Ñïàñèáî, ÷òî ñêà÷àëè êíèãó â áåñïëàòíîé ýëåêòðîííîé áèáëèîòåêå BooksCafe.Net
Âñå êíèãè àâòîðà
Ýòà æå êíèãà â äðóãèõ ôîðìàòàõ
Ïðèÿòíîãî ÷òåíèÿ!
- Preface
- Chapter 1. Quick Start: Installing Fedora
- 1.1. Choosing Fedora: Is It Right for You?
- 1.2. Obtaining Fedora Core Software
- 1.2.1. How Do I Do That?
- 1.2.1.1. Determining your architecture
- 1.2.1.2. Choosing boot and installation media
- 1.2.1.3. Creating Fedora Core CDs or DVDs
- 1.2.1.4. Buying Fedora Core CDs or DVDs
- 1.2.1.5. Preparing files for a hard disk installation
- 1.2.1.6. Preparing a USB flash disk, network installation server, or PXE boot server
- 1.2.2. How Does It Work?
- 1.2.3. What About...
- 1.2.4. Where Can I Learn More?
- 1.3. Installing Fedora Core
- 1.3.1. How Do I Do That?
- 1.3.1.1. Preparing for dual-boot
- 1.3.1.2. Starting the installation
- 1.3.1.3. Testing the installation media
- 1.3.1.4. Selecting the installation method
- 1.3.1.5. Installation stage 2
- 1.3.1.6. Upgrading a Fedora installation
- 1.3.1.7. Performing a new Fedora installation
- 1.3.1.8. Partitioning layout
- 1.3.1.9. General questions
- 1.3.1.10. Software selection
- 1.3.1.11. First boot
- 1.3.2. How Does It Work?
- 1.3.3. What About...
- 1.3.4. Where Can I Learn More?
- Chapter 2. Using Fedora on Your Desktop
- 2.1. Getting Started Using the Fedora Graphical User Interfaces
- 2.2. Customizing GNOME
- 2.3. Customizing KDE
- 2.4. Fine-Tuning Your Display Configuration
- 2.5. Configuring Printing
- 2.6. Configuring Sound
- 2.7. Adding and Configuring Fonts
- 2.8. Using USB Storage
- Chapter 3. Using Fedora on Your Notebook
- 3.1. Power Management
- 3.2. Configuring Networking
- 3.3. Configuring a Touchpad
- 3.4. Using Dual Video Output
- Chapter 4. Basic System Management
- 4.1. Using the Command Line
- 4.1.1. How Do I Do That?
- 4.1.2. How Does It Work?
- 4.1.3. What About...
- 4.1.3.1. ...accessing a character-mode display when the graphical user interface is running?
- 4.1.3.2. ...finding out where a program is located?
- 4.1.3.3. ...starting graphical programs?
- 4.1.3.4. ...quickly entering a single command?
- 4.1.3.5. ...the difference between commands, utilities, applications, and programs?
- 4.1.3.6. ...using a different shell?
- 4.1.4. Where Can I Learn More?
- 4.2. Accessing Online Documentation
- 4.3. Managing Files
- 4.3.1. How Do I Do That?
- 4.3.1.1. Understanding Linux directory names
- 4.3.1.2. Key directories
- 4.3.1.3. Ambiguous filenames
- 4.3.1.4. Choosing easy-to-use filenames
- 4.3.1.5. Listing the contents of directories
- 4.3.1.6. Displaying and changing the current working directory
- 4.3.1.7. Creating and removing directories from the command line
- 4.3.1.8. Copying files
- 4.3.1.9. Renaming and moving files
- 4.3.1.10. Removing files
- 4.3.1.11. Creating multiple names by linking files
- 4.3.1.12. Determining the contents of files
- 4.3.1.13. Viewing the contents of text files
- 4.3.1.14. Managing files graphically using GNOME
- 4.3.1.15. Managing files graphically with KDE
- 4.3.2. How Does It Work?
