If you aren’t able to get your GTK theme to work apply one of the other themes available, and then select use GTK theme.

Also if you want to enable Flash do the following

$ sudo updatedb
$ locate libflashplayer.so
$ mkdir /opt/google/chrome/plugins/
$ cp [insert libflashplayer.so location here] /opt/google/chrome/plugins/

Now change the shortcut for Chrome to

/opt/google/chrome/google-chrome --enable-plugins %U

Enjoy the speed and smoothness that is Chrome.

#/usr/bin/python2.6
#
# ziptest.py
import sys
print sys.argv

and for the sake of this example we will have another file with the header. The best thing to do would be to make a system that added this to the beginning of the file when building it. We will name this file zip_template.py

#/usr/bin/python2.6
#
# Copyright 2009, ME

So lets zip up the __main__.py file and then concatenate the two files together to create our archive. We also need to make it executable.

$ zip tmp_appname.zip __main__.py
$ cat zip_template.py tmp_appname.zip > appname.zip
$ rm tmp_appname.zip
$ chmod +x appname.zip
$ ./appname.zip
['./appname.zip']

There you have it. You can now bundle your Python code in a zip file and run it just like you would a Java jar. It also doesn’t have to end with .zip you can name it .par or no extension at all if you like.

I would like to see support for encrypted zip files so that you can encrypt this archive and Python will prompt for the password.

/var/efw/main/settings
     HOSTNAME=$hostname
/var/efw/main/hostname.conf
     ServerName $hostname

To start this off you need to install Mercurial

sudo [yum or apt-get] install mercurial

The next step is initializing the repository in your home directory and protect others from being able to read files.

$ cd ~
$ hg init
$ chmod 700 .hg/

In my previous post a commenter pointed out something I was not aware of. When using git if you were to run ‘git clean’ all files not under version control would get deleted. You should be doing regular backups anyway, but that is certainly something we do not want to be able to do on accident. The hg equivalent is ‘hg purge’, but purge is a bundled extension that must be enabled, and because it might be enabled we want to explicitly disable that plugin from being able to work in our repository. To do so you put the following line in ~/.hg/hgrc, because that file will take precedence over conf files in etc and your ~/.hgrc file.

[extensions]
hgext.purge = !

You can store anything you would like to in this repository, but there is most likely going to be some files, and very large files at that, that you do not want to store. To fix that we are going to start off by ignoring everything in your home directory and selectively removing files from the list that we want to store. The following commands are going to list all non-hidden files, but listing directories first, the second command lists everything except for ‘.’ and ‘..’ directory references and greps for all hidden files and lists them directories first. One thing to note is that the –group-directories-first option is not available on CentOS and the only distro I can confirm it exists in is Ubuntu.

$ ls -1 --group-directories-first > .hgignore
$ ls -1 --group-directories-first -A | grep '^\.' >> .hgignore
$ cat .hgignore
Applications
bin
Desktop
...
.cache
.checkbox
.compiz
...
.bash_aliases
.bash_history
.bash_logout
...
.xsession-errors

Go through the list and either comment out (prepend with #) or remove from .hgignore any file/directory names that you DO want to store in version control, any file listed in .hgignore will be ignored by mercurial, unless you ‘hg add’ the file or directory.

If you want to see what files will be picked up by an ‘hg add’ you can run ‘hg status’

$ hg status
? .bash_history
? .bash_logout
? .bash_profile
? .bashrc
? .hgignore
? .hgrc
? .mysql_history
? .screenrc
? bin/mysqltuner.pl

If that is satisfactory you can now run ‘hg add’ to add the files listed here.

$ hg add
adding .bash_history
adding .bash_logout
adding .bash_profile
adding .bashrc
adding .hgignore
adding .hgrc
adding .mysql_history
adding .screenrc
adding bin/mysqltuner.pl

And you can verify it by again running ‘hg status’

$ hg status
A .bash_history
A .bash_logout
A .bash_profile
A .bashrc
A .hgignore
A .hgrc
A .mysql_history
A .screenrc
A bin/mysqltuner.pl

So go ahead now and run ‘hg commit’ and we can deal with individual files under ignored directories afterwards. Running ‘hg commit’ should be default use vi as your editor so after writing your description his Esc, then type :wq and it will commit.

