel. The cost of a VPN is much less than the cost of running dedicated lines, particularly if a freely available open source VPN solution is used. VPN solutions are typically deployed to provide access over the Internet which sometimes varies in the availability and bandwidth of the connection. In this case, dedicated lines provide a clear advantage. They are both highly available and provide guaranteed bandwidth.

In general, a VPN solution should take into consideration security, key distribution, scalability, transport protocol, interoperability, and cross-platform availability [Kolesnikov02]. Security is perhaps the biggest concern because there are so many ways to implement security incorrectly. Key distribution is related to security and has to do with the procedure by which keys are distributed to clients. If keys are distributed in an insecure manner, they can be intercepted, allowing an intruder to gain access to the private network. Scalability refers to how well a VPN solution scales in terms of the number of connections and sites. The transport protocol has an effect on the overhead and performance of the VPN tunnel which will be described in a later section. Interoperability refers to devices running the same VPN solution being able to work with each other. Simple, well thought out designs tend to be the more interoperable. Last, cross-platform availability allows the VPN solution to work with multiple operating system platforms.

In the next section, the VPN solution used in this case study which takes these points into consideration is described.

1.2 The VPN

OpenVPN is a cross-platform, secure, highly configurable VPN solution [OpenVPN]. It uses virtual interfaces provided by the universal Network TUNnel/TAP (TUN/TAP) driver and is implemented entirely in user-mode in the least privileged protection ring of the system. This decision was made to provide better security. If a vulnerability is found by an intruder, their access will be limited. However, this does affect performance due to multiple memory copies between kernel and user space. OpenVPN supports peer-to-peer and multi-client server configurations which makes many VPN topologies possible: host-host, host-network, and network-network. It supports creating a Layer 3 or Layer 2 VPN using TUN/TAP devices, respectfully [Feilner06].

Security in OpenVPN is handled by the OpenSSL cryptographic library [OpenSSL] which provides strong security over Secure Socket Layer (SSL) using standard algorithms such as Advanced Encryption Standard (AES), Blowfish, or Triple DES (3DES). Certificates are used for authentication, and symmetric and asymmetric ciphers for encryption. A cipher has several characteristic parameters: key length, block size, and mode. Key length dictates the strength of the cipher. The block size dictates how much data is encrypted in a block. The mode dictates how the encryption cipher is actually used. Other important factors are key distribution and the cryptographic strength of the cipher. OpenSSL uses symmetric and asymmetric ciphers as part of the overall security. However, the security is only as strong as the weakest link. Kolesnikov and Hatch give an example. If a 40-bit symmetric key and a 4096 bit asymmetric key are used for the ciphers, likely the 40-bit key will be the weakest link, making a 4096 bit asymmetric key unnecessarily large [Kolesnikov02].

In OpenSSL, block ciphers are used for symmetric encryption and can be used in different modes. OpenVPN uses a mode called Cipher Block Chaining (CBC) which makes the cipher text of the current block dependent on the cipher text of the previous block. This prevents an attacker from seeing patterns between blocks with identical plaintext messages and manipulating one or more of these blocks [Kolesnikov02].

The philosophy for judging the security of an encryption cipher is based on the test of time. A cipher that has stood scrutiny of the security community for many years with its details published is generally considered strong. If the cipher had any major flaws, they likely would have been found. Some of the criteria for selecting a cipher are security, performance, and availability. The cipher selected should meet security needs [Kolesnikov02].

The cross-platform support in OpenVPN allows it to be deployed to other systems including embedded routers. The router used in this case study is described next.

1.3 The Router

The Linksys WRT54GL router is a consumer-grade router made by Linksys [Linksys], a division of Cisco Systems, capable of running under Linux. A Linux firmware actively being developed is DD-WRT [DD-WRT] which is based on the OpenWrt kernel [OpenWrt]. DD-WRT is released under the GNU General Public License (GPL) and provides an alternative to the stock firmware in the Linksys router. The firmware allows the router to take on many roles: Internet gateway, VPN gateway, firewall, wireless access point, dynamic Domain Name Service (DNS) client, etc. It has a friendly web interface and supports many features beyond the router's original capabilities. It supports OpenVPN through special firmware and can be extended from the console using packages. Console access is given by both Secure Shell (SSH) and Telnet. For basic and advanced configurations, tutorials are available [DD-WRT Tutorials].

OpenVPN, which is supported in the DD-WRT firmware [OpenVPN/DD-WRT wiki], can be used on the router in a variety of different ways. First, key management can be maintained on the router. This allows certificates to be generated for users from the console; however, due to a limited amount of flash memory available, this requires a modification to the Linksys router to add a SecureDigital/MultiMediaCard (SD/MMC) memory card. A tutorial on the OpenWrt wiki describes how to do this [MMC Tutorial]. Second, the VPN package can be configured in several different topologies such as host-network or network-network depending on whether users will connect to the VPN or will access the remote network using a site-to-site connection. Last, the VPN virtual interface can be bridged to the physical network interface, allowing Ethernet frames to traverse between clients and the private network.

VPNs provide a cost-effective alternative solution to leased lines and are able to create secure connections between two end-points. OpenVPN is a VPN solution which can run on an embedded router running Linux. The Linksys WRT54GL router can run Linux through a firmware upgrade to the DD-WRT firmware. In the next section, the characteristics of a VPN will be discussed as they relate to performance analysis.

2 VPN Characteristics

There are many characteristics of a VPN that affects the performance of the system. In the sections that follow, the transport protocol is discussed, a set of performance metrics are defined, and the system parameters are identified.

2.1 Transport Protocol

The transport protocol used for the VPN tunnel will have an impact on the performance of the VPN. If the Transport Control Protocol (TCP) is used, it will have an undesirable effect when TCP is used in the tunnel as well. This is called TCP stacking. TCP is a connection-oriented protocol that was not designed to be stacked. It assumes an unreliable medium and retransmits packets when a timeout occurs. TCP uses an adaptive timeout which exponentially increases to avoid an effect known as meltdown. The problem occurs when both TCP protocols timeout. This is the case when the base connection loses packets. TCP will queue a retransmission and increase the timeout, trying not to break the connection. The upper-layer protocol will queue retransmissions faster than the lower layer due to having a smaller timeout value. This causes the meltdown effect that TCP was originally trying to prevent. The User Datagram Protocol (UDP), a datagram carrier having the same characteristics as IP, should be used as the lower layer protocol [Titz01].

2.2 Performance Metrics

Network performance is measured using a set of performance criteria or metrics. For OpenVPN, the service provided is access to the private network. The response time, throughput, and utilization are used to characterize the performance of the VPN. In the case that errors occur, the probability of errors and time between errors should be measured [Jain91]. A list of selected performance metrics are below:

Overhead
Round-trip time
Jitter
TCP throughput
Router CPU utilization
Client CPU utilization
Probability of error
Time between errors
Link utilization

Every VPN packet incurs overhead from the encapsulation process. When a payload is sent through the VPN tunnel, headers/trailers of various protocols are added to the payload to form a routable packet. Additional overhead comes from encryption ciphers used to secure the tunnel. The effects of overhead can be alleviated by using compression to reduce the amount of data transmitted [Khanvilkar04].

The overhead in OpenVPN is a function of the interface, transport protocol, cryptographic algorithm, and compression. The fixed overhead added to each packet is 14 bytes from the frame header and 20 bytes from the IP header. The transport protocol, used to form the VPN tunnel, contributes 8 (32) bytes from the UDP (TCP) header. The cryptographic algorithm used to secure the tunnel will contribute to the overhead depending on the algorithm. Part of the overhead includes the hash from the medium access control (MAC) algorithm, such as MD5 (128-bits) or SHA-1 (160-bits), and zero padding for block encryption ciphers. Compression of uncompressible data adds at most one byte of overhead. Other minor contributions come from sequence numbers and timestamps that are included to defeat reply attacks [Khanvilkar04].

The round-trip time (RTT) is the time it takes for a packet to reach a remote host and return back and is related to the latency of the connection. Latency through a VPN tunnel is dependent on the machine hardware, the link speed, and the encapsulation time. Higher latencies in OpenVPN are caused by multiple copies between kernel and user space, and the compute-intensive operations of encryption and compression. Latency can be improved, generally, by using faster hardware and better algorithms [Khanvilkar04]. Jitter is the variation in the latency of packets received by a remote host. For applications with streaming connections, jitter can be alleviated by buffering the stream. However, this adds delay in the connection which is intolerable for some applications such as Voice over Internet Protocol (VoIP). Low latency and low jitter are better for these metrics.

Throughput is a measure of the amount of payload data that can be transmitted end-to-end through the VPN tunnel. It does not include the overhead incurred by protocol headers / trailers, and the VPN tunnel. Similar to the latency, the throughput is limited by the machine hardware and encapsulation time; although it can be improved by using faster hardware and better algorithms. Throughput is a critical performance metric which will limit the number of users whom the VPN can support. Thus, higher throughput is better.

The performance of a VPN solution is often limited by the CPU on one or both of the endpoints which must encapsulate, encode, transmit, receive, and decode packets. Monitoring the CPU utilization of each device allows us to identify the bottleneck in the network communication. For this metric, utilization in the middle of the range is better.

The link utilization is the ratio of the physical network interface throughput to the link speed. In this case, the throughput is the total throughput of all packets transmitted including overhead. This metric is not directly useful, however, it can be used indirectly through a calculation to gauge the efficiency of the packets transmitted through the VPN tunnel. Higher link utilization is better only when the throughput is also higher.

Errors can sometimes occur in network communication causing packets to be lost, corrupted, duplicated, or out of order. When an error occurs, it is important to know the probability of it happening again, and the time between errors. A related metric is packet loss which gives the percentage of packets that were lost or corrupted. No errors are ideal, but low error rate is acceptable.

2.3 System Parameters

The performance in OpenVPN is affected by many parameters ranging from the hardware to the configuration. A list of these parameters is below.

Network topology
Memory
Speed of the router CPU
Speed of the network
VPN topology
Interface
Transport Protocol
Encryption cipher
Encryption key size
Compression algorithm

The network topology will affect system performance. For example, a topology in which the client is located far from the OpenVPN server will have to contend with network traffic unlike a client that is directly connected. Hardware factors such as memory, speed of the router CPU, and speed of the network can all affect system performance. At least one of these three hardware factors will be a bottleneck in the system. The VPN topology, such as host-host, host-network, and network-network, will affect system performance. The choice of the interface, transport protocol, encryption cipher, key size, and compression algorithm will all affect system performance. This is due to additional overhead and compute-intensive operations.

The transport protocol, if it is TCP, for the VPN tunnel will have an impact on the network performance. UDP is a protocol which has the same characteristics as IP which will not suffer from meltdown caused by retransmissions. There are many metrics that are used to measure network performance. While not all of them are significant, each one should nonetheless be included in the performance analysis. There are many system parameters that affect the performance of the VPN. Only a subset of these parameters can be changed. For the performance analysis done in the next section, a set of factors were chosen and varied in a 2^k-p fractional factorial design.

3 Performance Analysis

There are three evaluation techniques that can be used for performance analysis: analytical modeling, simulation, and measurement. For assessing the performance of OpenVPN on the Linksys WRT54GL router, measurement was chosen. The performance can be measured and analyzed through a series of experiments using the experimental design method described by Jain called 2^k-p fractional factorial design [Jain91]. This method is intended to determine the effects and percent variation of the effects for each factor and their interactions. Confidence intervals can also be calculated to determine the significance of each effect. In the sections that follow, the measurement tools used and the experimental setup are described. The results of the study are then presented.

3.1 Measurement Tools

Assessing the performance of OpenVPN requires the use of several measurement tools for generating, measuring, and monitoring network traffic. The tools used in this case study are wireshark, iperf, ping, and sar. Of these four tools, wireshark, iperf, and ping are available for both Windows and Linux. Although Windows has a ping tool, it is limited and not sufficient for the latency and packet loss tests in this case study. The last tool, sar, is available only on Linux. A description of each tool is given below.

Wireshark, formally Ethereal, is a network protocol analyzer with a rich feature set for capturing and analyzing network traffic. It has deep inspection and filtering capabilities of hundreds of protocols, making it a valuable tool for monitoring network traffic [Wireshark]. In this case study, it was used to monitor VPN-encapsulated packets and normal packets.
Iperf is a network testing tool for creating and measuring TCP and UDP streams. It has options for controlling several network parameters including maximum segment size (MSS), buffer length, TCP window size, and TCP no delay (for disabling Nagle's Algorithm). The TCP test will generate traffic at full speed and measure the bandwidth between two endpoints. The UDP test will generate traffic at a given bandwidth and measure the jitter (variation in the latency) and packet loss between two endpoints [Iperf].
Ping is a network testing tool for measuring latency and packet loss between two endpoints using the Internet Control Message Protocol (ICMP). A large number of packets can be transmitted using a flood ping. A flood ping works by transmitting one packet at a time and waiting for a reply or timeout. If a timeout occurs, the packet is counted as lost.
Sar is a system activity collection and reporting tool found in the sysstat utilities package [SYSSTAT]. It is able to collect and report information on CPU and network interface activity over a period of time. This information can be collected in parallel with the TCP bandwidth, UDP jitter, and latency tests.

3.2 Experimental Setup

The goal of this case study is to evaluate the performance of OpenVPN on a consumer grade router running the DD-WRT firmware. The router is a Linksys WRT54GL v1.1 with 16 MB RAM, 4 MB flash memory, and a 200 MHz processor.

Figure 2: System definition for the study of OpenVPN on a consumer grade router

The system definition, shown in Figure 2, consists of two systems connected to a router in the middle. The first system is the OpenVPN client which needs to establish a VPN tunnel to access the internal private network. It is the first test endpoint for the performance tests. The router is the OpenVPN server which is the system under test (SUT) [Jain91]. The second system is a computer on the private network which is the second test endpoint. The specifications of these two test systems are shown in Table 1.

System	Description
Test endpoint 1 (test client)	Cento OS 5.2 Linux, AMD Athlon XP-M 2600+, 1.83 GHz, 2.0 GB of RAM, ASUS A7V880 motherboard, VIA KT880 chipset
Test endpoint 2 (test server)	Windows XP Professional, Service Pack 3, AMD Athlon XP 2000+ (Thoroughbred), 1.67 GHz, 768 MB of RAM, ASUS A7V8X-X motherboard, VIA KT400 chipset

Table 1: System specifications for test endpoints

To facilitate the testing process, a Python script, on test endpoint 1, is used to automatically run each test and collect data results which are saved in a log file. There are three tests that are run: TCP bandwidth test, UDP jitter test, and latency test. The TCP bandwidth test uses iperf to generate traffic from a workload, and to measure the bandwidth over multiple time intervals. Simultaneously, CPU and network activity are measured using sar over the same time intervals. The UDP jitter test also uses iperf to generate traffic from a workload, and measures the jitter and packet loss across the VPN tunnel. As with the TCP test, sar is used to measure CPU and network activity. The latency test uses ping to flood small packets to the remote host and to measure the return-trip time (RTT) and packet loss across the VPN tunnel. The RTT is related to the latency of the connection, and the packet loss can be used to get the probability of error.

Many of the system parameters were fixed to a single value for a reduction in the number of total experiments needed. Some parameters are determined by the hardware which cannot be changed such as memory, router CPU speed, and network speed. The other parameter values were chosen based on recommendations given in the OpenVPN documentation. These parameters are shown in Table 2.

Fixed Parameter	Value
Memory	16 MB RAM
Speed of router CPU	200 MHz
Speed of network	100 Mbps
Encryption key size	256-bit
Digest	SHA1
TLS cipher	DHE-RSA-AES256-SHA

Table 2: Parameters fixed in the experimental setup

In the fractional factorial design, five factors were chosen and are listed in Table 3.

	Factor	Level (-1)	Level (+1)
A	Interface	TAP (bridged)	TUN
B	Protocol	UDP	TCP
C	Cipher	None	AES-256
D	Compression	None	LZO
E	Workload	Text	Video

Table 3: Factors in fractional factorial design

OpenVPN supports creating tunnels using two devices: TUN and TAP. The primary distinction between these two is the layer at which they operate. TUN, which stands for Network TUNnel, operates at Layer 3 of the OSI model and will not transmit any Layer 2 protocols through the VPN. TAP, which stands for Network TAP, operates at Layer 2 of the OSI model. It is capable of sending Layer 2 protocols through the VPN, but needs a bridge between the virtual network interface controller (NIC) and the physical NIC. If bridging mode is not used, then additional routing table entries are needed to route packets between the client and remote network [OpenVPN HOWTO].

Two transport protocols supported by OpenVPN are UDP and TCP. The performance of the VPN depends on the protocol used. UDP is a datagram packet which has less overhead and shares the same characteristics of IP. TCP, however, is a connection-based protocol which assumes an unreliable medium. Consequently, it has more overhead, and will encounter adverse effects from packet loss as described in Section 2.1.

Many ciphers are available in OpenVPN which uses the OpenSSL cryptographic library. For this factor, a comparison is being done between no encryption, and encryption using the Advanced Encryption Standard (AES) algorithm. This algorithm is recommended by the National Institute of Standards and Technology (NIST) federal agency for secure communications [NIST].

In low-throughput links, compression is a way to increase the overall throughput. The throughput achieved, however, is dependent on the workload. For this study, the performance is tested both with and without compression and for different workloads. Two workloads were chosen: text, and video. The text workload consists of highly compressible RFC documents and the video workload consists of uncompressible MPEG video.

The 2^5-1 fractional factorial design for measuring the effects of each factor is shown in Table 4. The design is the equivalent of a 4 factor design, except that the ABCD interaction is replaced with factor E, the workload. The confounding effects for this design are shown in Table 5.

I	A	B	C	D	AB	AC	AD	BC	BD	CD	ABC	ABD	ACD	BCD	E
1	-1	-1	-1	-1	1	1	1	1	1	1	-1	-1	-1	-1	1
1	-1	-1	-1	1	1	1	-1	1	-1	-1	-1	1	1	1	-1
1	-1	-1	1	-1	1	-1	1	-1	1	-1	1	-1	1	1	-1
1	-1	-1	1	1	1	-1	-1	-1	-1	1	1	1	-1	-1	1
1	-1	1	-1	-1	-1	1	1	-1	-1	1	1	1	-1	1	-1
1	-1	1	-1	1	-1	1	-1	-1	1	-1	1	-1	1	-1	1
1	-1	1	1	-1	-1	-1	1	1	-1	-1	-1	1	1	-1	1
1	-1	1	1	1	-1	-1	-1	1	1	1	-1	-1	-1	1	-1
1	1	-1	-1	-1	-1	-1	-1	1	1	1	1	1	1	-1	-1
1	1	-1	-1	1	-1	-1	1	1	-1	-1	1	-1	-1	1	1
1	1	-1	1	-1	-1	1	-1	-1	1	-1	-1	1	-1	1	1
1	1	-1	1	1	-1	1	1	-1	-1	1	-1	-1	1	-1	-1
1	1	1	-1	-1	1	-1	-1	-1	-1	1	-1	-1	1	1	1
1	1	1	-1	1	1	-1	1	-1	1	-1	-1	1	-1	-1	-1
1	1	1	1	-1	1	1	-1	1	-1	-1	1	-1	-1	-1	-1
1	1	1	1	1	1	1	1	1	1	1	1	1	1	1	1

Table 4: 2^5-1 fractional factorial design; A = Interface, B = Protocol, C = Cipher, D = Compression, E = Workload

I	A	B	C	D	AB	AC	AD
ABCDE	BCDE	ACDE	ABDE	ABCE	CDE	BDE	BCE
BC	BD	CD	ABC	ABD	ACD	BCD	E
ADE	ACE	ABE	DE	CE	BE	AE	ABCD

Table 5: Confounding effects of 2^5-1 fractional factorial design

3.3 Experimental Results

The results of the 2^5-1 fractional factorial design are presented in the section below. There are a few general observations that I made while running these tests. First, the CPU utilization of the router was always at 100% during these tests. This indicates that the router was consistently the bottleneck. The CPU utilization of the router was not reported because there was no mechanism for obtaining this information automatically from the router. Second, the CPU utilization of the client machine was always low, indicating that it was never the bottleneck.