- 4.3.3. What About...
- 4.3.4. Where Can I Learn More?
- 4.4. Basic Text Editing Using vi
- 4.5. Using Runlevels
- 4.6. Managing and Configuring Services
- 4.7. Managing Users and Groups
- 4.8. Control Access to Files
- 4.8.1. How Do I Do That?
- 4.8.1.1. Viewing the current user, group, and mode from the command line
- 4.8.1.2. Viewing the current user, group, and mode graphically
- 4.8.1.3. Changing permissions graphically
- 4.8.1.4. Changing permissions from the command line
- 4.8.1.5. Using group permissions
- 4.8.1.6. Default permissions
- 4.8.1.7. Changing file ownership
- 4.8.2. How Does It Work?
- 4.8.3. What About...
- 4.8.4. Where Can I Find More Information?
- 4.9. Managing Processes
- 4.10. Remote Management Using SSH
- 4.11. Using Shell Redirection and Piping
- 4.12. Writing Simple Scripts
- Chapter 5. Package Management
- 5.1. Querying the Package Management Database
- 5.2. Installing and Removing Software Using RPM
- 5.3. Using Repositories
- 5.4. Rolling Back a Package Installation, Upgrade, or Removal
- 5.5. Automating Updates
- 5.6. Installing From Source
- 5.7. Making Your Own RPM Packages
- 5.8. Rebuilding an RPM Package for a Different Architecture
- Chapter 6. Storage Administration
- 6.1. Using Logical Volume Management
- 6.2. Managing RAID
- 6.2.1. How Do I Do That?
- 6.2.2. How Does It Work?
- 6.2.3. What About...
- 6.2.3.1. ...booting from a RAID array?
- 6.2.3.2. ...mixing and matching USB flash drives, USB hard disks, SATA, SCSI, and IDE/ATA drives?
- 6.2.3.3. ...mirroring to a remote drive as part of a disaster-recovery plan?
- 6.2.3.4. ...using more than one RAID array, but configuring one hot spare to be shared between them?
- 6.2.3.5. ...configuring the rebuild rate for arrays?
- 6.2.3.6. ...simultaneous drive failure?
- 6.2.4. Where Can I Learn More?
- 6.3. Making Backups
- 6.3.1. How Do I Do That?
- 6.3.1.1. Determining what data to back up
- 6.3.1.2. Determining how often to back up your data
- 6.3.1.3. Determine how quickly you will need to restore your data
- 6.3.1.4. Determine how far back in time you need to restore
- 6.3.1.5. Decision 1: Incremental versus full backups, and backup rotation
- 6.3.1.6. Decision 2: Decide on the backup media
- 6.3.1.7. Decision 3: Decide on media rotation and storage
- 6.3.1.8. Simple backup labeling
- 6.3.1.9. Backing up to DVD
- 6.3.1.10. Backing up to tape
- 6.3.1.11. Restoring files from backups
- 6.3.1.12. Viewing the table of contents and verifying a backup
- 6.3.2. How Does It Work?
- 6.3.3. What About...
- 6.3.4. Where Can I Learn More?
- 6.4. Scheduling Tasks
- 6.4.1. How Do I Do That?
- 6.4.2. How Does It Work?
- 6.4.3. What About...
- 6.4.4. Where Can I Learn More?
- Chapter 7. Network Services
- 7.1. Configuring Samba to Share Files with Windows Systems
- 7.2. Configuring a DHCP Server
- 7.3. Configuring a Domain Name Server
- 7.3.1. How Do I Do That?
- 7.3.1.1. Configuring named graphically
- 7.3.1.2. Configuring named through configuration files and datafiles
- 7.3.1.3. Testing DNS entries
- 7.3.1.4. Configuring a slave nameserver
- 7.3.1.5. Using your nameservers locally
- 7.3.1.6. Serving domain information to the Internet
- 7.3.1.7. Reverse mapping
- 7.3.2. How Does It Work?