Initial commit of home directory files.

Contains mostly bash dot files, but also a script in my bin directory

HG: Enter commit message.  Lines beginning with 'HG:' are removed.
HG: Leave message empty to abort commit.
HG: --
HG: user: Peter Manis <manis@pyverted.com>
HG: branch 'default'
HG: added .bash_history
HG: added .bash_logout
HG: added .bash_profile
HG: added .bashrc
HG: added .hgignore
HG: added .hgrc
HG: added .mysql_history
HG: added .screenrc
HG: added bin/mysqltuner.pl

So there were a couple directories I had in my .hgignore file that I would like to store certain files in version control. The first is .ssh and the second is .irssi. So to do this we run ‘hg add’ and then ‘hg commit’

$ hg add .ssh/config
$ hg add .irssi/config
$ hg status
A .irssi/config
A .ssh/config
$ hg commit
Adding files that are under ignored directories

HG: Enter commit message.  Lines beginning with 'HG:' are removed.
HG: Leave message empty to abort commit.
HG: --
HG: user: Peter Manis <manis@pyverted.com>
HG: branch 'default'
HG: added .irssi/config
HG: added .ssh/config

Let us now take a look at the local commits that we have.

$ hg log
changeset:   1:5ca5d6d283fe
tag:         tip
user:        Peter Manis <manis@pyverted.com>
date:        Thu Aug 13 19:48:16 2009 -0400
summary:     Adding files that are under ignored directories

changeset:   0:d0e3d9042208
user:        Peter Manis <manis@pyverted.com>
date:        Thu Aug 13 19:43:06 2009 -0400
summary:     Initial commit of home directory files.

We now need to prepare to push these local commits to our bitbucket private repository. To do this we need to setup ssh keys

$ ssh-keygen -t rsa -b 2048
Generating public/private rsa key pair.
Enter file in which to save the key (/home/mercurialguide/.ssh/id_rsa):
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in /home/mercurialguide/.ssh/id_rsa.
Your public key has been saved in /home/mercurialguide/.ssh/id_rsa.pub.
The key fingerprint is:
c5:fc:5b:3e:06:2c:3f:f9:17:51:bf:78:f8:60:ac:cb mercurialguide@hostname

Now sign up for a bitbucket account, create your first private repository, I called mine homedir. After you do that you need to go into your “Account” page and add your ssh public key to the list of ssh keys.

$ cat .ssh/id_rsa.pub
ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAwRewbcXoot9nUUZzonryDYKBhxapI69JRW5TNsxfJQEAw4l7VoA681sgHVA2B8T876Tn9uZrzMBgcEz4GMGVsrU31wVNa9p/HtBJCyp1zWKoitoR1wu2FdNRSgsjFOdlMJ6BIxchmG58/hwA88FZXdYgcKMe2WWQP7pDInhHIJhLKPoctXURr6kSM7TWLh4eO81amSE2GB77mCRIoqxI6Y0uQGqO6JDhFUQAPuErCJcfXSkO+Lv9XIyCwhclki2oZUMwvDyYYrHVHWCNZ/azY1C4Ea722CFSWQjAUI9ljA8yaYmLaI4tbgWu9bNQdNy7v9x9EMtq8Q828BF9LGb+tw== mercurialguide@hostname

You will also need to edit your .ssh/config file for bitbucket.

Host bitbucket.org
  User hg
  Compression yes

Now we can push changes to bitbucket

$ hg push ssh://bitbucket.org/manis/homedir/
pushing to ssh://bitbucket.org/manis/homedir/
searching for changes
remote: adding changesets
remote: adding manifests
remote: adding file changes
remote: added 2 changesets with 12 changes to 12 files
remote: bb/acl: manis is allowed. accepted payload.
remote: quota: 103.6 MB in use, 500.0 MB available (20.72% used)

And you’re done! You just setup a remote repository with your home directory files. Now that you have that setup remember that until you ‘hg push’ your changes they are only local.