The overhead of the VPN tunnel can be estimated empirically using the network activity information gathered by sar during the TCP test. The overhead is simply the difference in the throughputs of the physical and virtual network interfaces divided by the number of packets per second transmitted. The equation is shown as follows:

For each experiment in the TCP test, traffic was generated from the client to the server and multiple metrics were measured: bandwidth, link utilization, and CPU utilization. The results shown in Table 6 are the mean value of 5 replications. These results show that the link was highly underutilized and that the client CPU was not a bottleneck in these experiments.

The overhead was estimated only for experiments that did not involve compression since compression reduces the packet size in the physical interface. The results show the smallest overhead of 51 bytes for the UDP protocol without encryption. This number is an estimate of the overhead due to the encapsulation of packets in the VPN tunnel. It does not show the overhead due to headers in the payload itself. For Layer 3 VPNs, which use the TUN interface, the payload does not contain any Layer 2 header information which reduces the overhead by 14 bytes.

The largest bandwidth of 8.87 Mbps is measured for the TAP interface with bridging using the UDP transport protocol for the tunnel and no encryption. The bandwidth is cut to less than half to 3.70 Mbps when encryption using AES 256-bit is enabled.

					TCP Tests
Interface	Protocol	Cipher	Comp	Workload	Overhead (Bytes)	BW (Mbps)	Link %	Client CPU %
TAP (br)	UDP	None	None	Video	51.0	8.87	1.20%	4.12%
TAP (br)	UDP	None	LZO	Text		8.02	0.70%	5.92%
TAP (br)	UDP	AES256	None	Text	100.0	3.64	0.51%	3.48%
TAP (br)	UDP	AES256	LZO	Video		3.70	0.52%	3.58%
TAP (br)	TCP	None	None	Text	76.5	6.17	0.85%	3.76%
TAP (br)	TCP	None	LZO	Video		6.27	0.87%	3.90%
TAP (br)	TCP	AES256	None	Video	127.5	3.26	0.47%	3.54%
TAP (br)	TCP	AES256	LZO	Text		3.83	0.36%	4.42%
TUN	UDP	None	None	Text	51.0	7.38	0.99%	3.30%
TUN	UDP	None	LZO	Video		7.32	0.98%	3.56%
TUN	UDP	AES256	None	Video	98.0	3.35	0.46%	3.16%
TUN	UDP	AES256	LZO	Text		3.66	0.33%	4.16%
TUN	TCP	None	None	Video	76.5	5.67	0.77%	3.28%
TUN	TCP	None	LZO	Text		6.11	0.53%	4.70%
TUN	TCP	AES256	None	Text	125.0	3.05	0.43%	3.30%
TUN	TCP	AES256	LZO	Video		3.00	0.42%	3.30%

Table 6: Client-to-server TCP test results for 2^5-1 fractional factorial design; the values shown are the mean of 5 replicatons

The UDP and latency test results are shown in Table 7. For both tests, the packet loss percentage is 0% indicating that no errors occurred in the VPN tunnel. The jitter measurement was done using large packets equal to the MTU size with a fixed UDP bandwidth of 1 Mbps. Although not shown, the jitter measurements were found to be sensitive to the UDP bandwidth and payload length, but not to the factors under test.

					UDP Tests		Latency Tests
Interface	Protocol	Cipher	Comp	Workload	Jitter (ms)	Loss %	RTT (ms)	Loss %	CPU %
TAP (br)	UDP	None	None	Video	6.2	0.00%	1.3	0.00%	7.02%
TAP (br)	UDP	None	LZO	Text	6.2	0.00%	1.3	0.00%	6.62%
TAP (br)	UDP	AES256	None	Text	6.3	0.00%	2.3	0.00%	5.22%
TAP (br)	UDP	AES256	LZO	Video	6.3	0.00%	2.2	0.00%	5.34%
TAP (br)	TCP	None	None	Text	6.5	0.00%	15.1	0.00%	0.40%
TAP (br)	TCP	None	LZO	Video	6.1	0.00%	12.7	0.00%	0.76%
TAP (br)	TCP	AES256	None	Video	6.3	0.00%	7.9	0.00%	2.34%
TAP (br)	TCP	AES256	LZO	Text	6.6	0.00%	14.9	0.00%	0.52%
TUN	UDP	None	None	Text	6.2	0.00%	1.9	0.00%	5.14%
TUN	UDP	None	LZO	Video	6.4	0.00%	1.9	0.00%	5.04%
TUN	UDP	AES256	None	Video	6.3	0.00%	2.8	0.00%	4.10%
TUN	UDP	AES256	LZO	Text	6.2	0.00%	2.8	0.00%	4.20%
TUN	TCP	None	None	Video	6.2	0.00%	8.4	0.00%	1.50%
TUN	TCP	None	LZO	Text	7.0	0.00%	15.1	0.00%	0.50%
TUN	TCP	AES256	None	Text	6.3	0.00%	11.2	0.00%	1.84%
TUN	TCP	AES256	LZO	Video	6.3	0.00%	10.5	0.00%	0.82%

Table 7: UDP and latency test results for 2^5-1 fractional factorial design; the values shown are the mean of 5 replications

Using the analysis technique described for a 2^k-p fractional factorial design, the effects and the percent variation were calculated [Jain91]. The percent variation of the effects is shown in Figure 3. 84% of the bandwidth is explained by encryption cipher (C). Another 8% is explained by the transport protocol (B). There is a small 4% interaction (BC) between the encryption cipher and the transport protocol of the bandwidth.

The jitter is not explained very well by the model and is relatively independent of the changes in the factors. The percent variation in the round-trip time (RTT) is 66% for the transport protocol. Another 3% is explained by the interaction (BE) between the transport protocol and the workload which is confounded with interaction ACD.

Figure 3: Variation of effects for 2^5-1 fractional factorial design

3.4 Future Work

The tests performed in the 2^k-p fractional factorial design should be extended to include server-to-client tests, and simultaneous bidirectional traffic tests. Although it is possible to get this information, it is not easy to do this in an automatic way, and will require extension of the test script. The design should also be extended to include other factors that will potentially affect the performance of the VPN such as payload length, encryption key size, encryption digest, TLS digest, etc. Using the results from the 2^k-p fractional factorial design, a one or two factor design should be done to analyze the effects of the most sensitive factors such as the transport protocol and encryption. The test bed can also be expanded for testing a site-to-site VPN topology involving two routers. Last, the effects of communication with multiple clients should also be tested.

In addition to these tests, the results should be verified using another evaluation technique such as analytical modeling. Some of the contributions of the overhead were modeled in this paper, but this work needs to be expanded to explain changes in performance as well. This will allow us to understand how each of these factors affects the performance and why.

4 Summary

The Linksys WRT54GL router is an inexpensive router that can easily be upgraded for extended functionality using an open-source Linux firmware called DD-WRT. This allows a VPN package such as OpenVPN to be set up to allow remote access to the internal network. OpenVPN is a flexible, cross-platform solution that is highly configurable and fairly easy to set up using available tutorials.

The performance of OpenVPN depends on the router hardware, and the configuration parameters. The throughput was found to be limited by the router CPU, and is not sufficient for fast connections such as 10/100 Mbps LANs. It is sufficient for slower connections such as most Internet connections. Measurements were presented for traffic generated from client to server. The encryption cipher was found to significantly reduce total throughput. For a configuration using the TAP interface with bridging, UDP transport protocol, AES256 cipher, and no compression, the throughput was 3.64 Mbps. 96% of the variation in the throughput was explained by the transport protocol, encryption cipher, and the interaction between the two; the encryption cipher explained the majority (84%) of the variation. The jitter in the latency was found to be relatively insensitive to the factors tested at around 6.3 ms. The round-trip time (RTT) was significantly larger for the TCP transport protocol explaining 66% of the variation. The next significant factor was the workload (3%), followed by the interaction between the workload and the encryption cipher (3%). This interaction is confounded with the interaction between the interface, cipher, and compression factors. For the same configuration above, the average RTT was 2.3 ms.

Although the encryption cipher accounted for the majority of the variation in the throughput, it is an important feature in VPNs. Future work is to investigate effects of different encryption algorithms with varying key sizes on the throughput that are still considered strong. One criterion for choosing an encryption algorithm is whether or not it is acceptable for use in ecommerce.

In conclusion, the Linksys WRT54GL router provides a cost-effective solution for setting up an OpenVPN server for remote access over the Internet. This solution is throughput-limited, but should be sufficient for most Internet connections. It is an appropriate solution for most home users and small businesses depending on their needs.

References

[DD-WRT] "DD-WRT :: News"; http://www.dd-wrt.com.
[DD-WRT Tutorials] "Tutorials - DD-WRT Wiki"; http://www.dd-wrt.com/wiki/index.php/Tutorials.
[Feilner06] M. Feilner, OpenVPN: Building and Integrating Virtual Private Networks, Packt Publishing, 2006.
[Jain91] R.K. Jain, The Art of Computer Systems Performance Analysis: Techniques for Experimental Design, Measurement, Simulation, and Modeling, Wiley, 1991.
[Joha08] A. Joha, F. Ben Shatwan, and M. Ashibani, "Remote Access VPNs Performance Comparison between Windows Server 2003 and Fedora Core 6," Home Networking, 2008, pp. 329-343; http://dx.doi.org/10.1007/978-0-387-77216-5_24.
[Iperf] "Iperf - Wikipedia, the free encyclopedia"; http://en.wikipedia.org/wiki/Iperf.
[Khanvilkar04] S. Khanvilkar and A. Khokhar, "Virtual private networks: an overview with performance evaluation," Communications Magazine, IEEE, vol. 42, 2004, pp. 146-154.
[Kolesnikov02] O. Kolesnikov and B. Hatch, Building Linux Virtual Private Networks (VPNs), Sams, 2002.
[Linksys] "Linksys - A Division of Cisco"; http://www.linksys.com.
[McGregor00] J. McGregor and R. Lee, "Performance impact of data compression on virtual private network transactions," Local Computer Networks, 2000. LCN 2000. Proceedings. 25th Annual IEEE Conference on, 2000, pp. 500-510.
[MMC Tutorial] "OpenWrtDocs/Customizing/Hardware/MMC - OpenWrt"; http://wiki.openwrt.org/OpenWrtDocs/Customizing/Hardware/MMC.
[NIST] "NIST.gov - Computer Security Division - Computer Security Resource Center"; http://csrc.nist.gov/groups/ST/toolkit/index.html.
[OpenSSL] "OpenSSL: The Open Source toolkit for SSL/TLS"; http://www.openssl.org.
[OpenWrt] "OpenWrt"; http://openwrt.org.
[OpenVPN] "Welcome to OpenVPN"; http://openvpn.net.
[OpenVPN/DD-WRT wiki] "OpenVPN - DD-WRT Wiki"; http://www.dd-wrt.com/wiki/index.php/OpenVPN.
[OpenVPN HOWTO] "OpenVPN 2.0 HOWTO," OpenVPN; http://openvpn.net/index.php/documentation/howto.html.
[SYSSTAT] "SYSSTAT"; http://pagesperso-orange.fr/sebastien.godard.
[Titz01] O. Titz, Why TCP Over TCP Is A Bad Idea, April, 2001; http://sites.inka.de/sites/bigred/devel/tcp-tcp.html.
[Tcpdump] JWS. "TCPDUMP Public Repository". Official Product Website. http://www.tcpdump.org. Website for Packet Capture / Sniffing tool.
[Wireshark] CACE Technologies. "Wireshark: The World's Most Popular Network Protocol Analyzer". Official Product Website. http://www.wireshark.org. Website for Packet Capture / Sniffing tool.

List of Acronyms

Acronym	Definition
3DES	Triple DES
AES	Advanced Encryption Standard
CBC	Cipher Block Chaining
CPU	Central Processing Unit
DES	Data Encryption Standard
DNS	Domain Name System
GPL	General Public License
ICMP	Internet Control Message Protocol
IP	Internet Protocol
LZO	Lempel-Ziv-Oberhumer
MAC	Medium Access Control
MMC	MultiMediaCard
MPEG	Moving Picture Experts Group
NIC	Network Interface Controller
NIST	National Institute of Standards and Technology
OSI	Open Systems Interconnection
RAM	Random Access Memory
RFC	Request for Comments
RTT	Round-Trip Time
SD	SecureDigital
SSL	Secure Socket Layer
SUT	System Under Test
TAP	Network TAP
TCP	Transport Control Protocol
TLS	Transport Layer Security
TUN	Network TUNnel
UDP	User Datagram Protocol
VoIP	Voice over Internet Protocol
VPN	Virtual Private Network

Memory Management in vSphere

2011-09-12T22:41:00.000-07:00

VMware vSphere is definitely the most efficient Hypervisor in managing the Hardware resources of the host like CPU,Memory,Storage and Network . Understanding how these resources are efficiently managed by the Hypervisor would help Virtualization Administrators efficiently plan and manage their environment . This post is to give a basic idea on various components involved and the memory management techniques employed by VMware vSphere 4.1 . This blog is based on the Memory Resource Mangement in vSphere 4.1 white paper by VMware . Please note that each Virtual machine’s target memory allocation is dynamic and is dependent on current load on the host and memory allocated to the Virtual machine along with its associated parameters like Shares , Reservation and Limits .

Below are certain terminologies commonly used in VMware ESX whose understanding would help administrators understand these techniques better

Host Physical memory - Amount of memory available on the host that is visible to the hypervisor.
Guest Physical memory -Amount of memory that is visible to a guest OS running inside a VM.
Consumed memory - This is the amount of host memory that has been allocated to a Virtual machine .
Active memory - This is the amount of guest memory that is actively used by the applications and guest OS .
Guest level paging -Transfer of Memory between the guest physical memory and guest swap . This is driven by the Guest OS.
Hypervisor Swapping – Transfer of memory between guest physical memory and host swap . This is driven by the hypervisor.
Guest virtual memory – Continuous virtual address space provided by the guest OS to its applications.
Shares – Entitles a VM to a fraction of available host physical memory, based on a proportional-share allocation policy.
Reservation – Guaranteed amount of minimum host physical memory the host reserves for a virtual machine .
Limit – Maximum amount of host physical memory allocated for a virtual machine . Default is unlimited .

Memory Management and Reclamation techniques :

Ever wondered how ESX is able to over commit memory to the Virtual machines . By over commit I mean that the total sum of memory allocated to Virtual machines running on a host is greater than the available physical memory on the host . There are various memory reclamation techniques employed by ESX to achieve this namely ,

TPS – Transparent Page sharing helps reclaim memory by removing redundant pages on the memory with identical content .
Ballooning – Memory is reclaimed by artificially increasing the memory pressure inside a VM .
Swapping : Hypervisor swapping help reclaim memory by swapping out guest memory onto swap created for every VM by hypervisor .
Memory Compression : Reclaims memory by compressing pages that needs to be swapped out into Compression cache created for every VM on the host physical memory .

Transparent Page sharing :

When multiple Virtual machines running in a host are running same guest OS or at times same guest OS and Application , we would see a lot of identical content on the memory . Instead of storing redundant content it is enough if we store a single identical copy on the host physical memory and allow multiple VM’s to access this identical copy . This is the basic mechanism behind please note that this operation is invisible to the Virtual Machine and is performed at the hypervisor level and therefore there is no chance of leakage of sensitive information between Virtual machines .

Redundant pages are identified by their content and hashing algorithm is used to identify the redundant content from the guest physical memory . ESX scans the guest physical memory content at a specified rate for sharing opportunities . TPS is always ” ON ” and has the least overhead .

Ballooning :

Remember I had mentioned earlier in my post that a VM’s target memory allocation is dynamic and ESX allocates memory on demand to the VM based on the various parameters like shares , reservation , limits and host memory . Let’s take for example a VM has consumed 2 GB of RAM during its peak operations but is currently running with 1 GB active memory only . Say if there is a memory crunch on the host running this VM , Although the VM is currently using 1 GB of RAM only it will not release the additional 1 GB that it has freed since the VM is isolated and is not aware of host memory shortage on the hypervisor . Ballooning makes the Guest OS aware of the low memory status of the host and help reclaim memory .

Ballooning is achieved using Balloon drivers which are loaded into Guest OS running inside Virtual machines using VMware Tools . These drivers load as a pseudo-device driver and communicates with the hypervisor using a private channel . When the host in need of physical memory , the host will set a target balloon size for the balloon driver and in turn the balloon driver will inflate inside the Guest OS by allocating guest physical pages within the VM . What will happen is the Guest OS will page out the contents from the host physical memory . Once this is completed the balloon driver notifies the hypervisor which can now safely reclaim the freed memory . Please note that If the virtual machine has plenty of free guest physical memory ( as described in the example above ) , inflating the balloon will induce no paging and will not impact guest performance. Guest OS has to make the decision on what pages needs to be paged out and hypervisor has no call on this .

Ballooning is employed when these is memory pressure on the host . Ballooning will offload host memory pressure onto the VM as VM will now use less physical memory on the host and more physical memory inside the guest . Ballooning is employed as the first technique to reclaim memory whenever the host is under memory pressure . Please note that TPS is always enabled .

Swapping :

A Swap file is created for every VM on startup and is deleted when the VM is powered off . The size of the swap file is directly proportional to the amount of RAM that has been allocated to the VM . Swapping is invoked when memory reclaim from TPS and Ballooning is not sufficient enough to reduce host memory pressure . When swapping is invoked hypervisor will swap out guest physical memory to the swap file that was created on the VM startup . This will free up host physical memory and reduce the memory pressure on the host . This is a guaranteed technique to reclaim a specific amount of physical memory in the quickest time possible among the three techniques but then considering the overhead involved this is the last resort that ESX will use to reclaim memory . Please note that the swap file that has been created by the hypervisor for each and every VM is on the disk and Hypervisor swapping and further access of these pages by the VM will make the VM responsiveness slow .

Memory Compression :

Remember when hypervisor swapping is invoked pages are swapped out from guest physical memory to swap file created on the disk by hypervisor which will have latency . Memory Compression tries to compress the pages that needs to be swapped in a compression cache that is allocated per VM on the host physical memory itself . When these pages needs to be accessed b y the VM they will be uncompressed and presented which will be faster than a disk access in case of swapping . Please note that ESX will not proactively compress guest pages when host swapping is not required .

The per-VM compression cache is accounted for by the VM’s guest memory usage, which means ESX will not allocate additional host physical memory to store the compressed pages. If the compression cache is full, one compressed page must be replaced in order to make room for a new compressed page. An age-based replacement policy is used to choose the target page. The target page will be decompressed and swapped out. ESX will not swap out compressed pages.In ESX 4.1, the default maximum compression cache size is conservatively set to 10% of configured VM memory size .

Memory States in ESX Server

There are four memory states that are maintained by the ESX Server

High – 6% Threshold of Total Host Memory
Soft – 4% Threshold of Total Host Memory
Hard – 2% Threshold of Total Host Memory
Low – 1% Threshold of Total Host Memory

Why are these States important ? What does these States denote ?