- 7.3.3. What About...
- 7.3.4. Where Can I Learn More?
- 7.4. Configuring a CUPS Print Server
- 7.5. Using the Apache Web Server
- 7.5.1. How Do I Do That?
- 7.5.1.1. Starting Apache
- 7.5.1.2. Testing Apache
- 7.5.1.3. Installing your own web content
- 7.5.1.4. Changing the default configuration
- 7.5.1.5. Configuring Apache graphically
- 7.5.1.6. Directly editing Apache's configuration file
- 7.5.1.7. Enabling CGI scripts in every directory
- 7.5.1.8. Password-protecting content
- 7.5.2. How Does It Work?
- 7.5.3. What About...
- 7.5.4. Where Can I Learn More?
- 7.6. Configuring the sendmail Server
- 7.7. Configuring IMAP and POP3 Email
- 7.8. Configuring Webmail
- 7.9. Creating Databases and Accounts on a MySQL Server
- 7.10. Installing and Configuring a Wiki
- 7.11. Configuring an FTP Server
- 7.12. Analyzing Web and FTP Logs
- Chapter 8. Securing Your System
- 8.1. Prevent Unwanted Connections
- 8.2. Using SELinux
- 8.3. Using Access Control Lists
- 8.4. Making Files Immutable
- 8.5. Using sudo to Delegate Privilege
- 8.6. Configuring PAM and consolehelper
- 8.7. Logging
- 8.8. Detecting File Changes with AIDE
- Chapter 9. The Fedora Community
- 9.1. Participating in the Fedora Mailing Lists
- 9.2. Using IRC
- 9.3. Using Bugzilla
- 9.4. Running Rawhide
- 9.5. Participating in Fedora Projects
- Chapter 10. Advanced Installation
- 10.1. Resizing a Windows Partition
- 10.2. Configuring RAID and LVM During Installation
- 10.3. Preparing Alternate Installation Media
- 10.4. Installing with Kickstart
- 10.4.1. How Do I Do That?
- 10.4.2. How Does It Work?
- 10.4.3. What About...
- 10.4.3.1. ...creating a Kickstart file using a graphical tool?
- 10.4.3.2. ...creating a Kickstart file that dynamically adjusts according to properties of the installation target?
- 10.4.3.3. ...performing customization after installation?
- 10.4.3.4. ...installing a system with the same configuration as another, previously installed system?
- 10.4.4. Where Can I Learn More?
- 10.5. Configuring the GRUB Bootloader
- 10.5.1. How Do I Do That?
- 10.5.1.1. Customizing the GRUB menu
- 10.5.1.2. Using your own splash image
- 10.5.1.3. Creating additional boot entries
- 10.5.1.4. Installing GRUB's boot record from Fedora
- 10.5.1.5. Installing GRUB's boot record from a GRUB DVD or floppy disk
- 10.5.1.6. Editing boot options
- 10.5.1.7. Installing or changing a GRUB password
- 10.5.2. How Does It Work?
- 10.5.3. What About...
- 10.5.4. Where Can I Learn More?
- 10.6. Using Rescue Mode on an Installation Disc
- 10.7. Installing Xen Virtual Machines
- Colophon
At the time of writing, Fedora Core 6 was being finalized; my apologies for the inevitable little discrepancies between the screenshots and descriptions in this book and the final version of Fedora Core 6
You can install a very basic version of Fedora Core without a graphical user interface on a system with as little as 64 MB of memory, 1 GB of disk space, and a processor speed of 200 MHz. However, this is not recommended for desktop usage.You can also install Fedora Core on a system with a PowerPC processor, such as an Apple Mac produced after 1999 and before 2006, or an IBM RS/6000 system.