I never liked the status output of Git, the Mercurial output was much closer to Subversion, which is what I was used to. A quick side note, I have read that most feel Mercurial is an easier move for Subversion users. With my first real Mercurial involvement needing a lot of adds and removes it was nice to have an ‘addremove’ command that quickly took care of this for me. With Git you had to run add on the files, which was not fun if you added a large number of new files. Before anything is said about adding files I will say that yes, if you are adding a lot of new files it is probably from adding a directory, which is more easily added, but I found a number of instances where I had to add a lot of files where it wasn’t that easy and writing out a one liner to do it just isn’t enjoyable.

The ability to serve a web interface straight from the command line was a feature I found very interesting, again being able to setup a complete environment it wasn’t something I really needed, but it was certainly a nice feature to have. Setting up a Mercurial/Apache environment is also much easier than doing it with Git. I love Trac, I use it for everything I can, but it was very difficult to use with Git for a couple reasons. The first was that the versions of software needed for the Trac plugin didn’t mesh well with the CentOS 5 environment it would be hosted on. The 2nd, which is one of my biggest gripes about Git is the revision id Git uses. Git uses full hashes like “b3ef65139dea83be5965a972159aa628847b763c” while Mercurial will use a number and a short hash like “0:3f7766464126″ and revisions can be referenced by either. Here is a visual comparison of the two.

• Git: OhLoh Labs
• Mercurial: Pylons

I’m sure you can see what a difference that makes, the Mercurial revision id is 1/3 the length of the Git.

Mercurial itself is written in Python, and it is pointed out in some of the pages I link to later that this allows the developers to concentrate on adding features and paying more attention to creating the best version control system instead of having to deal with all the issues that can be involved in maintaining more low level code like C/C++. When you don’t have to spend time on garbage collection and finding memory leaks you have more time to add in features like Mercurial’s archiving option. I can simple link to http://webaddress.com/repository/archive/tip.{zip,tar.gz,tar.bz2} and it will create an archive version of the tip, or what is also known as the last revision, but you can also link to tags and create archives based on that. It also allows me to very easily add autogenerated links to my Trac project index as well, seen below.

I think that Mercurial being written in Python influences my decision more than I may realize. I like to have the power to add and change things and considering that I write Python more than I do anything else these days that fits in very nicely. It means that if I want a feature I can write it, I don’t need to know C or C++ and with the design of Python the features can be more easily added and shared with others. An example of a quick and easy extension is the InfoExtension, which if you are used to Subversion will look very much like ’svn info’.

Back in April, Google added support for Mercurial to their project hosting service, which you can see even has integrated branch graphing. More recently Python creator Guido van Rossum announced they will be moving from Subversion to Mercurial along with a followup from Brett Cannon about the decision. There is also a detailed PEP about the selection of a distributed VCS.

These are just some of the things that I really liked about Mercurial, you can read a little more on the following pages:

• Five Features from Mercurial That Would Make Git Suck Less
• Why Mercurial > Git, or How I Learned To Stop Censoring Myself and Participate in Flamewars.

chkconfig NetworkManager off
chkconfig --levels 2345 network on
/etc/init.d/network restart

The file gets placed in ~/.gnome2/nautilus-scripts/ and will take a restart of X.

#!/bin/bash

FILENAME=`gdialog --title "MD5 File" --inputbox "Enter the name of the MD5 file (without extension)" 100 200 2>&1`
if [ ${#FILENAME} -lt 1 ]; then
  FILENAME=temp_name.md5
else
  FILENAME=$FILENAME.md5
fi

echo "#!/usr/bin/md5sum -c" > $FILENAME
/usr/bin/md5sum $* >> $FILENAME
chmod +x $FILENAME

An example, the following will let you run ./filename.md5 and have it return the results of the md5 check.

#!/usr/bin/md5sum -c

bf185a69398a7fa91b6006aae61f8be1  TracMercurial-0.11.0.7-py2.4.egg

$ chmod +x mercurial_plugin.md5
$ ./mercurial_plugin.md5
TracMercurial-0.11.0.7-py2.4.egg: OK

This file defines the locations for Desktop, Music, Templates, etc so I went ahead and moved those files to Dropbox so I can maintain the files across multiple machines.

While I’m on the topic of these directories, I want to mention the awesomeness that is the Templates directory. If you add the file “Python Script.py” to that directory and put in the following text:

#!/usr/bin/python2.5
#
# Copyright 2009

import sys

# Enter text here

You can then right click in a directory, go to “Create Document” you will see “Python Script” listed and if you select it a .py file will be created with the previous text in it. This directory lets you create templates for anything you want and easily use it to create documents.