As mentioned earlier , TPS is enabled by default in the ESX Server . Host Memory free states in ESX Server determines when to invoke Ballooning and Swapping ( activates memory compression as well )

When the memory state is high , it indicates that the total amount of active memory used by the all VMs in a host is less than total host memory .This means that the host will not invoke ballooning or swapping as long as the state is high . This is valid only if limits are not set for the VM’s .

If host free memory drops towards the soft threshold, the hypervisor starts to reclaim memory using ballooning. Ballooning happens before free memory actually reaches the soft threshold because it takes time for the balloon driver to allocate and pin guest physical memory. Usually, the balloon driver is able to reclaim memory in a timely fashion so that the host free memory stays above the soft threshold.

If ballooning is not sufficient to reclaim memory or the host free memory drops towards the hard threshold, the hypervisor starts to use swapping in addition to using ballooning. During swapping, memory compression is activated as well. With host swapping and memory compression, the hypervisor should be able to quickly reclaim memory and bring the host memory state back to the soft state.

Note : In certain scenarios, host memory reclamation happens regardless of the current host free memory state. For example, even if host free memory is in the high state, memory reclamation is still mandatory when a virtual machine’s memory usage exceeds its specified memory limit. If this happens, the hypervisor will employ ballooning and, if necessary, swapping and memory compression to reclaim memory from the virtual machine until the virtual machine’s host memory usage falls back to its specified limit.

What are the benefits of these memory management techniques ?

Better Utilization of available Memory
Higher Consolidation Ratio

Wrote by Sudharsan

Bacula - Open Source network backup and restore solution

2011-05-16T21:31:00.000-07:00

1 . INTRODUCTION

Bacula is a set of Open Source, enterprise ready, computer programs that permit you (or the system administrator) to manage backup, recovery, and verification of computer data across a network of computers of different kinds. Bacula is relatively easy to use and efficient, while offering many advanced storage management features that make it easy to find and recover

lost or damaged files. In technical terms, it is an Open Source, enterprise ready, network based backup program.

2 . BACULA ARCHITECUTURE

BACULA DIRECTOR

The Bacula Director service is the program that supervises all the backup, restore, verify and archive operations. The system administrator uses the Bacula Director to schedule backups and to recover files. For more details see the Director Services Daemon Design Document in the Bacula Developer's Guide. The Director runs as a daemon (or service) in the background.

BACULA CONSOLE

The Bacula Console service is the program that allows the administrator or user to communicate with the Bacula Director Currently, the Bacula Console is available in three versions: text-based console interface, QT-based interface, and a wxWidgets graphical interface. The first and simplest is to run the Console program in a shell window (i.e. TTY interface). Most system

administrators will find this completely adequate. The second version is a GNOME GUI interface that is far from complete, but quite functional as it has most the capabilities of the shell Console. The third version is a wxWidgets GUI with an interactive file restore. It also has most of the capabilities of the shell console, allows command completion with tabulation, and gives you instant help about the command you are typing. For more details see the Bacula Console Design Document_ConsoleChapter.

BACULA FILE

The Bacula File service (also known as the Client program) i

s the software program that is installed on the machine to be backed up. It is specific to the operating system on which it runs and is responsible for providing the file attributes and data when requested by the Director. The File services are also responsible for the file system dependent part of restoring the file attributes and data during a recovery operation. For more details see the File Services Daemon Design Document in the Bacula Developer's Guide. This program runs as a daemon on the machine to be backed up. In addition to Unix/Linux File daemons, there is a Windows File daemon (normally distributed in binary format). The Windows File daemon runs on current Windows versions (NT, 2000, XP, 2003, and possibly Me and 98).

BACULA STORAGE

The Bacula Storage services consist of the software programs that perform the storage and recovery of the file attributes and data to the physical backup media or volumes. In other words, the Storage daemon is responsible for reading and writing your tapes (or other storage media, e.g. files). For more details see the Storage Services Daemon Design Document in the Bacula Developer's Guide. The Storage services runs as a daemon on the machine that has the backup device (usually a tape drive).

CATALOG

The Catalog services are comprised of the software programs respo

nsible for maintaining the file indexes and volume databases for all files backed up. The Catalog services permit the system administrator or user to quickly locate and restore any desired file. The Catalog services sets Bacula apart from simple backup programs like tar and bru, because the catalog maintains a record of all Volumes used, all Jobs run, and all Files saved, permitting efficient restoration and Volume management. Bacula currently supports three different databases, MySQL, PostgreSQL, and SQLite, one of which must be chosen when building Bacula.

The three SQL databases currently supported (MySQL, PostgreSQL or SQLite) provide quite a number of features, including rapid indexing, arbitrary queries, and security.

Although the Bacula project plans to support other major SQL databases, the current Bacula implementation interfaces only to MySQL, PostgreSQL and SQLite. For the technical and porting details see the Catalog Services Design Document in the developer's documented.

The packages for MySQL and PostgreSQL are available for several operating systems. Alternatively, installing from the source is quite easy, see the Installing and Configuring MySQLMySqlChapter chapter of this document for the details. For more information on MySQL, please see: www.mysql.comhttp://www.mysql.com. Or see the Installing an

d Configuring PostgreSQLPostgreSqlChapter chapter of this document for the details. For more information on PostgreSQL, please see: www.postgresql.orghttp://www.postgresql.org.

Configuring and building SQLite is even easier. For the details of configuring SQLite, please see the Installing and Configuring SQLiteSqlLiteChapter chapter of this document.

BACULA MONITOR

A Bacula Monitor service is the program that allows the administrator or user to watch current status of Bacula Directors, Bacula File Daemons and Bacula Storage Daemons. Currently, only a GTK+ version is available, which works with GNOME, KDE, or any windo

w manager that supports the FreeDesktop.org system tray standard.

To perform a successful save or restore, the following four daemons must be configured and running: the Director daemon, the File daemon, the Storage daemon, and the Catalog service (MySQL, PostgreSQL or SQLite).

ALSA Upgrade Script

2011-04-19T18:38:00.000-07:00

The script is not in line with Debian/Ubuntu rules for package handling. It just overwrites existing files.
You won't see any changes on the ALSA package-ids within Synaptic!

The script recognizes severe problems during the installation and will stop automatically. It shouldn't mess up your setup.
If the script stops with an error-message nothing should have been touched!

In the worst case scenario the -r restore option restores your old system status as good as possible. It'll reinstall kernel, kernel-headers and Alsa related packages.

Ubuntu upgrades/updates might overwrite your Alsa installation once in a while (e.g. Major upgrades, kernel-upgrades or ALSA-package upgrades).
You just need to rerun the upgrade-script using the -i option in this case (if you still have the compiled sources on the disk).

Short Alsa-Upgrade script install instructions:

1. download the script and save it somewhere
2. cd
3. tar xzvf AlsaUpgrade-1.0.24-2.tar.gz
4. chmod +x AlsaUpgrade-1.0.24-2.sh
5. sudo ./AlsaUpgrade-1.0.24-2.sh -d
6. sudo ./AlsaUpgrade-1.0.24-2.sh -c
7. sudo ./AlsaUpgrade-1.0.24-2.sh -i
8. sudo shutdown -r 0

Logging: I recommend to log all the upgrade steps, e.g.

script -a -c "./AlsaUpgrade-1.0.24-2.sh -d" /tmp/Alsa_1.0.24-2_upgrade_download.log

You'll find a log file /tmp/Alsa_1.0.24-2_upgrade_download.log as soon as the script is finished.
You need to run this procedure for every single step. Choose whatever logfile names.

Test and Troubleshooting

After reboot you can type:

cat /proc/asound/version

This will let you know if you're running the new version.

The easiest and most reliable test to verify if Alsa is working is "aplay" - the Alsa player application. If aplay won't work -- nothing else will work.

Make sure that all your channels are unmuted and volume is up!

Type in a terminal:
$ aplay -l
(This won't work on e.g. webcams with a microphone only. Here you need to do a $cat /proc/asound/cards to see if it is there"

If you see your soundcards, you're almost there.

To test your first (default-index 0 X=0) soundcard, type e.g.:
$ aplay -Dplughw:X,0 -fcd //.wav
or e.g.
$ speaker-test -Dplughw:X,0 -c2
replace the X with the index of your soundcard index , which you find out by typing "aplay -l" - look for "card X"

Multichannel you can test the following way:
1. Type $aplay -L to find out about your pcm device . e.g "surround51"
2. Type $speaker-test -D surround51 -c6
Note: If the channel mapping should be wrong you need to adjust it in .asoundrc
links :
alsa-info.tar : http://www.mediafire.com/?ryvemykblsc15jp
AlsaUpgrade-1.0.24-2.tar.gz : http://www.mediafire.com/?399o94by5u7bydx
HD-Audio-Models.txt : http://www.mediafire.com/?kcvfvtzedaf14hd

Source : ubuntuforum.org

Split / Cut a String

2011-04-18T00:54:00.000-07:00

Some people have trouble when cutting/split string in linux/unix. This article show some simple ways to cut/split string in shell:
Simple : use cut :
cut command only support cut strings with single character delemiter .
Advance: you can use ksh,perl,bash shell...
Example:
@string=blackcat.gatrong@gmail.com
and i want to cut tring gmail.com( to save blackcat.gatrong in somewhere...)
echo $string|cut -d'@' -f2

-d'@' : character dememiter is @
-f2 : cut part 2 ( here is gmail.com)

Example :
$str = "abc\@hotmail.com;xyz\@gmail.com;uvw\@yahoo.com";
I want to split to 3 individual email.

@arr = split(/;/, $str);
print "first: $arr[0]\n";
print "second: $arr[1]\n";
print "third: $arr[2]\n";

You can do the same thing with ksh :

#!/usr/bin/ksh

string="abc@hotmail.com;xyz@gmail.com;uvw@yahoo.com"

oIFS="$IFS"; IFS=';'
set -A str $string
IFS="$oIFS"

echo "strings count = ${#str[@]}"
echo "first : ${str[0]}";
echo "second: ${str[1]}";
echo "third : ${str[2]}";

With Bash shell :

string="abc@hotmail.com;xyz@gmail.com;uvw@yahoo.com"
var=$(echo $string | awk -F";" '{print $1,$2,$3}')
set -- $var
echo $1
echo $2
echo $3

HỊCH KHOA HỌC CÔNG NGHỆ

2011-04-06T21:26:00.000-07:00

Khoa học đại vương Trần Công Nghệ
Ta cùng các ngươi
Sinh ra phải thời bao cấp
Lớn lên gặp buổi thị trường.

Trông thấy:
Mỹ phóng Con thoi lên vũ trụ chín tầng
Nga lặn tàu ngầm xuống đại dương nghìn thước
Nhật đưa rô bốt na nô vào thám hiểm lòng người
Pháp dùng công nghệ gen chế ra cừu nhân tạo.

Thật khác nào:
Đem cổ tích biến thành hiện thực
Dùng đầu óc con người mà thay đổi thiên nhiên!
Ta thường tới bữa quên ăn, nửa đêm vỗ gối, ruột đau như cắt, nước mắt đầm đìa
Chỉ giận chưa thể đuổi kịp nước Nga, vượt qua nước Mỹ, mà vẫn chỉ hơn Lào, hao hao Băng la đét.
Dẫu cho trăm thân này phơi trên sao Hỏa, nghìn xác này bọc trong tàu ngầm nguyên tử, ta cũng cam lòng.

Các ngươi ở cùng ta,

Học vị đã cao, học hàm không thấp
Ăn thì chọn cá nước, chim trời
Mặc thì lựa May Mười, Việt Tiến
Chức nhỏ thì ta… quy hoạch
Lương ít thì có lộc nhiều.
Đi bộ A tít, Cam ry
Hàng không Elai, Xi pic.
Vào hội thảo thì cùng nhau tranh luận
Lúc tiệc tùng thì cùng nhau “dô dô”.
Lại còn đãi sỹ chiêu hiền
Giáo sư, tiến sỹ, thạc sỹ, cử nhân, ai cũng có phần, không nhiều thì ít.
Lại còn chính sách khuyến khoa
Doanh nghiệp, giáo viên, trí thức, nông dân nhận cúp, nhận bằng còn thêm tiền thưởng.

Thật là so với:
Thời Tam quốc bên Tàu, Lưu Bị đãi Khổng Minh,
Buổi hiện đại bên Nga, Pu tin dùng Mét vê đép,

Ta nào có kém gì?

Thế mà, nay các ngươi:
Nhìn khoa học chậm tiến mà không biết lo
Thấy công nghệ thụt lùi mà không biết thẹn
Giáo sư ư? Biết “Thần đèn” chuyển nhà mà chẳng chạnh lòng
Tiến sỹ a? Nghe “Hai lúa” chế tạo máy bay sao không tự ái?
Có người lấy nhậu nhẹt làm vui
Có kẻ lấy bạc cờ làm thích
Ham mát xa giống nghiện “u ét đê”
Ghét ngoại ngữ như chán phòng thí nghiệm
Chỉ lo kiếm dự án để mánh mánh mung mung
Không thích chọn đề tài mà nghiên nghiên cứu cứu
Ra nước ngoài toàn muốn đi chơi
Vào hội thảo chỉ lo ngủ gật
Bệnh háo danh lây tựa vi rút com pu tơ
Dịch thành tích nhiễm như cúm gà H5N1
Mua bằng giả để tiến sỹ, tiến sy
Đạo văn người mà giáo sư, giáo sãi.

Thử hỏi học hành như rứa, bằng cấp như rứa, thì mần răng hiểu được chuyện na niếc na nô?
Lại còn nhân cách đến vậy, đạo đức đến vậy, thì có ham gì bút bút nghiên nghiên.

Cho nên

“Tạp chí hay” mà bán chẳng ai mua
“Công nghệ tốt” mà không người áp dụng.
Đề tài đóng gáy cứng, chữ vàng, mọt kêu trong tủ sắt
Mô hình xây tường gạch, biển xanh, chó ị giữa đồng hoang.
Hội nhập chi, mà ngoại ngữ khi điếc, khi câm?
Toàn cầu chi, mà kiến thức khi mờ, khi tỏ?
Hiện đại hóa ư? vẫn bám đít con trâu
Công nghiệp hóa ư? toàn bán thô khoáng sản
Biển bạc ở đâu, để Vi na shin nổi nổi chìm chìm
Rừng vàng ở đâu, khi bô xít đen đen đỏ đỏ

Thật là:

“Dân gần trăm triệu ai người lớn
Nước bốn nghìn năm vẫn trẻ con”!

Nay nước ta:

Đổi mới đã lâu, hội nhập đã sâu
Nội lực cũng nhiều, đầu tư cũng mạnh
Khu vực có hòa bình, nước ta càng ổn định
Nhân tâm giàu nhiệt huyết, pháp luật rộng hành lang
Thách thức không ít, nhưng cơ hội là vàng!

Chỉ e:

Bệnh háo danh không mua nổi trí khôn
Dịch thành tích chẳng làm nên thương hiệu.
Giỏi mánh mung không lừa nổi đối tác nước ngoài
Tài cờ bạc không địch nổi hắc cơ quốc tế.
Cặp chân dài mà nghiêng ngả giáo sư
Phong bì mỏng cũng đảo điên tiến sỹ.

Hỡi ôi,

Biển bạc rừng vàng, mà nghìn năm vẫn mang ách đói nghèo
Tài giỏi thông minh, mà vạn kiếp chưa thoát vòng lạc hậu.

Nay ta bảo thật các ngươi:

Nên lấy việc đặt mồi lửa dưới ngòi pháo làm nguy;
Nên lấy điều để nghìn cân treo sợi tóc làm sợ
Phải xem đói nghèo là nỗi nhục quốc gia
Phải lấy lạc hậu là nỗi đau thời đại
Mà lo học tập chuyên môn
Mà lo luyện rèn nhân cách

Xê mi na khách đến như mưa
Vào thư viện người đông như hội
Già mẫu mực phanh thây Gan ruột, Tôn Thất Tùng chẳng phải là to
Trẻ xông pha mổ thịt Bổ đề, Ngô Bảo Châu chỉ là chuyện nhỏ

Được thế thì:

Kiếm giải thưởng “Phiu” cũng chẳng khó gì
Đoạt Nô ben không là chuyện lạ
Không chỉ các ngươi mở mặt mở mày, lên Lơ xút, xuống Rôn roi
Mà dân ta cũng hưng sản, hưng tâm, vào Vi la, ra Rì sọt.
Chẳng những tông miếu ta được hương khói nghìn thu
Mà tổ tiên các ngươi cũng được bốn mùa thờ cúng,
Chẳng những thân ta kiếp này thỏa chí,
Mà đến các ngươi, trăm đời sau còn để tiếng thơm.
Chẳng những tên tuổi ta không hề mai một,
Mà thương hiệu các ngươi cũng sử sách lưu truyền.
Trí tuệ Việt Nam thành danh, thành tiếng
Đất nước Việt Nam hóa hổ, hóa rồng

Lúc bấy giờ các ngươi không muốn nhận huân chương, phỏng có được không?
Nay ta chọn lọc tinh hoa bốn biển năm châu hợp thành một tuyển, gọi là Chiến lược
Nếu các ngươi biết chuyên tập sách này theo lời ta dạy bảo thì suốt đời là nhà khoa học chính danh.
Nhược bằng không tu thân tích trí, trái lời ta khuyên răn thì muôn kiếp là phường phàm phu tục tử.

Vì:

Lạc hậu, đói nghèo với ta là kẻ thù không đội trời chung
Mà các ngươi cứ điềm nhiên không muốn trừ hung, không lo rửa nhục
Chẳng khác nào quay mũi giáo mà đầu hàng, giơ tay không mà thua giặc.
Nếu vậy rồi đây khi nước Việt hóa hổ, hóa rồng, ta cùng các ngươi há còn mặt mũi nào đứng trong trời đất này nữa?

Cho nên mới thảo Hịch này
Xa gần nghiên cứu
Trên dưới đều theo!

Source : unkowns

Quick setup LemonPos

2011-04-04T20:49:00.000-07:00

Lemon —in short— is an open source Point of Sale software targeted for micro, small and medium businesses.

For compiling lemonpos, first make sure you have kde4 installed . Then you can start compiling :

cd trunk
mkdir build
cd build
cmake -DCMAKE_INSTALL_PREFIX=/opt/kde4 .. #here you put your path to kde4.
make
su
make install

When installing, you can see where it was installed, just in case you cant find a way to run lemon, write the location of the installation (the binary files are in /usr/bin or /usr/local/bin), also the menu entries are under something like “lost objects”.

copy the lemonrc file to your local .kde/share/config directory:
cp trunk/src/lemonrc /home/USER/.kde4/share/config/ #Replace USER with your username.

After compiling and installing lemonpos, you must proceed to the database creation before you can login and use lemonpos.

Things you will need:

* MySql Installed and ready to use.
* MySql’s root password
* The script to create the database, located in the database_resource folder from lemonpos code. If you are using lemon POS 0.6 version, the file is also installed on your /usr/share/apps/lemon/ or /usr/local/share/apps/lemon/ depending on your system and configuration. But if you use *ubuntu with lemon POS 0.5 version this file is missing for such version you can get it here

This task is very simple. All you have to do is to run the script as shown below:

cd trunk/database_resources
cat lemon_mysql.sql | mysql -u root -p

MySql will prompt for the password, type the mysql’s root password. If you dont know this, try searching the default password for your linux distribution.

If no errors are reported, you can start using lemonpos.