Media type | Media count | Size | Notes |
---|---|---|---|
DVD | 1 | 4.7 GB (or larger) | All of the software will fit on one disc (which serves as both the boot and installation medium), so this is usually the fastest and most convenient installation option. |
CD | 1 | 8 MB (any CD) | A single CD or mini-CD can be used to start a network or hard disk installation. If you will be using CDs for both the boot and installation media, five 700 MB discs are required (see Table 1-2). |
USB flash drive | 1 | 8 MB or higher | Requires a Linux system to configure the drive. Useful for network or hard disk installation. The BIOS of some systems will not permit booting from a USB flash key (beware of BIOS versions that permit booting only from a USB floppy or Zip drive). |
PXE Server (Network Boot) | 1 | 6.5 MB | Requires an existing system to serve as the PXE server (see Lab 10.3, "Preparing Alternate Installation Media"). |
Media type | Media count | Size | Notes |
---|---|---|---|
DVD | 1 | 4.7 GB or higher | Same media used for booting. |
CD | 5 | 700 MB | The images will not fit on 650 MB discs, such as some CD-RWs or old CD-Rs. |
Network server (HTTP, NFS, or FTP) | 1 | 3.5 GB of disk space on the server | HTTP is the lightest of the three protocols and is often the easiest to set up. |
Hard disk partition | 1 | 3.5 GB of disk space | Only ext2 and ext3 (Linux) and FAT (Windows/DOS) partitions are supported, on an internal or external disk drive. NTFS and LVM-based partitions will not work. This option is useful when adding Fedora to a computer that already has an operating system installed; the existing OS can be used to download the installation images. Note that the file size exceeds the maximum for FAT16 filesystems (2 GB). |
Some download tools have problems with files over 2 GB in size. Most of the time, these problems affect only the download size, progress, or time-remaining displays during the download process, but some versions of the Lynx browser will not successfully download files over 2 GB. Older versions of wget also have a 2 GB limitation. If you are downloading onto a Windows system that is formatted with the FAT file system, the maximum file size may be 2 GB (FAT16) or 4 GB (FAT32).To download only the boot disk ISO (for use with a network or hard disk installation):
When burning a CD or DVD, use the ISO image file as the disc filesystem, but do not place the ISO image inside another filesystem on the disc. You will usually get the correct results if you save the ISO file to the desktop and then double-click on it.
To verify that the disk was created correctly, open it after you burn it: you should see several files and directories. If you see a single file with a .iso extension, the disc was not created correctly.
Be sure to check the system requirements in the release notes at http://fedora.redhat.com/docs/release-notes/ or in the root directory of the Fedora Core DVD or CD disc 1.
On your system, if you have any data that you want to preserve, back it up before installing Fedora Core, and test the integrity of the backup copy.
Additional installation boot options are discussed in Chapter 10.Table 1-3. Fedora Core basic installation options
Option | Description | Notes |
---|---|---|
lowres | Uses 640x480 screen resolution. | Use if you are installing with a very old monitor. |
resolution= 1024x 768 | Specifies a standard video resolution. | Use if the installer does not correctly detect your monitor capabilities and the video signal is out of range. |
text | Uses text mode for installation (no graphics mode or mouse access). | Use this if graphics are garbled or slow when using the regular installer. |
askmethod | Ask the user for the installation method (source of the software to be installed). | The installer will automatically ask if the boot media is a USB flash drive or a network boot. For a CD or DVD installation, the installer will assume that you're installing from the CD or DVD unless the askmethod or method= options are specified. |
method= method | Specifies the installation method:cdromInstall from optical disc (CD or DVD)http:// server / pathInstall from HTTP serverftp:// server / pathInstall from FTP servernfs: server / pathInstall from a NFS serverhd:// partition / pathInstall from an ISO file on a hard disk partition | For the hd installation method, take the hard disk device name from Table 1-4 and add the partition number at the end. For example, if the ISO file is in the folder fc6 on the 2nd partition of the primary master hard disk, use: method=hd://dev/hda2/fc6/. |