In Ubuntu 9.04 a new application was introduced called etckeeper. This application uses various version control systems to store versions of files within etc. Some machines that I work on I keep my home directory very clean, and I go out of my way to keep things organized and stored in version control. I have dropped the ball on being so organized when it comes to my home desktop, but tonight, that changed. This is how to use version control with your home directory. I am not going to cover indepth topics about using Git or any other version control, this guide simply explains how to maintain a local repository.

The first step is to install your preferred version control system. In this case I am going to use git, since a lot of people are familiar with it.

sudo apt-get install git

Now we need to initialize our repository and prevent other users from having access.

$ cd ~
$ git init
Initialized empty Git repository in /home/user/.git/
$ chmod 700 .git

We don’t need to put every file under version control so we need to create a list of everything in our home directory and then remove what we don’t want. To do this we are first going to list all non-hidden files directories first, and then list all hidden files directories first followed by leaving out the current and parent directories. This list gets put in a file called .gitignore, a file that git reads to determine what files it should ignore.

$ ls -1 --group-directories-first > .gitignore
$ ls -1 --group-directories-first -A | grep '^\.' >> .gitignore
$ cat .gitignore
Applications
bin
Desktop
...
.cache
.checkbox
.compiz
...
.bash_aliases
.bash_history
.bash_logout
...
.xsession-errors

Now you should go through and remove files and directories you would like to have maintained in version control. You can also temporarily comment out a file with a # so that it will get added and then uncomment the file so that in the future changes will be ignored.

After editing .gitignore you can run ‘git status’ to verify the files that are not ignored.

$ git status
# On branch master
#
# Initial commit
#
# Untracked files:
#   (use "git add <file>..." to include in what will be committed)
#
#       .bash_aliases
#       .bash_history
#       .bash_logout
#       .bash_profile
#       .bashrc
#       .gitconfig
#       .gitignore
#       .hgrc
#       .nvidia-settings-rc
#       .profile
#       .screenrc
#       .ssh/
#       .subversion/
#       .vim/
#       .viminfo
#       .vimrc
nothing added to commit but untracked files present (use "git add" to track)

Some things you may want to leave out like in my case I don’t really want to have the auth information for subversion or ssh private keys stored in version control. For those specific things you can add lines like the following to your .gitignore file.

.ssh/id_*
.subversion/auth/

To test what files will be added and what will not be added you can do a dry run.

$ git add -n -A
add '.bash_aliases'
...
add '.screenrc'
add '.ssh/config'
add '.ssh/known_hosts'
add '.subversion/README.txt'
add '.subversion/config'
add '.subversion/servers'
add '.vim/colors/astronaut.vim'
...

Now we need to add the files to git and commit them.

$ git add -A
$ git commit -m "Initial commit of files in home directory"

Now if you make a change to .profile you can easily revert it

$ echo 'testing' >> .profile
$ git status
# On branch master
# Changed but not updated:
#   (use "git add <file>..." to update what will be committed)
#   (use "git checkout -- <file>..." to discard changes in working directory)
#
#       modified:   .profile
#
no changes added to commit (use "git add" and/or "git commit -a")
$ git checkout .profile
$ git status
# On branch master
nothing to commit (working directory clean)

And you’re done.

Mercurial

I have not decided which DVCS I will be using so I initialized a hg repository along side the git repository so that I can see the differences first hand. The mercurial command is ‘hg’ and the ignore file is .hgignore so this guide can be easily adapted to using mercurial. One nice benefit is that BitBucket’s free plan comes with a private repository so you can easily setup a remote repository to store it all.

#!/bin/bash

DISPLAY=:0.1
vlc -f $*

The other problem I ran into was that I would be presented with a page saying “Database Upgrade Required”, after upgrading it would bring me back to the same page. The problem ended up being the wp-content/object-cache.php file, moving that out fixed the problem. However because the page was still cached in memcache moving the file back raised the same issues. The faster fix is to restart memcache all together to clear the cache.

$ imap_count.py manis@digital39.com
Password for manis@digital39.com: *****
56578 messages in account manis@digital39.com

Expand the code below and copy it to a file on your system. It takes one argument, and that argument is a comma separated list of email addresses.