Now you can run lemonpos and squeeze. from your applications menu or by command. Note that if you run “lemon” and it is not found, maybe you installed at another location, try /usr/local/bin/lemon or /usr/local/bin/squeeze

Source: Lemon Pos Webblog

Fix apport problem when upgrade Ubuntu

2011-03-30T21:24:00.000-07:00

May be meet this report like :

Errors were encountered while processing:
apport
cups
apport-gtk

To fix this problem:

sudo update-rc.d -f apport remove
sudo gedit /etc/init.d/apport
- Add "exit 0" right after script declarations... turns out to be line 17 or 18.
sudo apt-get update
sudo apt-get --reinstall install apport

Solve "Monitor is unkown and messed up" problems

2011-03-09T18:03:00.000-08:00

Signs : messed up monitorresolution and "Unknown monitor" messages when open "Monitor Preferences"
Fix :
- Use cvt 1280 1024 60 command to generate modeline configuration for xrandr command after
The results looks like :

# 1280x1024 59.89 Hz (CVT 1.31M4) hsync: 63.67 kHz; pclk: 109.00 MHz
Modeline "1280x1024_60.00" 109.00 1280 1368 1496 1712 1024 1027 1034 1063 -hsync +vsync

Copy everything on the second line after “Modeline ” and then add that as a new mode :

xrandr --newmode "1280x1024_60.00" 109.00 1280 1368 1496 1712 1024 1027 1034 1063 -hsync +vsync"

then add mode to proper monitor:

xrandr —addmode VGA1 “1280x1024_60.00”

With VGA1 is VGA port (can replace with "default")
Now, open "Monitor Preferences" to change resolutions

The difference of copy_to_user/copy_from_user and put_user/get_user

2010-08-29T08:32:00.000-07:00

There is a little difference with read, data comes from user, so you have to import data from user space to kernel space (with copy_from_user or get_user)

The reason for copy_from_user or get_user is that Linux memory (on Intel architecture, it may be different under some other processors) is segmented. This means that a pointer, by itself, does not reference a unique location in memory, only a location in a memory segment, and you need to know which memory segment it is to be able to use it. There is one memory segment for the kernel, and one for each of the processes.

The only memory segment accessible to a process is its own, so when writing regular programs to run as processes, there's no need to worry about segments. When you write a kernel module, normally you want to access the kernel memory segment, which is handled automatically by the system. However, when the content of a memory buffer needs to be passed between the currently running process and the kernel, the kernel function receives a pointer to the memory buffer which is in the process segment. The put_user and get_user macros allow you to access that memory. These functions handle only one caracter, you can handle several caracters with copy_to_user and copy_from_user. As the buffer (in read or write function) is in kernel space, for write function you need to import data because it comes from user space, but not for the read function because data is already in kernel space.

Example. procfs2.c

/**
*  procfs2.c -  create a "file" in /proc
*
*/

#include  /* Specifically, a module */
#include  /* We're doing kernel work */
#include  /* Necessary because we use the proc fs */
#include  /* for copy_from_user */

#define PROCFS_MAX_SIZE  1024
#define PROCFS_NAME   "buffer1k"

/**
* This structure hold information about the /proc file
*
*/
static struct proc_dir_entry *Our_Proc_File;

/**
* The buffer used to store character for this module
*
*/
static char procfs_buffer[PROCFS_MAX_SIZE];

/**
* The size of the buffer
*
*/
static unsigned long procfs_buffer_size = 0;

/**
* This function is called then the /proc file is read
*
*/
int
procfile_read(char *buffer,
      char **buffer_location,
      off_t offset, int buffer_length, int *eof, void *data)
{
int ret;

printk(KERN_INFO "procfile_read (/proc/%s) called\n", PROCFS_NAME);

if (offset > 0) {
 /* we have finished to read, return 0 */
 ret  = 0;
} else {
 /* fill the buffer, return the buffer size */
 memcpy(buffer, procfs_buffer, procfs_buffer_size);
 ret = procfs_buffer_size;
}

return ret;
}

/**
* This function is called with the /proc file is written
*
*/
int procfile_write(struct file *file, const char *buffer, unsigned long count,
    void *data)
{
/* get buffer size */
procfs_buffer_size = count;
if (procfs_buffer_size > PROCFS_MAX_SIZE ) {
 procfs_buffer_size = PROCFS_MAX_SIZE;
}

/* write data to the buffer */
if ( copy_from_user(procfs_buffer, buffer, procfs_buffer_size) ) {
 return -EFAULT;
}

return procfs_buffer_size;
}

/**
*This function is called when the module is loaded
*
*/
int init_module()
{
/* create the /proc file */
Our_Proc_File = create_proc_entry(PROCFS_NAME, 0644, NULL);

if (Our_Proc_File == NULL) {
 remove_proc_entry(PROCFS_NAME, &proc_root);
 printk(KERN_ALERT "Error: Could not initialize /proc/%s\n",
  PROCFS_NAME);
 return -ENOMEM;
}

Our_Proc_File->read_proc  = procfile_read;
Our_Proc_File->write_proc = procfile_write;
Our_Proc_File->owner    = THIS_MODULE;
Our_Proc_File->mode    = S_IFREG | S_IRUGO;
Our_Proc_File->uid    = 0;
Our_Proc_File->gid    = 0;
Our_Proc_File->size    = 37;

printk(KERN_INFO "/proc/%s created\n", PROCFS_NAME);
return 0; /* everything is ok */
}

/**
*This function is called when the module is unloaded
*
*/
void cleanup_module()
{
remove_proc_entry(PROCFS_NAME, &proc_root);
printk(KERN_INFO "/proc/%s removed\n", PROCFS_NAME);
}

10 common network security design flaws

2010-01-23T12:35:00.000-08:00

Date: October 23rd, 2009
Author: Brien Posey

Solid planning and design can help reduce the potential for security breaches. Here are some security design missteps to watch out for.

Network security is arguably one of the most critical functions of IT - yet I frequently see organizations that have overlooked easily implemented security design practices. Here are a few common mistakes that could compromise your network defenses and put company assets at risk.

1: Set it and forget it

The first flaw I want to talk about is more a planning flaw than a design flaw. It involves what I like to think of as the “set it and forget it” mentality. This is what happens when organizations work hard to secure their networks without stopping to reevaluate their security plans again. The threats to security are constantly evolving, and your security architecture must evolve too. The best way to accomplish this is to reevaluate your security needs on a regular basis.

2: Opening more firewall ports than necessary

We all know that opening an excessive number of firewall ports is bad, but sometimes opening ports is unavoidable. For instance, take Microsoft Office Communications Server 2007 R2. If you are planning on providing external access, about a dozen ports must be opened. In addition, OCS 2007 R2 assigns a wide range of ports dynamically. So what’s a security administrator to do?

One of the best solutions is to make use of a reverse proxy (such as Microsoft’s ForeFront Threat Management Gateway). A reverse proxy sits between the Internet and the server that requires the various ports to be opened. While there is no getting around the need for open ports, a reverse proxy can intercept and filter requests and then pass them on to the server they’re intended for. This helps hide the server from the outside world and helps ensure that malicious requests do not reach the server.

3: Pulling double duty

With the economy in shambles, there is increasing pressure to make the most of existing server resources. So it might be tempting to host multiple applications or multiple application roles on a single server. While this practice is not necessarily bad, there’s a law of computing that states that as the size of the code base increases, so does the chance that an exploitable vulnerability exists.

It isn’t always practical to dedicate a server to each of your applications, but you should at least be careful about which applications or application roles are hosted on a single server. For example, at a minimum, an Exchange 2007 organization requires three server roles (hub transport, client access, and mailbox server). While you can host all three roles on a single server, you should avoid doing so if you are going to be providing Outlook Web Access to external users. The Client Access Server role makes use of IIS to host Outlook Web Access. Therefore, if you place the client access server role on the same server as your hub transport and mailbox server roles, you are essentially exposing your mailbox database to the Internet.

4: Ignoring network workstations

About a year ago, someone asked me during a radio interview what I thought was the single biggest threat to network security. My answer was, and still is, that workstations make up the single largest threat. I constantly see organizations that go to great lengths to secure their network servers but practically neglect their workstations. Unless workstations are locked down properly, users (or malicious Web sites) can install unauthorized software with untold consequences.

5: Failing to use SSL encryption where it counts

We all know that a Web site needs to use SSL encryption any time a user is going to be entering sensitive information, such as a username and password or a credit card number. However, many organizations make some bad decisions when it comes to securing their Web portals. The security flaw I see most often is including insecure content on a secure page. When this happens, users receive a prompt asking if they want to display both secure and insecure content. This gets users in the habit of giving Internet Explorer permission to provide insecure content.

A less obvious but even more common problem is that organizations often fail to encrypt critical pages within their Web sites. In my opinion, any page that provides security information, security advice, or contact information should be SSL encrypted. It isn’t that these pages are especially sensitive. It’s just that the certificate used by the encryption process guarantees to users that they are accessing a legitimate Web page rather than a page someone has set up as a part of a phishing scam.

6: Using self-signed certificates

Since some organizations completely neglect the importance of SSL encryption, Microsoft has begun to include self-signed certificates with some of its products. That way, Web interfaces can be used with SSL encryption even if the organization hasn’t acquired its own certificate yet.

While self-signed certificates are better than nothing, they are not a substitute for a valid SSL certificate from a trusted certificate authority. Self-signed certificates are primarily intended to help boost a product’s security until an administrator can properly secure it. Yes, a self-signed certificate can provide SSL encryption, but users will receive warning messages in their browsers because their computers do not trust the certificate (nor should they). Furthermore, some SSL-based Web services (such as ActiveSync) are not compatible with self-signed certificates because of the trust issue.

7: Excessive security logging

Although it’s important to log events that occur on your network, it’s also important not to go hog wild and perform excessive logging. Too much logging can make it difficult or impossible to locate the security events you’re really interested in. Rather than trying to log everything, focus on logging the events that are really meaningful.

8: Randomly grouping virtual servers

Virtual servers are commonly grouped on host servers by their performance. For example, a high demand virtual server might be paired on a host with a few low demand virtual servers. From a performance standpoint, this is a good idea, but this approach may not be the best idea from a security standpoint.

I recommend using dedicated virtualization hosts for any Internet-facing virtual servers. In other words, if you have three virtual servers that provide services to Internet users, you might consider grouping those servers on a virtualization host, but don’t put infrastructure servers (such as domain controllers) on the host.

My reasoning behind this is to provide protection against an escape attack. An escape attack is one in which a hacker can escape from a virtual machine and take control of the host. To the best of my knowledge, nobody has figured out a way to perform a real-world escape attack yet, but I’m sure that day is coming. When it does, your odds of prevailing against the attack are going to be a lot higher if virtual machines that are exposed to the Internet share a virtualization host only with similarly hardened Web-facing servers.

9: Placing member servers in the DMZ

If you can avoid it, try not to place any member servers in your DMZ. If compromised, a member server can reveal information about your Active Directory.

10: Depending on users to install updates

One last common security flaw is depending on users to deploy security patches. I have seen several network deployments recently that use WSUS to patch network workstations. Unfortunately, many of these deployments rely on the users to click the option to install the latest updates. The problem with this is that the users know that the update process is going to require them to reboot their computers. Some users may end up putting off the updates indefinitely. Rather than relying on the end users, use a patch management solution that pushes security patches automatically without giving users a choice in the matter.

C Programming Tips 1

2010-01-05T19:12:00.000-08:00

Here are some questions about C programming which I come across and answer very frequently on programming newsgroups. All of them can be used in C++ programs as well. You might find them helpful.

I need help with my homework!
Please don't void my main()!
What should my "int main()" return?
What should I use instead of gets()?
How do I input numbers as binary strings?
How do I output numbers as binary strings?

I need help with my homework!

If I posted a link to this page in reply to a message you posted on a programming newsgroup, it seemed to me that you were asking for someone to do your programming homework for you. Your post probably looked like one of the following:

You typed in your assignment word-for-word.

You complained that your instructor is stupid, but your instructor is smarter than you are, he or she already knows how to write this program!

You said you have tried and tried, but get nothing but errors, but you didn't include any of your code.

You said you do not have any idea where to start, and you didn't include any of your code.

Your post looked like a thinly disguised attempt into fooling somebody into thinking that it is not your homework.

You specifically asked for help, and not for someone to write the code, but you still didn't post any of the code you had written on your own. In this case, you still want to look at the suggestions below for the best way to get help.

First let me say that I apologize if I have misjudged you and you really aren't trying to get someone to do your homework for you.

But if you are...

The purpose of actually writing programs in a programming class is to learn how to write them. If you don't do the work, you will be cheating yourself out of the knowledge you are going to school for.

Most regular contributors to the programming newsgroups will not just write your program for you. Some of them will write a program with deliberate and subtle errors, in the hopes that you will turn it in as your own work and get caught for cheating.

Here are some of the replies I have posted in newsgroups to messages like yours. They are sarcastic, but don't worry, I will follow them with some suggestions on how to successfully get help with your homework.

If I did your homework for you, then you might pass your class without learning how to write a program like this. Then you might graduate and get your degree without learning how to write a program like this. You might become a professional programmer without knowing how to write a program like this. Someday you might work on a project with me without knowing how to write a program like this. Then I would have to do you serious bodily harm.

Please post your instructor's email address in case I have any questions about your assignment. In fact, I have a great idea. I could just email your assignment directly to your instructor and then you wouldn't even have to go to class either!

OK, I promised to give you advice on how to get useful help with your assignment in a programming newsgroup. The best results will come from following the steps below.

If you can't even figure out how to start, sit down with a pencil and paper and go work on the problem as a problem, not as a program. Take it one step at a time until you figure out how the actual operation needs to be done.

Try to write the program yourself. Give it your best effort, using everything you have learned so far.

If there is one particular part of the program which you just can't get to work right, perform the following steps.

Cut your program down to the smallest possible code sample which compiles and displays your problem. In the process of doing this many people find and fix the problem on their own!
If your program uses non-standard functions from non-standard headers with names like conio.h, dos.h, or bios.h, remove them from the program.
Do not attach your executable or source code to your message. Just copy the source code in your text editor and paste in into the body of your message as plain text.
Be sure to include the exact text of important error or warning messages which you get when trying to build your program.
Include the brand and version number of the compiler you are using and the operating system on your computer. If your compiler can make more than one type of program (many PC compilers can make programs for MS-DOS or Windows) then specify exactly what type you are trying to make.
Do not ask for an email reply. In the first place, it tends to annoy the people who can help you the most. In the second place, programming newsgroups are read by thousands of people worldwide. If your question is not important enough for you to take the time and effort to come back to the group in a few hours or a day to look for answers, it is certainly not important enough for you to waste the time and bandwidth of all those readers by posting it. Finally if someone posts an incorrect answer to your problem on the group, others will point out the error and correct it. If you get an answer by email, how will you know if it is right or not?
Do not post your question again if you do not see any replies in 15 minutes or an hour. Usenet groups do not work that fast. It could take up to a day (or more) before you get a reply.
It could be that you will not get a reply at all. It is possible that your question is outside the range of topics normally discussed on the group, and none of the people who see it are interested enough, or familiar enough with the subject, to post a reply.
This last one seems too obvious to mention, but the fact that I am mentioning it indicates that some people can't figure it out for themselves. Be polite in your post, and use proper spelling and grammar. You are asking for help from people who know more than you, at least about the problem you are having. If they don't know more than you, you are wasting your time asking them for help! Remember that nobody is paying these people to help you, they do it because they want to. Politeness and respect will make the most knowledgeable contributors more likely to help you.

If you follow the advice above, and if your question is really on topic in the group you posted it too, there is a good chance that you will receive several excellent replies to help you solve your problem.

Please don't void my main()!

A commonly asked question:

Why do people say that main() has to return an int and void main(void) is wrong? I think it is all right because:

I have a book by /* somebody */ and all of the example programs are written this way.
My instructor tells us to write it that way.
The examples in my online help show it that way.
It works on my compiler.

First let's talk about the items above.

Many books are written by people who don't even bother to actually learn their subject. They are good at writing books and think they know everything. Some of them test their code by compiling and running it with their favorite compiler, and never notice that they are using compiler specific extensions. Some authors have written books containing code which they just wrote off the top of their head. They never compiled and ran it because it would not compile with ANY compiler.
Sadly, many instructors of computer programming classes do not know the actual standard for the language themselves. What they know they learned from reading the same books written by careless authors described above. This kind of ignorance of their subject matter would not be allowed in a subject like mathematics, chemistry, or physics, but it is all too common in computer programming.
Microsoft is particularly bad at this. Almost all of the examples in their online help start with void main(void). Yet if you look up main in the online help, it displays a proper definition. The example programs in the online help for Borland compilers always show main() properly returning an int.
The standards for the C and C++ programming languages specifically allow compiler writers to include extensions. In addition, the usual tradition is for a compiler to process your program and generate an executable if at all possible, even if your source code is questionable. The International Standard for each programming language defines what the language is, not whatever any particular compiler happens to accept. Most C compilers have some type of option to compile in strict standard mode. Again Microsoft is one of the worst offenders here. There is no way that I know of to get their compilers to issue an error or even a warning message if you define a void main() function in your code.

Some computer languages are proprietary, that is they belong to a particular company, and that company has final authority to determine what the language is and isn't.

One example is Java. This language is a product of Sun Microsystems, and it defined by them. Any other company which uses the Java language signs a contract with Sun and agrees that their version will be 100% compatible with Sun's standard.

Another language is Microsoft's Visual Basic. This is a programming package that only they sell, and only for their Windows operating systems. Since this language is completely theirs, the definition of what the language is is completely theirs.

This is not the case with most general purpose programming languages, and this includes C and C++. Nobody owns these languages or their definitions. Instead the languages are defined by International Standards, which are generated and maintained by ISO, the International Standards Organization.

ANSI, which is the American National Standards Institute, is the American national standards body and is one of the member bodies of ISO. You may have heard the term ANSI C or ANSI C++. These terms are in common use because it was ANSI that issued the first standard for C. When the ISO International Standard was adopted, ANSI adopted the ISO version and it became the ANSI version as well. The current ANSI standards for C and C++ are the ISO International standards.

The ANSI/ISO standards for C and C++ define the languages, not Microsoft or Borland or any other compiler vendor. Here is what the standards have to say:

ANSI/ISO/IEC 9899:1990 International Standard For C

The function called at program startup is named main. The implementation declares no prototype for this function. It can be defined with no parameters:

int main(void) { /* ... */ }

or with two parameters (referred to here as argc and argv, though any names may be used, as they are local to the function in which they are declared):

int main(int argc, char *argv[ ]) { /* ... */ }

The newly ratified update to the C standard in 1999 will make this even clearer, perhaps because of all the clueless who could not understand that only the two formats above, both of which define main to return an int, are valid.

The draft of the new standard expands on the two definitions above by modifying the wording "It can be defined" to "It shall be defined with a return type of int".

ANSI/ISO/IEC 14882:1998 International Standard For C++

An implementation shall not predefine the main function. This function shall not be overloaded. It shall have a return type of type int but otherwise its type is implementation defined. All implementations shall allow both of the following definitions of main:

The two definitions which follow are identical to those in the C standard.

Practical Reasons To Return An int from main()

On many operating systems, the value returned by main() is used to return an exit status to the environment. On Unix, MS-DOS, and Windows systems, the low eight bits of the value returned by main() is passed to the command shell or calling program. This is often used to change the course of a program, batch file, or shell script.

Many compilers will refuse to compile a source code file containing a definition of main() which does not return an int.

On some platforms a program starting with void main() may crash on startup, or when it ends.

A program which contains a main() function that is not defined to return an int is just plain not real C or C++.

What should my "int main()" return?

As pointed out in the section above, it is extremely common for a program to return a result indication to the operating system. Some operating systems require a result code. And the return value from main(), or the equivalent value passed in a call to the exit() function, is translated by your compiler into an appropriate code.

There are three and only three completely standard and portable values to return from main() or pass to exit():

The plain old ordinary integer value 0.
The constant EXIT_SUCCESS defined in

If you use 0 or EXIT_SUCCESS your compiler's run time library is guaranteed to translate this into a result code which your operating system considers as successful.

If you use EXIT_FAILURE your compiler's run time library is guaranteed to translate this into a result code which your operating system considers as unsuccessful.

Note: Some operating systems, such as Unix, MS-DOS, and Windows, truncate the integer passed to exit() or returned from main() to an unsigned char and make this available to the shell script, batch file, or parent process which invoked the program. On these systems programmers sometimes use different positive numbers to indicate different reasons for the failure of the program to execute successfully. Such usage is not portable and may not work correctly on all implementations and operating systems. Only the values 0 and the constants EXIT_SUCCESS and EXIT_FAILURE are portable and guaranteed to work correctly on all hosted implementations.

C++ Note

In a C++ program you do not have to return anything from int main()! The language standard guarantees that if your int main() function "falls off the end" by reaching the closing brace, the compiler will automatically return 0 for you indicating success.

Warnings

It is not good programming practice to take advantage of this C++ feature. Programs should always specifically indicate a return status.

C++ does not provide this automatic return for any function except int main().

C does not provide an automatic return value for main() or any other function. It is up to the program to specify a return value or the status returned to the operating system is undefined.

What should I use instead of gets()?

You might have been told this in a C programming newsgroup already, but it is important enough that I will repeat it here:

Never, never, NEVER use the function gets(). It is the most dangerous function in the entire C standard library because there is there is no way to use it safely!

Consider this example:

#include  int main(void) {   char name [25];   printf("Enter your name: ");   fflush(stdout);   if (gets(name) != NULL)      printf("Hello and Goodbye %s\n", name);   return 0; }

What do you think will happen if the user types fifty characters into your twenty-five character array? What if the user types one hundred characters? Two hundred??

The answer is that gets() will fill up your array and then keep on going, trying to write to memory past the end of the array which your program does not have the right to access. A program crash is likely. Some notorious computer viruses have based their attack on deliberately overflowing buffers used by calling gets().

You might also have heard that you should use the fgets() function, with stdin as the FILE * parameter, instead of gets(). Most people stop after saying that, but that doesn't actually give you the same result. gets() removes the '\n' character from the input but fgets() does not. That means you must manually remove the '\n' before passing the string to fopen(), or for many other uses.

Here is my getsafe() function. Like gets() and fgets() both, it returns a pointer to char. This is either the pointer which was passed to it, or NULL if end of file or an error occurred. Like gets(), it removes the '\n' at the end of the string, if there is one. The prototype is:

char *getsafe(char *buffer, int count);

Here is the function:

#include  #include  char *getsafe(char *buffer, int count) {   char *result = buffer, *np;   if ((buffer == NULL) || (count < result =" NULL;" count ="=" result =" '\0';" result =" fgets(buffer," np =" strchr(buffer," np =" '\0';"> That's all it takes to safely get input strings from the standard input with the '\n' removed.
 How do I input numbers as binary strings?
 The first step is to read the binary string representing the number into a character array in your program. If the input is from a file which you opened with fopen(), you can use the standard function fgets(). If the input is coming from stdin, you can use my getsafe() function, or fgets() with a FILE * of stdin. There is no need to remove the trailing '\n' if you are receiving a single numeric value in the string.  
 The next step is to use the standard C library function strtoul() prototyped in  
 unsigned long int strtoul(const char *nptr, char **endptr, int base);  
 Here is what the parameters are:  
 nptr is a pointer to the array of characters containing the string you want parsed. It has the const type qualifier to indicate that the function will not modify the string.  
 endptr is a pointer to a pointer to char. If this parameter is not NULL, a pointer to the remainder of the string is stored in the object endptr points to. This can be useful in parsing complex input lines from a file, but for the purpose of processing one line at a time we will use NULL for this parameter.
 base the final parameter is the number base to be used. If we use 10 for base, the string would be parsed as a decimal number. If we use 16, the string will be taken to represent a hexadecimal number even if it doesn't start with 0x or 0X. If we use 2, strtoul() will accept only the characters '0' and '1' and assume they represent a number in binary.
 This code has a few other interesting features. It includes the standard header which defines some very important constants. In this case two of the constants it defines are used trim the unsigned long value returned by strtoul() to fit in an unsigned int and an unsigned char.  
 #include  #include  #include  int main(void) {   char buffer [50];   unsigned char uc;   unsigned int ui;   unsigned long ul;   if (fgets(buffer, sizeof buffer, stdin) != NULL)   {      ul = strtoul(buffer, NULL, 2);      ui = (unsigned int)(ul & UINT_MAX);      uc = (unsigned char)(ul & UCHAR_MAX);      printf("You entered %lu decimal, %lX hex\n", ul, ul);      printf("This is %X as an unsigned int\n", ui);      printf("This is %X as an unsigned char\n", uc);   }   return 0; }
 The function strtoul() has another very useful feature. If you pass 0 as the base parameter, the function uses the same rules for converting the numeric string to a value that the C compiler uses on source code.
 If the first non whitespace characters of the string are "0x" or "0X",strtoul() parses the string as hex, accepting the letters 'a' through 'f' and'A' through 'F' as well as the digits '0' through '9'.
 If the first non whitespace character of the string is '0' and it is not followed by 'x' or 'X', strtoul parses the string as octal, and only acceptsthe digits '0' through '7'.
 Finally if the first non whitespace character of the string is any digit except'0', that is '1' through '9', strtoul parses the number as decimal.
 How do I output numbers as binary strings?
 We had some help from the standard C library to answer the question How do I input numbers as binary strings? The standard library function strtoul() was available to do the work for us.  
 When it comes to outputting a numeric value of one of the integer types as a string of just 0's and 1's, however, we are strictly on our own. The code to do this is not very hard. Here is the code for displaying an unsigned char:
 #include  #include  char *unsigned_char_to_text(char val) {   unsigned char usc = (unsigned char)val;   unsigned char mask = UCHAR_MAX - (UCHAR_MAX >> 1);   static char result [CHAR_BIT + 1];   char *store = result;   while (mask)   {      *store++ = (char)('0' + ((usc & mask) != 0));      mask >>= 1;   }   *store = '\0';   return result; }
 To generate a function to output an unsigned int as a binary string, just make the following changes to this function:
 Change val to int and usc and mask to unsigned int.  
 Change the two references to UCHAR_MAX to UINT_MAX.
 Change the expression "UCHAR_BIT + 1" for the array size to "sizeof(int) *UCHAR_BIT + 1".
 To make a function to do the same for unsigned long, change val to long and usc and mask to unsigned long, change UCHAR_MAX to ULONG_MAX, and use "sizeof(long) * UCHAR_BIT + 1".  
 Warning about the returned string. The string used to store the characters in the unsigned_char_to_text is defined as a static array of characters inside the function. It must be static because local variables defined inside a function go out of scope and cease to exist once the function returns, so it is illegal and a bug to return a pointer to a local non static variable.
 The fact that the string is static means that each call to the function uses the same string space and overwrites the string produced by a previous call. So if you use this function more than once in a program you should be careful to do the following:
 Use the string immediately to display or write to a file, before calling the function again.  
 If you do need to keep the generated string for some time, and the function might be called again, copy the string.
 C++ Notes For Using These Functions
 All of these functions are written in standard C. They can also be used and work correctly in a C++ program. In some of the cases, the features of C which I use in these functions could be replaced with C++ specific features. This is usually the preferred method in C++ if it provides a newer way of doing something than C does. Even so, the C code here is perfectly legal in C++.
 If your have a newer C++ compiler that supports namespaces, you can modify the programs to use the C++ feature namespace feature to place the C library function names in the std namespace. In place of traditional C header names like

ATI : Binary Driver Howto

2009-12-13T02:44:00.000-08:00

Contents

By default Ubuntu will use the open source 'ati' or 'radeon' driver for cards manufactured by ATI. Some users however prefer the proprietary 'fglrx' driver for various reasons. The instructions on this page will tell you how to use this driver.

There are two ways you can install proprietary fglrx drivers. The preferred way is to use the drivers provided via the Ubuntu repositories. More advanced users can also try the drivers from ati.com. Both approaches are documented below and you need to take only one of them. The Ubuntu-provided ones are the safest bet, the ati.com ones however may be needed (eg: when you need hibernation).

As mentioned elsewhere, if you encounter bugs with these closed-source drivers, developers will not be willing or even able to assist you in resolving your issues. Use them at your own risk. We encourage our users to prefer open source drivers.

Prerequisites

Make sure the following things are true about your video card:

It is a 'Radeon' card
The model of the card is in the 9xxx series, 9500 or higher, or it is in the X series (e.g. X300), or it has TV-Out capability. The 'fglrx' driver does not support cards earlier than the 9500
The command lspci reveals a card with "ATI" in its name
You need hardware-accelerated 3D support, or display refresh rates higher than 60 Hz. The open source drivers are fine for all other areas
Some basic knowledge of a Linux command line (see UsingTheTerminal)

Note that if you own an ATI card from the R400 series or below, you already have working 2D and may have accelerated 3D with the default drivers. These cards include:

R400 series Xnnn (X800, X700, etc) (3D works)
R300 series (9300+) (3D works)
R200 and R100 series (9200 and below)

For specific chipsets and models, see the Xorg 7.0 Release Notes.

Install from Ubuntu repositories (easier)

Instructions for Ubuntu 9.04 (Jaunty)

Enable the accelerated ATI graphics driver in the 'Hardware Drivers' (System->Hardware drivers), then do:

sudo dpkg-reconfigure -phigh linux-restricted-modules-`uname -r`
sudo insmod /lib/modules/`uname -r`/volatile/fglrx.ko

Log out and log in.

JAUNTY NOTICE

The above Jaunty 9.04 instructions don't actually work because the latest ATI driver is incompatible with XOrg 1.6. To see a guide on instructing how to downgrade XOrg and install the ATI driver, view this link:
http://tan-com.com/posts/technology/fix-ubuntu-904-ati-driver-issue

Instructions for Ubuntu 8.04 (Hardy) and 8.10 (Intrepid)

Enable the accelerated ATI graphics driver in the hardware drivers menu (System->Administration->Hardware Drivers), then do:

sudo dpkg-reconfigure -phigh linux-restricted-modules-`uname -r`
sudo insmod /lib/modules/`uname -r`/volatile/fglrx.ko

Log out and log in.

Instructions for Kubuntu 7.10 (Gutsy)

First make sure linux-restricted-modules-generic and restricted-manager-kde are both installed

sudo apt-get install linux-restricted-modules-generic restricted-manager-kde

Open the restricted drivers manager from KMenu → System Settings → Advanced → Restricted Drivers and select "ATI accelerated graphics driver". This will hopefully enable fglrx in a painless way. If not, follow the instructions for Feisty.

Instructions for Ubuntu 7.10 (Gutsy)

Install linux-restricted-modules and restricted-manager provided in the restricted repositories:

sudo apt-get update
sudo apt-get install linux-restricted-modules-generic restricted-manager

Open the restricted drivers manager in "System -> Administration -> Restricted Drivers Manager" and select "ATI accelerated graphics driver".

Instructions for 6.06 (Dapper)

Install the kernel drivers. These drivers should be installed by default, but it's better to make sure they are installed. You need the package linux-$arch, where you replace $arch by the CPU architecture for the machine. This is 386 for Intel Pentium, 686 for Celeron, Pentium Pro, Pentium II, Pentium III, and Pentium 4 without Hyper-Threading. 686-smp for Pentium 4 with Hyper-Threading, or k7 or k7-smp for AMD athlon. On 64-bit systems, this may be amd64-generic, amd64-k8, amd64-k8-smp, or amd64-xeon.

sudo apt-get install linux-686
or
sudo apt-get install linux-k7
or
...

You also need to install the restricted-modules package that match ***exactly*** the kernel you are running, as well as specific required packages: (if you ran the previous command, make sure to reboot on your new kernel, otherwise this will install the wrong kernel modules !)

sudo apt-get update
sudo apt-get install linux-restricted-modules-$(uname -r)
sudo apt-get install xorg-driver-fglrx fglrx-control

Please note that the fglrx-control package is not compulsory as it seems to be buggy (but wont affect your machine in anyway ).

If the restricted-modules package for the kernel you are running is not available (it happens sometimes with K/Ubuntu), you may have to opt for running a kernel for which this package is available or to install the drivers directly from the setup script provided by ATI (https://support.ati.com/ics/support/default.asp?deptID=894&task=knowledge&folderID=27)

Once the above packages are correctly installed, run these commands:

sudo aticonfig --initial
sudo aticonfig --overlay-type=Xv

Then go back and edit xorg.conf with your favorite editor, perhaps:

gksudo gedit /etc/X11/xorg.conf

or:

kdesu kate /etc/X11/xorg.conf

and make sure that under the "Device" section, the Driver is set to

Driver "fglrx"

You will have 2 device sections related to your graphic card, one is the pre-aticonfig one, and should use the ati or radeon driver. No need to change this part as it is not used by xorg anymore. The other device section however will have to use the fglrx driver.

It appears that fglrx is often unstable, at least on AMD64. System may lock on 8.25 driver. 3D accell may not work on 8.28. The 8.26.18 driver may be your best bet, as of Sept2006. Instructions for updating drivers are at: http://wiki.cchtml.com/index.php/Ubuntu_Dapper_Installation_Guide#Method_2:_Generating.2FInstalling_Ubuntu_packages_for_the_8.28.8_drivers_in_Ubuntu_Dapper_Manually But I recommend 8.26 at this time, not 8.28.

Reboot.

Confirm it worked, by issuing the "fglrxinfo" command:

fglrxinfo/glxinfo may not work properly for you via SSH and via the console when logged in as root.

$ fglrxinfo
display: :0.0  screen: 0
OpenGL vendor string: ATI Technologies Inc.
OpenGL renderer string: RADEON 9700 Generic
OpenGL version string: 2.0.5755 (8.24.8)

Source: http://wiki.cchtml.com/index.php/Ubuntu_Dapper_Installation_Guide

Troubleshooting

You may see a message

Xlib:  extension "XFree86-DRI" missing on display ":1.0

If the line

load "dri"

Section "Module"

is missing from your /etc/X11/xorg.conf then add it. However this message does not necessarily indicate a problem.

If fglrxinfo gives you the following, your installation is not completed correctly:

fglrxinfo/glxinfo may not work properly for you via SSH and via the console when logged in as root.

$ fglrxinfo
display: :0.0  screen: 0
OpenGL vendor string: Mesa project: www.mesa3d.org
OpenGL renderer string: Mesa GLX Indirect
OpenGL version string: 1.2 (1.5 Mesa 6.4.1)

In this case, watch for these things:

Make sure that the resctricted-modules package installed correspond to the kernel your are running and that you can load the fglrx driver, wether by issuing the command "sudo modprobe fglrx" or by verifying that the module appears in the list of loaded modules, by issuing the command "lsmod";
It may be necessary to establish a symbolic link for the /usr/lib/dri folder, by issuing the following command: "sudo ln -s /usr/lib/dri /usr/lib/xorg/modules/dri";
You may have to deload the radeon and dri modules, by issuing "sudo rmmod radeon" and "sudo rmmod dri";
Make sure you deload the module ati-agp by issuing "sudo rmmod ati-agp" and blacklist it in /etc/modprobe.d/blacklist.
Check the /etc/X11/xorg.conf in Section "Module" to have this line: Load "dri" and it is not commented.

Install from ati.com (latest version of drivers)

WARNING: this method of installing the driver is not recommended and not supported, and any problems that occur after using the following instructions should not be reported to the Launchpad bug area.

Instructions for Ubuntu 8.04 (Hardy) with ATi 8.443.1-1 and above binary drivers

To begin first install the needed packages:

sudo apt-get install dpkg-dev debhelper libstdc++5 dkms build-essential cdbs fakeroot

You will then need to build the installation packages with the downloaded ATi drivers (ensure the ATi drivers have the execute flag set first):

./ati-driver-installer-8.443.1-x86.x86_64.run --buildpkg Ubuntu/

You can replace in the above with the codename for the version of Ubuntu you are running (gutsy, hardy, intrepid).

Then install the binary drivers:

sudo dpkg -i fglrx-kernel-source_.deb

Run the following command to install the Xorg driver

sudo dpkg -i xorg-driver-fglrx_.deb

Finally run aticonfig to build your new xorg.conf if you have not done so before:

sudo aticonfig --initial

Reboot and X.Org should start with the ATi binary drivers fully functional. To confirm the drivers are working from a terminal run:

fglrxinfo

You should get output similiar to the following:

display: :0.0  screen: 0
OpenGL vendor string: ATI Technologies Inc.
OpenGL renderer string: ATI Radeon HD 3870
OpenGL version string: 2.1.7170 Release

If you see any mention of the "MESA" in the output the drivers have not installed correctly. Look at instructions below for possible fixes.

Instructions for 6.06 (Dapper)

Download the apropiate drivers from ati.com. You will need the ATI Driver Installer, not the seperate XFree86/X.org rpm packages. Save the installer into an empty directory (or at least one containing no *.deb files), since it will create several new files.
Make sure the universe section of the Ubuntu repositories is enabled (See the AddingRepositoriesHowto)

Perform the following commands (where is the version number of the installer):

$ sudo apt-get install fakeroot gcc-3.4 module-assistant build-essential debhelper
$ fakeroot sh ./ati-driver-installer-.run --buildpkg Ubuntu/edgy
You may need to wait a few mintues for this to complete.

This will create a number of .deb files in the current directory. note: If you run Dapper, replace "edgy" (above) with "dapper".

1 sudo dpkg -i *.deb
2 sudo module-assistant prepare,update
3 sudo module-assistant build,install fglrx-kernel
4 sudo depmod
note: You need to repeat steps 2-4 - building the kernel module -
everytime you upgrade the kernel.

Seveas Repository

You do not need to take all these steps if you run an up-to-date Dapper installation on a 32 bit system. Dennis Kaarsemaker provides these packages in a repository. Add the following line to /etc/apt/sources.list:

deb http://mirror.ubuntulinux.nl/ dapper-seveas drivers

Then you can simply install the ubuntu-fglrx-$arch (see above for the meaning of $arch) package.

The fglrx driver on Dapper (8.26.18-1) can cause rss-glx screensavers to run very slowly.

Modifying xorg.conf

When you install from ati.com drivers or the dapper-seveas repository, you still need to change xorg.conf and add the fglrx module to /etc/modules as described under "Ubuntu provided drivers". There are scripts from ATI that may or may not work for you. They will backup xorg.conf before modifying it.

$ sudo aticonfig --initial
$ sudo aticonfig --overlay-type=Xv

Whether you install manually or from dapper-seveas, you MUST disable the Ubuntu-provided fglrx by performing these actions:

Disable fglrx in /etc/default/linux-restricted-modules-common
Run sudo /sbin/lrm-manager
Run sudo depmod -a
Reboot

There is a forum thread on installing ATI drivers from ati.com. Look there if you have trouble, and if your problem isn't already solved there, post a question.

More Troubleshooting

If after everything you still get indirect rendering when typing "fglrxinfo" run:

$ depmod -ae

Now reboot and hope for the best.