#!/usr/bin/python2.4
#
# Copyright (c) 2009, Peter Manis
# All rights reserved.
#
# Redistribution and use in source and binary forms, with or without
# modification, are permitted provided that the following conditions are met:
#
# Redistributions of source code must retain the above copyright notice, this
# list of conditions and the following disclaimer.
#
# Redistributions in binary form must reproduce the above copyright notice, this
# list of conditions and the following disclaimer in the documentation and/or
# other materials provided with the distribution.
#
# Neither the name of the Peter Manis nor the names of its contributors may
# be used to endorse or promote products derived from this software without
# specific prior written permission.
#
# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
# DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
# SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
# CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
# OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

import getpass
import imaplib
import sys

results = []

def RetrieveMsgCount(username, password):
  """Retrieves message count by accessing Gmail or Google Apps IMAP account.

  Args:
    username: str, Username of the account we are accessing.
    password: str, Password of the account we are accessing.

  Returns:
    count: str, Number of messages in IMAP account

  Raises:
    imaplib.IMAP4.error: Failed to login to the IMAP account.
  """
  try:
    imap = imaplib.IMAP4_SSL('imap.gmail.com', 993)
    imap.login(username, password)
    status, [count] = imap.select ("[Gmail]/All Mail")
    imap.close()
    imap.logout()
  except imaplib.IMAP4.error:
    return 'Unable to check'
  else:
    return count

def main():
  if len(sys.argv) > 1:
    accounts = sys.argv[1]
    for account in accounts.split(','):
      password = getpass.getpass("Password for %s: " % account)
      results.append('%s messages in account %s' % (
          RetrieveMsgCount(account, password), account))
    for account in results:
      print account
  else:
    print "Please provide a comma separated list of accounts to check."

if __name__ == '__main__':
  main()

What sparked this post was that someone on a mailing list I belong to asked about installing KDE in Ubuntu so that he could switch back and forth between KDE and Gnome, an email sent on the 8th of May. A few of us gave him commands he could run, and links to topics related to this, each one being shot down for some reason or another. Eventually a couple people made comments about how maybe Linux wasn’t for him, and so on, and he started to get defensive, which he has the right to do, but he started explaining how he works with over 100 servers and has been using Linux for like 8 years. Someone called him out by saying that with that much experience he should have been able to install KDE, which is very true, there might have been a couple problems to fix, but finding what packages to install should have been quite simple. The user then came back with this email about how we must have unlimited time to learn all of this stuff, and how he doesn’t have the time to spend figuring something out that many people have figured out already and then ending the email with comments about how if the list becomes unhelpful he will unsubscribe.

A big mistake he made was sounding ungrateful for the help he did receive. He thanked a few of us as we replied, but they were “Thanks, but” replies, telling us what was wrong with our response. By giving the attitude that your time is more valuable than ours is not the greatest way to get help. If you really want to make it about the value of an hour unless you are a doctor or a lawyer we can most likely bill more per hour than you can. Acting like you are some big shot by listing off the stuff you do isn’t a great thing to do either, you don’t know the audience, when you have people with a lot of experience hearing you make comments about how awesome you are, and you can’t install KDE it really makes you look like an ass.

Before you send an email to a list or to a group you need to think about the time you are taking away from other people’s day. If 200 people read your email, and it takes them 2 minutes a piece, but the answer to your question shows up in the top 5 results in Google, you just wasted 400 minutes of people’s time for something you could have found in 5 seconds. In the case of this guy it took me longer to read his replies than it did to search for a quick howto or give him a command he could run to find out what to install.

I hope this helps some of you who have been annoyed at your friend or acquaintance because they came across as having an attitude or they got upset with you.

In 2007 a friend and I both started moving out equipment to rack mount setups. We each had our own reasons, but the common reasons were saving space, organization, and it is kinda nice to say you have a rack in your house. When I was looking for a rack/cabinet I found someone a couple hours away that had a lightly used 45U fully enclosed cabinet for sale. The cabinet came with sides, doors, caster base, two shelves, four-fan unit for the top, and a $350 price tag. A few days after picking up the cabinet I spoke with him again and we made a deal that resulted in me having an entire car full (trunk full and front and back seats full to the ceiling) of equipment. I recreated an album containing the older pictures of the cabinet, and how things were organized, which can be viewed in the Rack Project album.