If you're using an AMD64 configuration and your Xorg.0.log mentions a 'duplicate symbol rol_long' message, comment out the 'Load "int10"' line in the Module section of /etc/X11/xorg.conf
If you are using an ATI Radeon Xpress 200M on an AMD64 CPU and the fglrx driver crashes with a blank screen on startup, change your BIOS settings to use the UMA+Sideport Video Mode with 128MB of Shared Video Memory. See http://ensode.net/ati_radeon_xpress_200m_linux.html
If you are going to compile 3d applications, you will want to install the fglrx-driver-dev package
The fglrx doesn't support 16 bit colour on some chip sets, if you have problems with X locking up on boot try setting this in your xorg.conf file to 24
If you are having problems related to DRI or 3d acceleration and the following lines show up in your /var/log/Xorg.0.log
```
(WW) fglrx(0): Kernel Module version does *not* match driver.
(EE) fglrx(0): incompatible kernel module detected - HW accelerated OpenGL will not work
```
then make sure you installed either linux-$arch or ubuntu-fglrx-$arch.Another reason for either this error message, or incorrect driver information when running fglrxinfo (reports that the mesa driver is still being used) could be that the (K)Ubuntu fglrx drivers were not uninstalled before installing the ATI driver, or that the restricted-modules package is installed. To fix this issue, start Adept or Synaptic and remove the fglrx packages supplied with (K)Ubuntu as well as the restricted-modules package. Quit KDE and go to a console.

$ sudo modprobe -r fglrx
$ gksudo gedit /etc/X11/xorg.conf
or
$ kdesu kate /etc/X11/xorg.conf

Change the driver for the device to 'ati' instead of fglrx to use the standard Xorg supplied driver.

$ startx

Now re-run the ATI driver installation
If there are no obvious error messages in Xorg.0.log but 3D acceleration is still not working, you should look at glxinfo output in debug mode:

LIBGL_DEBUG=verbose glxinfo

Possibly there are some errors in the beginning concerning not found drivers in /usr/X11R6/lib/modules/dri/. This could be the case if you used the driver from ATI and are now using again the provided fglrx driver. ATI's fglrx driver installs a script in /etc/X11/Xsession.d/10fglrx which changes the search path for libraries, causing 3D-related errors. In this case just remove the script:

$ sudo rm /etc/X11/Xsession.d/10fglrx

Sometimes 2D acceleration with xv is not enabled. You need this for smooth video playback among other things. In this case you should check if your /etc/X11/xorg.conf contains the line Option "VideoOverlay" "on" in the corresponding section:

Section "Device"
       Identifier      "ATI Radeon"
       Driver          "fglrx"
       Option          "VideoOverlay" "on"
       BusID           "PCI:1:0:0"
EndSection

General Troubleshooting

Video-out

Black and White/Wrong Colours or Scrolling Picture

If you are having issues with S-Video out where the video is incorrectly displayed (such as black and white or scrolling), try adding the line
```
        Option      "TVFormat" ""
```
into the Device section that lists your monitor/TV, as the output to the TV might be set to PAL or another incompatible format for your region/TV. Replace the with the region specific video type. The TVFormat choices are: NTSC-JPN, NTSC-M, NTSC-N, PAL-B, PAL-CN, PAL-D, PAL-G, PAL-H, PAL-I, PAL-K, PAL-K1, PAL-L, PAL-N, PAL-M, PAL-SCART.

Example:

Section "Device"
       Identifier  "ATI Radeon 9600/X1050 (Screen 1)"
       Driver      "fglrx"
       Option      "TVFormat" "NTSC-M" # NTSC-M is used in North America -- Canada/USA -- amoung other countries
       BusID       "PCI:2:0:0"
       Screen      1
EndSection

Don't forget that most older TVs use a standard resolution of 640x480, so it may be wise to force that resolution:

Section "Screen"
       Identifier "TV"
       Device     "ATI Radeon 9600/X1050 (Screen 1)"
       Monitor    "Toshiba 32in (Screen 1)"
       DefaultDepth     24
       SubSection "Display"
               Viewport   0 0
               Depth     24
               Modes    "640x480" # Force this standard resolution
       EndSubSection
EndSection

More information about this issue is listed in the Ubuntu Forums and also through the MythTV Wiki. If you are unsure of your region, review this region list. The fglrx man page might be useful as well.

Safely Creating Temporary Files in Shell Scripts

2009-11-26T23:22:00.000-08:00

The basic idea of a symlink exploit is to predict where an application will create its temporary file and put a symbolic link (symlink) at that place. When the application now tries to work with a tempfile it will actually work with the file that the symlink points to. The most simplistic thing a (local) attacker can do with this is to have the symlink point to important files such as /bin/bash. This will cause the program (assuming it has root privileges) to overwrite /bin/bash with its temporary data, making the system unusable. . . .

Safely Creating Temporary Files in Shell Scripts

0. Abstract

This paper discusses how a programmer can write shell scripts that securely create temporary files in world/group writable directories. After explaining why it is important to be careful with temporary files I give some hints on how to identify and fix vulnerable shell scripts. This paper concentrates on how things are done. I intentionally leave out lots of gory details in order to make this document shorter and easier to understand for people that just want to write secure code with as little extra effort as possible.

1. Introduction

1.1 Why I wrote this

There are actually many documents and papers out there that describe how to securely create temporary files, so why yet another one? Unfortunately, most of these documents refer mainly to C programs even though many temporary files are created by shell scripts. Such shell scripts are wrappers for other programs or configuration scripts. They are inside Makefiles, they are install scripts included in RPM packages or just small tools written by the admin. Due to the nature of these scripts they very often handle temporary files. In contrast to C/C++ there is no standard mechanism for creating temporary files. In order to compensate for this, programmers have to reinvent the wheel time and time again which is very error prone. As a result many scripts handle temporary files insecurely, creating a security risk that is often underestimated.

1.2 Symlink Exploits: The Basic Idea

Programmers often do not think that creating temporary files in a secure way is important. After all it is just a tiny shell script. I will give a very brief introduction of how this can be exploited by an attacker in order to underline the importance of secure tempfile handling:

It is also possible to use this type of exploit to gain complete root privileges. If an attacker is somehow able to influence what data the insecure program writes to the tempfile (now /bin/bash) he can as a result modify the contents of /bin/bash or any other executable on the system. Obviously he will then get root privileges the next time the modified executable is run by root.Â There are more advanced concepts for exploiting insecure tempfile creation (not all of them involve symlinks), but these simple examples should demonstrate that insecure file creation may cause a lot of trouble.

2. Common mistakes

2.1 Predictable filename

In order to make it easier for you to identify vulnerable code I will show you some examples of how you should NOT create your temporary files.

Very often shell scripts create their temporary files without any checks at all:

 sort /some/file > /tmp/tempfile

This will make an exploit trivial: Just create a symlink called /tmp/tempfile and let it point to a file you want to overwrite.

Other vulnerable programs will create temporary files with a name like /tmp/tempfile.$$. The $$ variable contains the process ID (PID) of the shell running the shell script. This is very useful if you have several shell scripts running in parallel: Each one will have its unique tempfile name (because it has a unique PID) so there will be no conflicts. Unfortunately this does not improve security. An attacker knows that the PID of your program will most likely be between 1 and 33000. So the attacker will create 33000 symlinks, knowing that one of them will work.

2.2 Race conditions

The obvious solution to the problems from 2.1 seems to be this:

 rm -rf /tmp/tempfile.$$
 sort /some/file > /tmp/tempfile.$$

"rm" will delete the symlink itself (not the file that the symlink points to), so that the "sort" command will be safe. It may sound good, yet the script is still insecure because now you have a race condition. Once the symlink gets deleted the attacker will know that "rm" was successfully run by the victim. Now he re-creates the symlink in the hope that the sort command has not yet created the tempfile. The attacker cannot be 100% sure that his exploit will be successful, but he can keep trying until it works.

2.3 Identifying vulnerable code

There are many variations of the above examples so one could think this kind of vulnerability is hard to find. Actually, it is much easier to detect than buffer overflows or format string vulnerabilities. Just do a

 grep -RH /tmp *

if you suspect that your package contains vulnerable code. If you feel really bored some day just try and scan your entire system, you might be surprised! Check if the files found by grep handle their tempfiles securely. If they do not, the next chapter will tell you how to fix this.

3. Writing secure code

3.1 Don't use tempfiles

This may sound a little stupid at first, yet there is some truth to it: If you don't do anything you can't mess up anything. Sometimes programs use tempfiles even though it is not necessary. Most commands can write their results to standard output instead of a file. Assuming that you have just a few bytes or kilobytes of temporary data it could actually be much more convenient for you as a programmer to store it in a variable rather than a file. This way you can sometimes avoid any risk of insecurely creating tempfiles simply by not creating them at all.

3.2 Use mktemp

If you have to use tempfiles then mktemp could be what you are looking for. Realizing that the creation of tempfiles in shell scripts is a security problem, Todd C. Miller wrote mktemp, a tool that will do this for you. The man page gives you some good examples of how to use it securely, so I am not going to explain that. If you write shell scripts for an environment where mktemp is available you should definitely use it to create your temporary files.

Just one little problem: Not all Linux distributions come with mktemp in their default install, so you cannot rely on mktemp to be available. Other Unixes (e.g. Solaris) don't necessarily have it either. If you want your script to be able to run on a wide variety of systems you will have to get along without mktemp. If maximum compatibility is not that much of an issue for you, you can just tell your users to install mktemp before they use your software. Mktemp will compile almost everywhere, so that should not be a big issue for most people.

3.3 Notes on mktemp

What you should know is that Suse Linux comes with a rather old version of mktemp. This older version of mktemp does not understand all of the command line options that are described on the mktemp website. It only understands the -d -q and -u options. If you try to use some of the newer options mktemp will simply exit and signal an error.

Similarly, the mktemp that comes with Mac OS X and FreeBSD 4.9/5.2 only supports -d -q -u and -t. Mktemp on Debian supports -d -q -u -t -p but not the -V option. So you should be careful when you use the new -V -p and -t options. It is probably better to stick to -d -q and -u for now to ensure portability. Optionally you may ask you distributor of choice to update his mktemp package.

3.4 Creating tempdirs with mkdir

Ok, so you are writing scripts for systems that may not have mktemp. Let's look for something to replace it that is available on all platforms. The mkdir command will do the job. "mkdir /tmp/tempdir.$$" will create the directory /tmp/tempdir.$$ and signal an error if it already existed. This is similar to whatÂ "mktemp -d" would do. But mkdir lacks some of the luxury that mktemp provides, so the code gets a little more complicated:

 (umask 077 && mkdir /tmp/tempdir.$$) || exit 1

Explanation: The umask command ensures that when mkdir creates the directory it will have an access mode of 700. Running chmod 700 afterwards would be a bit less secure. Because the umask is in parentheses it will not affect the umask for anything other than the mkdir command. If mkdir signals an error for whatever reason, the program exits. This approach is used by many shell scripts and is secure against symlink exploits. The code should work on every decent operating system that deserves to be called Unix-like.

Now that you have created yourself a secure temporary directory you can create new files/directories/whatever inside this tempdir without having to worry about security: You own the directory, you are the only one that has access to it. This makes it easy to fix existing code. All you need to do is add the code for the secure tempdir creation, adjust a few pathnames and you are finished! Just don't forget to clean up after yourself and delete the tempdir with "rm -rf" when you are finished with it.

3.5 Mkdir deluxe

While the above code is pretty good there is still room for improvements. First you should find out if the admin really wants you to use /tmp/ for your temporary data. For this purpose there is a shell variable called TMPDIR. IfÂ TMPDIR is set you should use this directory to create your temporary files. That way the admin can for example improve security by assigning each user a separate (=safe) directory for temporary data.

Using $$ is a convenient way of creating unique names for tempfiles. And even though the filename can be predicted the directory is still created in a secure way by the mkdir command. The question that remains is: Secure against what? Well, it is secure against symlink exploits and the like. But it is not secure against a DoS attack. An attacker simply keeps your application from creating its temporary directory by imitating (!) a symlink attack. That way your program always exits and never completely does what it is supposed to do. Depending on the program, this alone can be a security threat.

This problem can be avoided by appending $RANDOM to the filename. This variable contains a random integer between 0 and 32767. In order to get filenames that are as unpredictable as the ones created by mktemp you will need to append $RANDOM to your filename three times for a total of 35184372088832 (=2^45) different possible combinations. So here comes the code to create a temporary directory:

 tmp=${TMPDIR-/tmp}
 tmp=$tmp/somedir.$RANDOM.$RANDOM.$RANDOM.$$
 (umask 077 && mkdir $tmp) || {
  echo "Could not create temporary directory! Exiting." 1>&2
  exit 1
 }

Explanation:
Â Line one will set tmp to $TMPDIR if $TMPDIR is defined. If $TMPDIR is undefined "/tmp" is used as a default. Line 2 builds the actual directory name using $RANDOM three times. It is important that you put some kind of separator like the "." between the numbers. Without the "." there would be no difference between the random numbers 12, 34 and 56 (=123456) and the random numbers 123, 45 and 6 (=123456). As a result the number of different combinations would decrease considerably, thereby making your directory name more predictable. You should replace "somedir" with a more meaningful name in your own script. If anything goes wrong, an error message will be printed (to stderr, where it belongs) and the program exits. If everything is ok, then $tmp will contain the name of your temporary directory.

The only trouble you may have with this is $RANDOM. This variable is a feature of the Bourne Again Shell (bash) and not included in the normal Bourne Shell (sh). But on every Linux I have seen (and on MacOS X) both "sh" and "bash" are just the good old GNU bash that will happily provide you with $RANDOM. On other systems it may not be available.

But even then there is no reason to worry. In those cases $RANDOM will simply be an uninitialized variable that defaults to "".Â Hence your directory will be "/tmp/somedir....123" if your PID is 123. This is also the reason why I append the $$ to the directory name: To make sure I get unique directory names even if $RANDOM is not supported. On systems that don't provide $RANDOM this program will act just like the one given in chapter 3.4.

3.6 Mixing mktemp and mkdir

Many shell scripts try to use mktemp to create their tempdirs. If mktemp is not available they will resort to using mkdir. At first glance this makes perfect sense: try to use the secure mktemp and only use mkdir if you have to. But once you think about it you will realize that this is rather illogical. Because for you as a programmer there are two possible scenarios that you have to take into account when writing a shell script:

1. mktemp is always available
In this case there is no point in including the code that uses mkdir. It will never be used and is therefore dead code that should be removed.

2. mktemp may not be available.
That means now you have to include the mkdir code. Of course this code is secure enough for your purpose. If it is not, then you got a vulnerability that you should fix right now! So if you already have code that uses mkdir and is sufficiently secure, why would you want to use mktemp? Your program works perfectly fine without it and you get no security benefit from using it. Obviously, mktemp is unnecessary in this scenario and the code using it should be removed.

There may be exceptions to this, but 99% of the time you should use either mktemp or mkdir but NOT both.

If you really do need to mix mktemp and mkdir (which is unlikely) make sure you don't repeat a very common mistake:

 #try mktemp
 tempfile=`mktemp /tmp/secureXXXXXXXX`

 #if mktemp didn't work, use insecure name
 test -n $tempfile && $tempfile=/tmp/insecure$$

 do_whatever > $tempfile

You would expect this code to be secure on all systems that provide mktemp. Wrong! This one is vulnerable on every system. An attacker will prepare a symlink attack against the /tmp/insecure$$ file name. Then he will fill up the /tmp partition with data. As /tmp is full, mktemp will fail and the insecure file name will be used. You may now object that there are quotas and the like. But you as a programmer cannot expect everybody to set up quotas for /tmp. And even if there is a quota an intelligent attacker can still flood /tmp in most cases. A solution could look like this:

 #look for mktemp
 mymktemp=`which mktemp`
 
 test -n $mymktemp && {
  #mktemp available
 }

 test -z $mymktemp && {
  #no mktemp
 }

This code checks if mktemp can be found and reacts accordingly. But as stated above, you should hardly ever need to do this.

4.0 Conclusion

As you have seen there are many mistakes one can make when creating tempfiles that can lead to anything from downtime to root compromise. Even though /tmp is the most prominent example for such security issues, it is certainly not the only dangerous directory. Whenever you work in group- or world-writable directories you have to make sure that your temporary files are created securely. You can protect yourself against such attacks quite easily if you just copy and paste a few lines of secure code into your script and adjust a number of lines. So you should take 5 minutes and check your scripts, it's definitely worth the time.

Remastering a Ubuntu Alternate CD

2009-08-31T02:23:00.001-07:00

Remastering a Ubuntu Alternate CD

From COMPSA

Jump to: navigation, search

Warning! If you are not familiar with at least the basics of Linux or virtual machines it is suggested that you get some time using them before attempting to follow the instructions on this page.

[hide]

Overview

The goal of this page is to outline the process that we've come down to for creating an install CD for Ubuntu which is faster and easier to run on a large number of systems than the regular install is. This custom CD is also supposed to have all updates streamed into it (or at least a mechanism in place to automatically perform these updates) and should install common software not included in Ubuntu's default installation (such as the Flash player, MP3 support, etc.).

Useful tools

VMWare server is helpful for testing installations in a quick fashion (and can test remastered CDs without requiring you to use up physical media). VMWare is available at no cost from VMWare.com (you'll need a serial number from the same site, feel free to use mailinator or whatever instead of your real info if you'd like; they are a well-behaved company, though, in terms of sending out e-mail).

QEmu is a also available; it can perform the same function as VMWare server; but, also allows people on other architectures to make their machine emulate an x86 processor. QEmu website

You will require a Linux distribution to be able to remaster CDs. Just about any modern distribution is fine as the tools we use are pretty much universal (mount, rsync, a text editor, and mkisofs). The remastering process requires a significant amount of hard drive space (I'd suggest plan for it to use at least 10 GB assuming you use one or more virtual machines for testing your CD).

The Process

1) Fetch a copy of Ubuntu's alternate install CD if you don't have one already. Do not get the Live CD (which is the default one). Unless you know otherwise you want to get the i386 version (since that's what all of the machines we've been donated so far require).

2) Extract the files from the ISO image to a directory, let's call it buntu (note: you can't use a graphical tool like Archive Manager to do this-- it'll appear to succeed; but, will create a corrupt CD later on-- you must perform this command as root)

mount ubuntu-6.06.1-alternate-i386.iso ubuntu-iso/ -t iso9660,ro -o loop
rsync -azvb --delete ubuntu-iso/ buntu/

3) Change into directory buntu

4) Add to isolinux/isolinux.cfg directly before the LABEL install bit this (everything after append should be on the same line):

LABEL forcause
 menu label Install Co^mputers for a Cause version
 kernel /install/vmlinuz
 append  debian-installer/locale=en_US kbd-chooser/method=us
netcfg/get_hostname=ubuntu debconf/priority=critical
preseed/file/cdrom/preseed/cause.seed
initrd=/install/initrd.gz ramdisk_size=16384 root=/dev/ram rw --

(this adds a new option to the menu when the install CD starts up titled Install Computers for a Cause version and specifies language and location information. It also tells the installer where to look for information about what installation options to pick and tells the installer not to ask about anything but critical decisions)

5) Copy the contents of cause.seed to a plain text file preseed/cause.seed

6) Optional If you'd like edit isolinux/splash.pcx to be a pretty custom startup screen.

7) Change back up a directory so you're in the directory above buntu

8) Generate a new CD image called NewCD.iso

mkisofs    \
-r    \
-V "Ubuntu 6.06.1 i386"    \
-cache-inodes    \
-J    \
-l    \
-b isolinux/isolinux.bin    \
-c isolinux/boot.cat    \
-no-emul-boot    \
-boot-load-size 4    \
-boot-info-table    \
-o ../NewCD.iso buntu/

9) Voila! You now have a customized Ubuntu CD. Feel free to test it in VMWare or QEmu or to burn it to a physical CD.