After moving to Atlanta I was able to acquire even more rack mount equipment and fill in some of the gaps I had to leave empty in the beginning. The details of what is in the cabinet can be read on my Gear page, but here is a parent list.

• Linksys WRT54G 4-Port 10/100 54mb Wireless Router
• Canon CanoScan 8400F
• brother HL Series HL-2070N Laser Printer,
• 4U, Intel Core 2 Duo E6750 Desktop
• 5U, AMD Athlon 64 X2 4000+ File Server
• 1U, Intel Pentium III, 850mhz Endian Firewall/Router
• 1U, Intel Pentium 4, 2.4ghz IBM x305 Servers (x4)
• 1U, Tripp Lite HTR07-1U UPS (x2)
• 1U, Dell PowerConnect 5012 Gigabit Switch
• 1U, Cisco Catalyst 2900 XL 24 port Switch
• 1U, CAT5e 24 port Patch Panel
• 1U, Rack Writer
• 2U, Intel Pentium 4, 2.6C Linux Desktop

I am currently not using the Cisco switch, the 2U desktop, or any of the x305 1Us on a regular basis. With the monitor and 5.1 audio connected to the same power source I am pulling 515 watts right now, which does raise the power bill, but not to an outrageous amount.

I am opening up time to start doing a little consulting so I have taken some time to organize the work space and make it a better work environment. The following pictures are of my home office that were taken on March 2nd, Home Office album is on PicasaWeb.

This afternoon I removed Boxee and hit menu, FrontRow opened, as it should have, and then I tried it on iTunes and it was successful. I’m not entirely sure what caused the problem, but I didn’t use Boxee enough to bother keeping it on the machine anyway.

This image was also created using the Google chart api, so it is very easy to integrate into a site that holds contact information. I think I will add a QR code to my business cards to make it easier for people to save my information. I should also mention it does not have to be an Android based phone. Do a search for QR codes on mobile devices and you should be able to find some solutions.

In Windows you can really put some detail in the ACLs, but with Linux you either need ACLs implemented or you need to understand how file permissions work. So first off, lets use the following example

# ls -l /
drwxr-xr-x  13 root root  4096 Apr 27  2007 usr
drwxr-xr-x  20 root root  4096 Oct  3 00:33 var

As you can see these are both owned by user root and group root and that the user has read, write, and execute permission permissions, while the group and others do not. So lets make a change to that to better explain permissions. So lets say we created /home/johndoe/usr and /home/johndoe/var.

# ls -l /home/johndoe/
drwxrwxr-x  13 johndoe johndoe  4096 Apr 27  2007 usr
drwxr-xr-x  20 johndoe johndoe  4096 Oct  3 00:33 var

Again, only the owner himself could write to the directories in the previous example. In this one we ran ‘chmod 775 usr’, which now gives anyone in johndoe group access to write to that folder. So say I come along and need to write to that folder, the sysadmin can run the following:

# groups manis
manis : manis
# usermod -G johndoe manis
# groups manis
manis : manis johndoe

Now the user manis can write to that directory. It might not be a good idea to place the user manis in the primary group of johndoe and the reason is that if by default directories and files are created with write permission manis would be able to write to all of those. Instead it might be better to have them both belong to a separate group, maybe empl or students or a department name. Then permissions can be given to a specific group, but they will not default to permissions that are less than desirable.

That really sort of sums it up for controlling access to files, the standard flags are r=read, w=write, x=execute. You will also sometimes run across a couple more.

The first is the sticky bit, which Linux ignores on files, but for directories it prevents users other than the owner from renaming, moving, or deleting files within the directory. The sticky bit is represented by a ‘t’ or a ‘T’ in place of the ‘x’ in permissions. The capital T means that the file/directory in question did not have ‘x’ set for the ‘others’ bits.