Connect desktop apps using D-BUS

2009-08-17T00:00:00.001-07:00

Helping applications talk to one another

Ross Burton (r.burton@180sw.com), Software Engineer, OneEighty Software, Ltd.

Summary: D-BUS is an up-and-coming message bus and activation system that is set to achieve deep penetration in the Linux® desktop. Learn why it was created, what it can be used for, and where it is going.

D-BUS is essentially an implementation of inter-process communication (IPC). However, several features distance D-BUS from the stigma of being "Yet Another IPC Implementation." There are many different IPC implementations because each aims to solve a particular well-defined problem. CORBA is a powerful solution for complex IPC in object-orientation programming. DCOP is a lighter IPC framework with less power, but is well integrated into the K Desktop Environment. SOAP and XML-RPC are designed for Web services and therefore use HTTP as the transport protocol. D-BUS was designed for desktop application and OS communication.

Desktop application communication

The typical desktop has multiple applications running, and they often need to talk to each other. DCOP is a solution for KDE, but is tied to Qt and so is not used in other desktop environments. Similarly, Bonobo is a solution for GNOME, but is quite heavy, being based on CORBA. It is also tied to GObject, so it is not used outside of GNOME. D-BUS aims to replace DCOP and Bonobo for simple IPC and to integrate these two desktop environments. Because the dependencies for D-BUS are kept as small as possible, other applications that would like to use D-BUS don't have to worry about bloating dependencies.

Desktop/Operating System communication

The term "operating system" here includes not only the kernel but also the system daemons. For example, with a D-BUS-enabled udev (the Linux 2.6 replacement for devfs, providing dynamic /dev directories), a signal is emitted when a device (such as a USB camera) is inserted. This allows for tighter integration with the hardware in the desktop, leading to an improved user experience.

D-BUS features

D-BUS has several interesting features that make it look like a very promising candidate.

The protocol is low-latency and low-overhead, designed to be small and efficient to minimize round-trips. In addition, the protocol is binary, not textual, which removes the costly serialization process. The use cases are biased towards processing on the local machine, so all messages are sent in the native byte ordering. The byte ordering is stated in each message, so if a D-BUS message travels over a network to a remote host, it can still be parsed correctly.

D-BUS is easy to use from a developer's point of view. The wire protocol is simple to understand, and the client library wraps it in an intuitive manner.

The library has also been designed to be wrapped by other systems. It is expected that GNOME will create wrappers around D-BUS using GObject (indeed these partially exist, integrating D-BUS into their event loop), and that KDE will create similar wrappers using Qt. There is already a Python wrapper that has a much simpler interface, due to Python's object-orientation and flexible typing.

Finally, D-BUS is being developed under the umbrella of freedesktop.org, where interested members from GNOME, KDE, and elsewhere participate in the design and implementation.

The inner workings of D-BUS

A typical D-BUS setup will consist of several buses. There will be a persistent system bus, which is started at boot time. This bus is used by the operating system and daemons and is tightly secured so that arbitrary applications cannot spoof system events. There will also be many session buses, which are started when a user logs in and are private to that user. It is a session bus that the user's applications will use to communicate. Of course, if an application wants to receive messages from the system bus, it can connect to it as well -- but the messages it can send will be restricted.

Once applications are connected to a bus, they have to state which messages they would like to receive by adding matchers. Matchers specify a set of rules for messages that will be received based on interfaces, object paths, and methods (see below). This enables applications to concentrate on handling what they want to handle, to allow efficient routing of messages, and to keep the anticipated multitude of messages across buses from grinding the performance of all of the applications down to a crawl.

Objects

At its heart, D-BUS is a peer-to-peer protocol -- every message has a source and a destination. These addresses are specified as object paths. Conceptually, all applications that use D-BUS contain a set of objects, and messages are sent to and from specific objects -- not applications -- that are identified by an object path.

Additionally, every object can support one or more interfaces. These interfaces appear at first to be similar to interfaces in Java or pure virtual classes in C++. However, there is not an option to check if objects implement the interfaces they claim to implement, and there is no way of introspecting an object to list the interfaces it supports. Interfaces are used to namespace the method names, so a single object can have multiple methods with the same name but with different interfaces.

Messages

There are four types of messages in D-BUS: method calls, method returns, signals, and errors. To perform a method on a D-BUS object, you send the object a method call message. It will do some processing and return either a method return message or an error message. Signals are different in that they cannot return anything: there is neither a "signal return" message, nor any other type of error message.

Messages can also have arbitrary arguments. Arguments are strongly-typed, and the types range from fundamental primitives (booleans, bytes, integers) to high-level structures (strings, arrays, and dictionaries).

Services

Services are the highest level of abstraction in D-BUS, and their implementation is currently in flux. An application can register a service with a bus, and if it succeeds, the application has acquired the service. Other applications can check whether a particular service exists on the bus and can ask the bus to start it if it doesn't. The details of the service abstraction -- particularly service activation -- are under development at the moment and are liable to change.

Use cases

Even though D-BUS is relatively new, it has been adopted very quickly. As I mentioned earlier, udev can be built with D-BUS support so that it sends a signal when a device is hot-plugged. Any application can listen to these events and perform actions when they are received. For example, gnome-volume-manager can detect the insertion of a USB memory stick and automatically mount it; or, it can automatically download photos when a digital camera is plugged in.

A more amusing but far less useful example is the combination of Jamboree and Ringaling. Jamboree is a simple music player that has a D-BUS interface so that it can be told to play, go to the next song, change the volume, and so on. Ringaling is a small program that opens /dev/ttyS0 (a serial port) and watches what is received. When Ringaling sees the text "RING," it uses D-BUS to tell Jamboree to turn down the volume. The net result is that if you have a modem plugged into your computer and your phone rings, the music is turned down for you. This is what computers are for!

Code examples

Now, let's walk through a few example uses of D-BUS code.

dbus-ping-send.c sends a signal over the session bus every second with the string "Ping!" as an argument. I'm using GLib to manage the bus so that I don't need to deal with the details of the bus connection myself.

Listing 1. dbus-ping-send.c

#include 
#include 

static gboolean send_ping (DBusConnection *bus);

int
main (int argc, char **argv)
{
 GMainLoop *loop;
 DBusConnection *bus;
 DBusError error;

 /* Create a new event loop to run in */
 loop = g_main_loop_new (NULL, FALSE);

 /* Get a connection to the session bus */
 dbus_error_init (&error);
 bus = dbus_bus_get (DBUS_BUS_SESSION, &error);
 if (!bus) {
   g_warning ("Failed to connect to the D-BUS daemon: %s", error.message);
   dbus_error_free (&error);
   return 1;
 }

 /* Set up this connection to work in a GLib event loop */
 dbus_connection_setup_with_g_main (bus, NULL);
 /* Every second call send_ping() with the bus as an argument*/
 g_timeout_add (1000, (GSourceFunc)send_ping, bus);

 /* Start the event loop */
 g_main_loop_run (loop);
 return 0;
}

static gboolean
send_ping (DBusConnection *bus)
{
 DBusMessage *message;

 /* Create a new signal "Ping" on the "com.burtonini.dbus.Signal" interface,
  * from the object "/com/burtonini/dbus/ping". */
 message = dbus_message_new_signal ("/com/burtonini/dbus/ping",
                                    "com.burtonini.dbus.Signal", "Ping");
 /* Append the string "Ping!" to the signal */
 dbus_message_append_args (message,
                           DBUS_TYPE_STRING, "Ping!",
                           DBUS_TYPE_INVALID);
 /* Send the signal */
 dbus_connection_send (bus, message, NULL);
 /* Free the signal now we have finished with it */
 dbus_message_unref (message);
 /* Tell the user we send a signal */
 g_print("Ping!\n");
 /* Return TRUE to tell the event loop we want to be called again */
 return TRUE;
}

The main function creates a GLib event loop, gets a connection to the session bus, and integrates the D-BUS event handling into the Glib event loop. Then it creates a one-second timer that calls send_ping, and starts the event loop.

send_ping constructs a new Ping signal, coming from the object path /com/burtonini/dbus/ping and interface com.burtonini.dbus.Signal. Then the string "Ping!" is added as an argument to the signal and sent across the bus. A message is printed on standard output to let the user know a signal was sent.

Of course, it is not good to fire signals down the bus if there is nothing listening to them... which brings us to:

Listing 2. dbus-ping-listen.c

#include 
#include 

static DBusHandlerResult signal_filter
     (DBusConnection *connection, DBusMessage *message, void *user_data);

int
main (int argc, char **argv)
{
 GMainLoop *loop;
 DBusConnection *bus;
 DBusError error;

 loop = g_main_loop_new (NULL, FALSE);

 dbus_error_init (&error);
 bus = dbus_bus_get (DBUS_BUS_SESSION, &error);
 if (!bus) {
   g_warning ("Failed to connect to the D-BUS daemon: %s", error.message);
   dbus_error_free (&error);
   return 1;
 }
 dbus_connection_setup_with_g_main (bus, NULL);

 /* listening to messages from all objects as no path is specified */
 dbus_bus_add_match (bus, "type='signal',interface='com.burtonini.dbus.Signal'");
 dbus_connection_add_filter (bus, signal_filter, loop, NULL);

 g_main_loop_run (loop);
 return 0;
}

static DBusHandlerResult
signal_filter (DBusConnection *connection, DBusMessage *message, void *user_data)
{
 /* User data is the event loop we are running in */
 GMainLoop *loop = user_data;

 /* A signal from the bus saying we are about to be disconnected */
 if (dbus_message_is_signal
       (message, DBUS_INTERFACE_ORG_FREEDESKTOP_LOCAL, "Disconnected")) {
   /* Tell the main loop to quit */
   g_main_loop_quit (loop);
   /* We have handled this message, don't pass it on */
   return DBUS_HANDLER_RESULT_HANDLED;
 }
 /* A Ping signal on the com.burtonini.dbus.Signal interface */
 else if (dbus_message_is_signal (message, "com.burtonini.dbus.Signal", "Ping")) {
   DBusError error;
   char *s;
   dbus_error_init (&error);
   if (dbus_message_get_args
      (message, &error, DBUS_TYPE_STRING, &s, DBUS_TYPE_INVALID)) {
     g_print("Ping received: %s\n", s);
     dbus_free (s);
   } else {
     g_print("Ping received, but error getting message: %s\n", error.message);
     dbus_error_free (&error);
   }
   return DBUS_HANDLER_RESULT_HANDLED;
 }
 return DBUS_HANDLER_RESULT_NOT_YET_HANDLED;
}

This program listens for the signals dbus-ping-send.c is emitting. The main function starts as before, creating a connection to the bus. Then it states that it would like to be notified when signals with the com.burtonini.dbus.Signal interface are sent, sets signal_filter as the notification function, and enters the event loop.

signal_func is called when a message that meets the matches is sent. However, it will also receive bus management signals from the bus itself. Deciding what to do when a message is received is a simple case of examining the message header. If the message is a bus disconnect signal, the event loop is terminated, as there is no point in listening to a non-existent bus. (The bus is told that the signal was handled). Next, the incoming message is compared to the message we are expecting, and, if successful, the argument is extracted and output. If the incoming message is neither of those, the bus is told that we did not handle the message.

Those two examples used the low-level D-BUS library, which is complete but can be long-winded to use when you want to create services and many objects. This is where the higher-level bindings come in. There are C# and Python wrappers in development that present a programming interface far closer to the logical model of D-BUS. As an example, here is a more sophisticated reworking of the ping/listen example in Python. Because the Python bindings model the logical interface, it is not possible to send a signal without it coming from a service. So this example also creates a service:

Listing 3. dbus-ping-send.py

#! /usr/bin/env python

import gtk
import dbus

# Connect to the bus
bus = dbus.Bus()

# Create a service on the bus
service = dbus.Service("com.burtonini.dbus.SignalService", bus)

# Define a D-BUS object
class SignalObject(dbus.Object):
   def __init__(self, service):
       dbus.Object.__init__(self, "/", [], service)

# Create an instance of the object, which is part of the service
signal_object = SignalObject(service)

def send_ping():
   signal_object.broadcast_signal("com.burtonini.dbus.Signal", "Ping")
   print "Ping!"
   return gtk.TRUE

# Call send_ping every second to send the signal
gtk.timeout_add(1000, send_ping)
gtk.main()

Most of the code is self-explanatory: a connection to the bus is obtained, and the service com.burtonini.dbus.SignalService is registered. Then a minimal D-BUS object is created and every second a signal is broadcast from the object. This code is clearer than the corresponding C code, but the Python bindings still need work. (For instance, there is no way to add arguments to signals.)

Listing 4. dbus-ping-listen.py

#! /usr/bin/env python

import gtk
import dbus

bus = dbus.Bus()

def signal_callback(interface, signal_name, service, path, message):
   print "Received signal %s from %s" % (signal_name, interface)

# Catch signals from a specific interface and object, and call signal_callback
# when they arrive.
bus.add_signal_receiver(signal_callback,
                       "com.burtonini.dbus.Signal", # Interface
                       None, # Any service
                       "/" # Path of sending object
                       )

# Enter the event loop, waiting for signals
gtk.main()

This code is more concise than the equivalent C code in dbus-ping-listen.c and is easier to read. Again, there are areas where the bindings still need work (when calling bus.add_signal_receiver, the user must pass in an interface and an object path; otherwise, malformed matchers are created). This is a trivial bug, and once it is fixed, the service and object path arguments could be removed, improving the readability of the code even more.

Conclusion

D-BUS is a lightweight yet powerful remote procedure call system with minimal overhead costs for the applications that wish to use it. D-BUS is under active public development by a group of very experienced programmers. Acceptance of D-BUS by early adopters is rapid, so it appears to have a rosy future on the Linux desktop.

Resources

You'll find info, downloads, documentation, and more at the D-BUS home page.
D-BUS is developed as part of freedesktop.org/.
CORBA is a powerful, standardized remote procedure call specification.
ORBit is the CORBA implementation used in GNOME. (The GNOME component system Bonobo is built on top of ORBit).
KDE's remote procedure call implementation is DCOP.
Project Utopia aims to build seamless integration of hardware in Linux and uses D-BUS to achieve this.
Previously for developerWorks, Ross wrote Wrap GObjects in Python (developerWorks, March 2003), which shows how you can use a C-coded GObject in Python whenever you like, whether or not you're especially proficient in C.
The tutorials Bridging XPCOM/Bonobo: Techniques (developerWorks, May 2001) and Bridging XPCOM/Bonobo: Implementation (developerWorks, May 2001) discuss concepts and techniques required for bridging two component architectures so that the components from one architecture can be used in another environment.
Connect KDE applications using DCOP (developerWorks, February 2004) introduces KDE's inter-process communication protocol and how to script it.
Synchronizing processes and threads (developerWorks, October 2001) looks at inter-process synchronization primitives as a way to control two processes' access to the same resource.
CORBA Component Model (CCM) outlines the CORBA specification and CORBA interoperability with other component models.
Find more resources for Linux developers in the developerWorks Linux zone.
Browse for books on these and other technical topics.
Download no-charge trial versions of selected developerWorks Subscription products that run on Linux, including WebSphere Studio Site Developer, WebSphere SDK for Web services, WebSphere Application Server, DB2 Universal Database Personal Developers Edition, Tivoli Access Manager, and Lotus Domino Server, from the Speed-start your Linux app section of developerWorks. For an even speedier start, help yourself to a product-by-product collection of how-to articles and tech support.

About the author

Ross Burton is an average computer science graduate who by day codes Java and embedded systems. By night, to get away from the horrors, he prefers Python, C, and GTK+. You can contact Ross at r.burton@180sw.com.

Three scripts for package management on Debian and Ubuntu systems

2009-07-11T09:16:00.000-07:00

Five of the top 10 most downloaded distributions on Distrowatch use the Debian package system. It has developed a rich infrastructure of utilities -- not just the core commands apt-get and dpkg, but also such less well-known commands as apt-cache, apt-spy, and apt-listbugs. In addition, an array of other scripts, some mashups of existing utilities, and some original, are regularly available on sites like openDesktop.org. Such scripts help to streamline the process of keeping a Debian-based package system in working order, and provide information to help you make better decisions about software installation.

These scripts join a host of graphical front ends to apt-get and GUI tools for searching package repositories. However, because efficient package management is still done at the command line, they have a relevance that many command lines tools lack today. Some are simple, some are specific to one distribution (usually Ubuntu), and you might need to modify them before they suit your needs. However, all can be surprisingly useful if you believe in making hands-on decisions about the contents of your system instead of relying on the update applet in your notification tray. Here are three excellent examples.

Apt-utility

Apt-utility is a simple bash script designed for those who like to keep their systems constantly up to date, and would prefer not to enter the commands one at a time.

Unfortunately, the script is a little muddled in the apt-get commands that it issues. It begins, reasonably enough, by using apt-get update to make sure that the package repositories are current. However, it then runs apt-get upgrade, followed immediately by apt-get dist-upgrade -- which is a redundancy, since dist-upgrade does everything that upgrade does, as well as handling the dependencies in new versions of packages. Then it runs apt-get clean, followed by apt-get autoclean, leaving autoclean with nothing to do, since clean has already cleared out the /var/cache/apt/archives directory. The script ends with apt-get autoremove to remove packages that were installed as dependencies for packages that are no longer on the system.

You can fix those issues with a little judicious editing. While you are removing apt-get upgrade and apt-get autoclean from the script, you can also remove sudo from the start of every line of the script if you are not using the sudo command to access the root account (by default, Debian does not use sudo, while Ubuntu does).

You should also be check which repositories are enabled in /etc/apt/sources.list before you use this script or your own version of it. Used with the stable or even the testing repositories of Debian, Apt-utility should be safe, but automated updates with the unstable or experimental repositories enabled could result in broken dependencies and, in extreme cases, even major system problems.

Ubucleaner

Although it's intended primarily for Ubuntu, Ubucleaner is a grab-bag script that works -- mostly -- with other Debian-based distributions as well. The script cleans the apt-cache, removes the configuration files for removed packages, removes all kernels except the present one, and empties the trash for every user on the system. The kernel removal function works only with Ubuntu kernels.

All these tasks have in common is that they remove extra files from the system, so you might want to edit the script or comment out sections that you don't want. In particular, considering that a backup kernel may be useful if tinkering disables your current one, you might want to disable the kernel removal feature -- as well as the "Removing old kernels" message, so you don't have a heart attack when you run the script.

The script assumes that you are using the text-based Aptitude application, rather than apt-get and dpkg. If you are not using Aptitude, you should also replace the reference to aptitude clean with apt-get clean and the reference to aptitude purge to dpkg --purge.

daptup

Like Ubucleaner, daptup is intended for use with Aptitude. However, it is far safer than Ubucleaner, since it is purely informational, building for Debian-derived distributions lists of new packages, upgradeable packages, watched packages, and outdated packages that have upgrades available. You can use these lists to plan your software upgrades.

You can configure the content of these lists by editing the file /etc/daptup.conf. Here you can set such criteria as how many days old a package should be before it is listed as outdated, what packages on your system to watch, and what packages to watch that are uninstalled. You might, for instance, want to keep checking on whether the latest version of OpenOffice.org has arrived in a repository, or to wait until Gnash reaches its 1.0 release before you install it. The configuration file is heavily commented and includes examples, so you should have little trouble setting daptup to run exactly as you want.

If you do not automatically upgrade, or if you know that a large number of packages has recently flooded into the repositories you use, you might want to run daptup piped into either the less or more command (for instance, daptup | less); otherwise, the lists could easily be longer than your display buffer, so that the first entries disappear before the last one is visible. Alternatively, you might comment out some of the lists in /etc/daptup.conf, or change the number of lines in the display buffer in your terminal program's configuration settings.