# ls -l ~
-rw-rw-r-x 1 user user      111 Aug 29 20:26 test.txt
# chmod 1664 test.txt
-rw-rw-r-T 1 user user      111 Aug 29 20:26 test.txt
# chmod 1665 test.txt
-rw-rw-r-t 1 user user      111 Aug 29 20:26 test.txt
# chmod 0665 test.txt
-rw-rw-r-x 1 user user      111 Aug 29 20:26 test.txt

As you can see we started out with a normal file, we ran chmod with a preceding 1, which sets the sticky bit. We removed executable permissions by making it 664 instead of 655 and you see there is a capital T replacing the ‘x’ in the others column. If we add executable rights to ‘others’, that then becomes a lowercase ‘t’. Remove the one and we now are back to where we started. Again, Linux ignores sticky bits on files, I was just using a file as an example.

Setuid and setgid, like the sticky bit, are seen less often than r,w,x permissions. What this does is fairly simple, when the bit is set the file is run as the user or group that owns the file. An example is /usr/bin/passwd.

# ls -l /usr/bin/passwd
-rwsr-xr-x 1 root root 30796 Feb  7  2008 /usr/bin/passwd
# ls -l /etc/passwd
-rw-r--r-- 1 root root 1428 Aug 26 09:52 /etc/passwd

The ’s’ in the owners column means that the setuid bit has been set. As you can see /etc/passwd can only be written to by root, but users need to be able to change their password. So when /usr/bin/passwd is executed it is view by the system as being run by root, and therefore any files owned by root that passwd interacts with can be modified by users allowed to execute the file. The same with setgid, the ’s’ is in the group column, but it will take on the role of that group. To set the setuid bit, you would make the first bit of chmod a 4 and for setgid you would use a 2.

# chmod 4755 testfile.txt
# ls -l testfile.txt
-rwsr-xr-x  1 manis  eng  0 Nov 24 15:47 testfile.txt
# chmod 755 testfile.txt
# ls -l testfile.txt
-rwxr-xr-x  1 manis  eng  0 Nov 24 15:47 testfile.txt
# chmod 2755 testfile.txt
# ls -l testfile.txt
-rwxr-sr-x  1 manis  eng  0 Nov 24 15:47 testfile.txt

The last thing I want to talk about is using changing permissions. There are 3 main programs, chmod, chgrp, and chown. I have seen some variation to just to be safe I will say to check the usage before changing permissions. My examples will be for CentOS.

chmod

All of my examples used numbers to represent the permissions, but you can use the letters too. If you wanted to give write permission to just a group you would run.

# chown g+w testfile.txt

and to a user

# chown u+w testfile.txt

For a lot of people I think the octal numbers for chmod can be a little confusing at first. It is really just simple math that will eventually become second nature. A 4 is equal to read permissions, a 2 is equal to write permissions and a 1 is equal to execute permissions. There are two things about these numbers, one is that they follow the binary count right to left. When running ‘ls -l’ permissions are displayed RWX or 421 and binary is 16 8 4 2 1. The other thing is that no matter how you spin it the combination of numbers is unique for any combination of permissions, which I will show you in a minute.

Anyway back to the math of it. When you run chmod in most cases you just use 3 digits, like in one of my examples 755. The first is for the owner, the second is for the group, and the third is everyone else. The number 7 comes from 4, read access, 2, write access, and 1, execute permissions. The next number 5, is read access (4) and execute (1) or (4+1) and the same goes for the “other” permissions. Read+write is 6, execute would be just 1, read would be just 4, so if you think about it you could do any combination and it would represent a unique set of permissions. 600 would be read and write for the owner, but nothing for anyone else.

The best thing you can do is just create some files and start playing with permissions. Soon enough you will know them like the back of your hand and know how to change them to fit your needs.

If I jumped around too much or made something unclear please comment and I will try to clarify.

T-Mobile: phonenumber@tmomail.net
Virgin Mobile: phonenumber@vmobl.com
Cingular: phonenumber@cingularme.com
Sprint: phonenumber@messaging.sprintpcs.com
Verizon: phonenumber@vtext.com
Nextel: phonenumber@messaging.nextel.com
US Cellular: phonenumber@email.uscc.net
SunCom: phonenumber@tms.suncom.com
Powertel: phonenumber@ptel.net
AT&T: phonenumber@txt.att.net
Alltel: phonenumber@message.alltel.com
Metro PCS: phonenumber@mymetropcs.com

This is inspiring me to write a monitoring script that is just for sending email to phones, but that will be another post.