Conclusion

There are many other scripts out on the Internet for Debian-based package management. For instance, UnusedPkg lists programs on the system that are not used and therefore might be removable, but the download is apparently no longer available. And for more advanced users who want to examine and compare dpkg status files, the awk script dpkg-diff might come in handy.

All these scripts help you gain more information about your system, and most are easy to modify even if you know little about any form of scripting. If you keep an eye on sites like openDesktop.org that list new applications, chances are that you will have no trouble finding utilities that allow you to make more intelligent decisions about the software you are running.

Bruce Byfield is a computer journalist who writes regularly for Linux.com.

dpkg tricks for Ubuntu / debian

2009-07-11T09:01:00.000-07:00

Posted by Fermi Level ( http://unixlab.blogspot.com)

In Debian GNU/Linux and its derivatives such as Ubuntu the software packages are bundled in a special format. We generally call them deb packages. A .deb package is basically
an archive of files that you want to install to your computer, plus some header and control
information that identifies the software. The deb files can be manipulated with dpkg command. Here are some common dpkg tricks that you can use in every day life on the Ubuntu/Debian systems.
Let us first get a debian package from Internet. I am using Ubuntu 9.04 for this tutorial and will be using aspell as a demo package. Download aspell from the Jaunty repository.

Installing a package manually.

# dpkg -i aspell_0.60.6-1_i386.deb

Removing the package

# dpkg -r aspell

#dpkg -P aspell ( Removes everything including config files.)

Now Let us explore the contents of a deb package.

Make a temporary directory.

#mkdir aspell_tmp
Extract the deb to the aspell_tmp directory.

# dpkg -x aspell_0.60.6-1_i386.deb aspell_tmp

You can see the package contents.
( Try ls -lR aspell_tmp)

The control information alone can be extrcted using -e flag instead of -x.
Or you can list the contents of a deb package as below.
# dpkg -c aspell_0.60.6-1_i386.deb

You can get details about the package with

#dpkg -p aspell
#dpkg -s aspell

If you find a strange file on your system you can check if it belongs to any package. Let us check the file /usr/share/man/man1/aspell.1.gz ( man page of aspell)
$ dpkg -S /usr/share/man/man1/aspell.1.gz
aspell: /usr/share/man/man1/aspell.1.gz

To see the installed files belonging to aspell try this
# dpkg -L aspell

If the package is not removed completely, you may see some configuration files left over.

Chuyển qua lại các dạng file cài của Linux(deb, rpm, pkg...).

2009-07-08T18:39:00.000-07:00

Để chuyển qua lại giữa các dạng file bạn cd đến thư mục cần chuyển đổi gõ alien [options] file [...]

file [...] Package file or files to convert.
-d, --to-deb Generate a Debian deb package (default).
Enables these options:
--patch= Specify patch file to use instead of automatically
looking for patch in /var/lib/alien.
--nopatch Do not use patches.
--anypatch Use even old version os patches.
-s, --single Like --generate, but do not create .orig
directory.
--fixperms Munge/fix permissions and owners.
--test Test generated packages with lintian.
-r, --to-rpm Generate a Red Hat rpm package.
--to-slp Generate a Stampede slp package.
-l, --to-lsb Generate a LSB package.
-t, --to-tgz Generate a Slackware tgz package.
Enables these options:
--description= Specify package description.
--version= Specify package version.
-p, --to-pkg Generate a Solaris pkg package.
-i, --install Install generated package.
-g, --generate Generate build tree, but do not build package.
-c, --scripts Include scripts in package.
-v, --verbose Display each command alien runs.
--veryverbose Be verbose, and also display output of run commands.
-k, --keep-version Do not change version of generated package.
--bump=number Increment package version by this number.
-h, --help Display this help message.
-V, --version Display alien's version number.

Ví dụ, mình vừa thử convert file pidgin-groupmsg_2.2.0-2_i386.deb sang pidgin-groupmsg_2.2.0-2_i386.rpm, mình gõ

alien -r pidgin-groupmsg_2.2.0-2_i386.deb

0-day in Microsoft DirectShow (msvidctl.dll) used in drive-by attacks

2009-07-08T08:52:00.000-07:00

Published: 2009-07-06,
Last Updated: 2009-07-07 14:08:53 UTC
by Stephen Hall (Version: 2)

A 0-day exploit within the msVidCtl component of Microsoft DirectShow is actively being exploited through drive-by attacks using thousands of newly compromised web sites, according to CSIS. The code has been published in the public domain via a number of Chinese web sites.

Please keep a watchful eye on your AV and IDS/IPS vendors updates to ensure coverage as early as possible on this exploit as it is likely to be widely deployed with the code being available.

A valid work around for the attack vector is available which set's the kill bit on the vulnerable DLL.

Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet ExplorerActiveX Compatibility{0955AC62-BF2E-4CBA-A2B9-A63F772D46CF}]
"Compatibility Flags"=dword:00000400

Details of the exploit are available on the CSIS web site, but are included below:

var appllaa='0';

var nndx='%'+'u9'+'0'+'9'+'0'+'%u'+'9'+'0'+'9'+appllaa;

[SHELL CODE REMOVED]

var headersize=20;

var omybro=unescape(nndx);

var slackspace=headersize+dashell.length;

while(omybro.length<0x30000) shuishimvp="shuishiMVP+shuishiMVP+bZmybr;" memory="new" x="0;x<300;x++)" myobject="document.createElement('object');" width="'1';" height="'1';" data="'./logo.gif';" classid="'clsid:0955AC62-BF2E-4CBA-A2B9-A63F772D46CF';

UPDATE July 6, 2009 19:00 UTC

Microsoft have released an advisory for the exploit, it can be found here :
http://www.microsoft.com/technet/security/advisory/972890.mspx

In addition, they have published a number of blog entries to cover their user base:
http://blogs.technet.com/msrc/default.aspx
http://www.microsoft.com/technet/security/advisory/default.mspx
http://blogs.technet.com/srd/

Some ways to restore Grub

2009-07-03T18:33:00.000-07:00

First :
1. Pop in the Live CD, boot from it until you reach the desktop.
2. Open a terminal window or switch to a tty.
3. Type "grub"
4. Type "root (hd0,6)", or whatever your harddisk + boot partition numbers are (my /boot is at /dev/sda7, which translates to hd0,6 for grub).
5. Type "setup (hd0)", ot whatever your harddisk nr is.
6. Quit grub by typing "quit".
7. Reboot.

Or

1. Boot your computer up with Ubunto CD
2. Go through all the process until you reech "[!!!] Disk Partition"
3. Select Manual Partition
4. Mount your appropriate linux partions

/
/boot
swap
.....

5. DO NOT FORMAT THEM.
6. Finish the manual partition
7. Say "Yes" when it asks you to save the changes
8. It will give you errors saying that "the system couldn't install ....." after that
9. Ignore them, keep select "continue" until you get back to the Ubuntu installation menu
10. Jump to "Install Grub ...."
11. Once it is finished, just restart your computer

How to update the custom compiled kernel to a new release using git

2009-06-30T01:05:00.000-07:00

In a previous article I addressed how to compile a kernel for Ubuntu Intrepid using git and in a follow up article I explained how to compile a new release if you already compiled your own custom kernel using git. The upgrade article was written if the kernel upgrade was one where the only ABI number changed was the last one.
In this article I’ll explain how you can update your previously compiled custom kernel to a newer version, if you used git. This article won’t touch an upgrade of kernel 2.6.27 to 2.6.28.

Updates:
Jan 9, 2009: Added git add to the “commit your changes” section.

The base of this article is that you already compiled a your own kernel with git using my previous article.

A lot of the steps are similar to my previous article but there are a few extra steps and liek I mentioned earlier I also explain how to handle the situation where the Ubuntu git repository is already in the next development cycle.

On October 31st, 2008 I have a made a few changes in the article, Compiling a custom kernel for Ubuntu Intrepid using git, to help compiling an upgrade of the kernel a bit easier. If you compiled a kernel prior to this you need to follow the steps in Preparing manual upgrade otherwise you can skip this step and go straight to Upgrading the source. If you read this article to update your kernel again you can also go straight to Upgrading the source.

Preparing manual upgrade

We need to work in our created branch

git checkout core2

We’re going to copy all the files we needed to change, restore the branch to it’s original starting point and copy all of our files back again. To keep remember this state we’ll do a commit.

cp debian/abi/2.6.27-7.13/i386/core2 ..
cp debian/abi/2.6.27-7.13/i386/core2.modules ..
cp debian/scripts/misc/getabis ..
cp debian/rules.d/i386.mk ..
cp debian/control.stub ..
cp debian/control ..
git reset --hard
git git clean -xdf
cp ../core2 debian/abi/2.6.27-7.13/i386/
cp ../core2.modules debian/abi/2.6.27-7.13/i386/
cp ../getabis debian/scripts/misc/
cp ../i386.mk debian/rules.d/
cp ../control.stub debian/
cp ../control debian/
git commit -a -m "Core2 modifications"

Upgrading the source

It’s time to get the new kernel source.
We’re going to update our master branch and use the master branch to update our own core2 branch.

git checkout master
git pull

If you have a problem switching to the master branch and you are stuck in the core2 branch use the following commands

git reset HEAD --hard
git clean -xdf
git checkout master
git pull

We now have the latest kernel source but we don’t want to the updates that are part of the next release.
To check for the latest tagged version the easiest way is to check the debian changelog.

 less debian/changelog

Look for the second section of the changelog

linux (2.6.27-10.21) UNRELEASED; urgency=low

CHANGELOG: Do not edit directly. Autogenerated at release.
CHANGELOG: Use the printchanges target to see the curent changes.
CHANGELOG: Use the insertchanges target to create the final log.

--  Tim Gardner   Mon, 24 Nov 2008 10:50:51 -0700

linux (2.6.27-10.20) intrepid-proposed; urgency=low

In this case the latest tagged version is 2.6.27-10.20
Let’s find the git tag name for this version

git tag -l *2.6.27-10.20*

This will result in

Ubuntu-2.6.27-10.20

We want to reset our git repository to this state, as we don’t want the unreleased updates

 git reset Ubuntu-2.6.27-10.20 --hard

To check if the above command really worked

git log

And log should say:

 UBUNTU: Ubuntu-2.6.27-10.20

Now that the master branch is all set we can go into our core branch and get ready for compilation.

git checkout core2
git reset --hard
git clean -xdf
git merge master

Because we added files to the directory

debian/abi/2.6.27-7.16/i386/

we need to move these files ourselves to the new abi directory

mv debian/abi/2.6.27-7.16/i386/core2* debian/abi/2.6.27-8.17/i386
rm -rf debian/abi/2.6.27-7.16

We need to edit the control file debian/control.
In the sections of core2 we created we need to change all the references to -7 to -10. I usually do it using vi, search for -7 and manually replacing it with -10.

Now we need to commit our changes in the git repository

git add.
git commit -a -m "Core2 modifications"

The text after -m is the message you add to your commit.

Compilation

It’s time for compiling.

CONCURRENCY_LEVEL=2 NOEXTRAS=1 skipabi=true skipmodule=true fakeroot debian/rules binary-core2

As we are upgrading to a higher version of the kernel we also need to compile the default linux-headers file

CONCURRENCY_LEVEL=2 NOEXTRAS=1 skipabi=true skipmodule=true fakeroot debian/rules binary-indep

Installation

After the compilation is finished we’ll have two deb files in the parent directory. To install the files

dpkg -i linux-image-2.6.27-10-core2_2.6.27-10.20_i386.deb
dpkg -i linux-headers-2.6.27-10-core2_2.6.27-10.20_i386.deb linux-headers-2.6.27-10_2.6.27-10.20_all.deb

Check your bootloader if the newly installed kernel is the default one, for grub edit the file /boot/grub/menu.lst

Reboot and enjoy your newly installed kernel.

I	A	B	C	D	AB	AC	AD	BC	BD	CD	ABC	ABD	ACD	BCD	E
1	-1	-1	-1	-1	1	1	1	1	1	1	-1	-1	-1	-1	1
1	-1	-1	-1	1	1	1	-1	1	-1	-1	-1	1	1	1	-1
1	-1	-1	1	-1	1	-1	1	-1	1	-1	1	-1	1	1	-1
1	-1	-1	1	1	1	-1	-1	-1	-1	1	1	1	-1	-1	1
1	-1	1	-1	-1	-1	1	1	-1	-1	1	1	1	-1	1	-1
1	-1	1	-1	1	-1	1	-1	-1	1	-1	1	-1	1	-1	1
1	-1	1	1	-1	-1	-1	1	1	-1	-1	-1	1	1	-1	1
1	-1	1	1	1	-1	-1	-1	1	1	1	-1	-1	-1	1	-1
1	1	-1	-1	-1	-1	-1	-1	1	1	1	1	1	1	-1	-1
1	1	-1	-1	1	-1	-1	1	1	-1	-1	1	-1	-1	1	1
1	1	-1	1	-1	-1	1	-1	-1	1	-1	-1	1	-1	1	1
1	1	-1	1	1	-1	1	1	-1	-1	1	-1	-1	1	-1	-1
1	1	1	-1	-1	1	-1	-1	-1	-1	1	-1	-1	1	1	1
1	1	1	-1	1	1	-1	1	-1	1	-1	-1	1	-1	-1	-1
1	1	1	1	-1	1	1	-1	1	-1	-1	1	-1	-1	-1	-1
1	1	1	1	1	1	1	1	1	1	1	1	1	1	1	1

I	A	B	C	D	AB	AC	AD	BC	BD	CD	ABC	ABD	ACD	BCD	E
1	-1	-1	-1	-1	1	1	1	1	1	1	-1	-1	-1	-1	1
1	-1	-1	-1	1	1	1	-1	1	-1	-1	-1	1	1	1	-1
1	-1	-1	1	-1	1	-1	1	-1	1	-1	1	-1	1	1	-1
1	-1	-1	1	1	1	-1	-1	-1	-1	1	1	1	-1	-1	1
1	-1	1	-1	-1	-1	1	1	-1	-1	1	1	1	-1	1	-1
1	-1	1	-1	1	-1	1	-1	-1	1	-1	1	-1	1	-1	1
1	-1	1	1	-1	-1	-1	1	1	-1	-1	-1	1	1	-1	1
1	-1	1	1	1	-1	-1	-1	1	1	1	-1	-1	-1	1	-1
1	1	-1	-1	-1	-1	-1	-1	1	1	1	1	1	1	-1	-1
1	1	-1	-1	1	-1	-1	1	1	-1	-1	1	-1	-1	1	1
1	1	-1	1	-1	-1	1	-1	-1	1	-1	-1	1	-1	1	1
1	1	-1	1	1	-1	1	1	-1	-1	1	-1	-1	1	-1	-1
1	1	1	-1	-1	1	-1	-1	-1	-1	1	-1	-1	1	1	1
1	1	1	-1	1	1	-1	1	-1	1	-1	-1	1	-1	-1	-1
1	1	1	1	-1	1	1	-1	1	-1	-1	1	-1	-1	-1	-1
1	1	1	1	1	1	1	1	1	1	1	1	1	1	1	1

Cafehack Group

PAC Manager - Trình quản lý terminal trên linux tốt nhất.

How to add kernel module to RHEL/Centos to fix unsupport driver

Ten Commands Every Linux Developer Should Know

Performance Analysis of OpenVPN on a Consumer Grade Router

Abstract:

Table of Contents

1 Introduction

1.1 Background

1.2 The VPN

1.3 The Router

2 VPN Characteristics

2.1 Transport Protocol

2.2 Performance Metrics

2.3 System Parameters

3 Performance Analysis

3.1 Measurement Tools

3.2 Experimental Setup

3.3 Experimental Results

3.4 Future Work

4 Summary

References

List of Acronyms

Memory Management in vSphere

Bacula - Open Source network backup and restore solution

ALSA Upgrade Script

Split / Cut a String

HỊCH KHOA HỌC CÔNG NGHỆ

Quick setup LemonPos

Fix apport problem when upgrade Ubuntu

Solve "Monitor is unkown and messed up" problems

The difference of copy_to_user/copy_from_user and put_user/get_user

10 common network security design flaws

1: Set it and forget it

2: Opening more firewall ports than necessary

3: Pulling double duty

4: Ignoring network workstations

5: Failing to use SSL encryption where it counts

6: Using self-signed certificates

7: Excessive security logging

8: Randomly grouping virtual servers

9: Placing member servers in the DMZ

10: Depending on users to install updates

C Programming Tips 1

Contents

I need help with my homework!

Please don't void my main()!

ANSI/ISO/IEC 9899:1990 International Standard For C

ANSI/ISO/IEC 14882:1998 International Standard For C++

Practical Reasons To Return An int from main()

What should my "int main()" return?

C++ Note

What should I use instead of gets()?

How do I input numbers as binary strings?

How do I output numbers as binary strings?

C++ Notes For Using These Functions

ATI : Binary Driver Howto

Prerequisites

Install from Ubuntu repositories (easier)

Instructions for Ubuntu 9.04 (Jaunty)

JAUNTY NOTICE

Instructions for Ubuntu 8.04 (Hardy) and 8.10 (Intrepid)

Instructions for Kubuntu 7.10 (Gutsy)

Instructions for Ubuntu 7.10 (Gutsy)

Instructions for 6.06 (Dapper)

Troubleshooting

Install from ati.com (latest version of drivers)

Instructions for Ubuntu 8.04 (Hardy) with ATi 8.443.1-1 and above binary drivers

Instructions for 6.06 (Dapper)

Seveas Repository

Modifying xorg.conf

More Troubleshooting

General Troubleshooting

Video-out

Black and White/Wrong Colours or Scrolling Picture

Safely Creating Temporary Files in Shell Scripts

Safely Creating Temporary Files in Shell Scripts

0. Abstract

1. Introduction

1.1 Why I wrote this

I	A	B	C	D	AB	AC	AD	BC	BD	CD	ABC	ABD	ACD	BCD	E
1	-1	-1	-1	-1	1	1	1	1	1	1	-1	-1	-1	-1	1
1	-1	-1	-1	1	1	1	-1	1	-1	-1	-1	1	1	1	-1
1	-1	-1	1	-1	1	-1	1	-1	1	-1	1	-1	1	1	-1
1	-1	-1	1	1	1	-1	-1	-1	-1	1	1	1	-1	-1	1
1	-1	1	-1	-1	-1	1	1	-1	-1	1	1	1	-1	1	-1
1	-1	1	-1	1	-1	1	-1	-1	1	-1	1	-1	1	-1	1
1	-1	1	1	-1	-1	-1	1	1	-1	-1	-1	1	1	-1	1
1	-1	1	1	1	-1	-1	-1	1	1	1	-1	-1	-1	1	-1
1	1	-1	-1	-1	-1	-1	-1	1	1	1	1	1	1	-1	-1
1	1	-1	-1	1	-1	-1	1	1	-1	-1	1	-1	-1	1	1
1	1	-1	1	-1	-1	1	-1	-1	1	-1	-1	1	-1	1	1
1	1	-1	1	1	-1	1	1	-1	-1	1	-1	-1	1	-1	-1
1	1	1	-1	-1	1	-1	-1	-1	-1	1	-1	-1	1	1	1
1	1	1	-1	1	1	-1	1	-1	1	-1	-1	1	-1	-1	-1
1	1	1	1	-1	1	1	-1	1	-1	-1	1	-1	-1	-1	-1
1	1	1	1	1	1	1	1	1	1	1	1	1	1	1	1