expert | Enables the use of a driver disk with additional device driver modules. | Use this to install onto hardware that requires driver modules not included in Fedora Core 6. |
Device name | Disk type | Controller | Unit |
---|---|---|---|
/dev/hda | Parallel ATA (IDE) | Primary | Master |
/dev/hdb | Parallel ATA (IDE) | Primary | Slave |
/dev/hdc | Parallel ATA (IDE) | Secondary | Master |
/dev/hdd | Parallel ATA (IDE) | Secondary | Slave |
/dev/hde | Parallel ATA (IDE) | Auxiliary #1 | Master |
/dev/hdf | Parallel ATA (IDE) | Auxiliary #1 | Slave |
/dev/hdg | Parallel ATA (IDE) | Auxiliary #2 | Master |
/dev/hdh | Parallel ATA (IDE) | Auxiliary #2 | Slave |
/dev/sd<X> | SATA, SCSI, IEEE1394, or USB | <X> is a for the first disk found, b for the second disk found, c for the third disk, and so forth. With USB and IEEE1394 (FireWire) devices, the assignments may change between reboots. |
Some disc burning programs will pad the image before burning it, adding additional data to the end of the disc. This will cause the disc to fail the media check even though the disc is valid.Figure 1-4. DVD/CD media check
If your mouse is not working, you can activate a graphical button on the installation screen by using the keyboard; just press Alt and the letter underlined in the button label. For example, to view the release notes while on the splash screen in Figure 1-8, press Alt-R (because R is underlined on the Release notes button).If you are using a text-mode installation, you will see a text-based version of each of the following screens; the layout may be slightly different to accommodate the available screen space and the absence of a mouse pointer. Use the Tab key to navigate among the controls on the text screen.
You cannot manually create a new Logical Volume configuration using the text-mode installerFigure 1-8. Fedora Core graphical-installation splash screen
This dialog may appear if you previously started a Fedora installation, but aborted the installation process before it was finished (producing a partially installed system). In that case, choose Install rather than Upgrade to ensure that the new system is complete.If you choose Install, skip to the next section titled "Performing a New Fedora Installation." Otherwise, the screen shown in Figure 1-12 will appear, asking what you want to do with the bootloader configuration.
If you have an existing Fedora installation and you want to replace it with Fedora Core 6, but you wish to preserve the data in your home directories, and the home directories have their own filesystem or partition, you can choose Upgrade.
In order to use Fedora Core's hibernate feature, you will also need a swap partition (either instead of or in addition to swapspace on a logical volume). See Lab 3.1, "Power Management," for more information on hibernation.If you have selected a partitioning option that includes the default layout and have selected the checkbox to review and modify the layout, the screen in Figure 1-18 will appear at this point in the installation.
The bootloader password is a critical piece of information. Don't lose it!Click Next to proceed.
Choose passwords that are easy for you to remember but hard for others to guess. One way to do this it to choose a line or verse from a song, poem, book, or play, and use the first letter from each word plus the punctuation marks. For example, from Shakespeare's line "Do you bite your thumb at us, sir?" you would derive the password Dybytau,s?Figure 1-27. Creating a root password
When installing from DVD or CD, the button labeled "Add additional software repositories" can be used to add a Fedora Updates network repository to ensure that the latest versions of the Fedora Core packages are installed. This can be somewhat faster than installing the disc version of all packages and then updating the software after installation, but it requires a good Internet connection (or local repository). See Lab 5.3, "Using Repositories," for more information.Figure 1-28. Software selection screen
Bored? You can read the release notes during the installation; just click on the button in the lower-left corner of the screen.Figure 1-32. Installation progress indicator
On some systems, you may need to click Reboot and wait for the system to start the boot process before you can remove optical media.Figure 1-33. Completed installation
If you are not using a bootloader password, then any user with physical access to your computer can reset the password of any account on the system using the reconfig boot argument.
Where possible, the labs in this book include instructions for performing tasks using both the graphical user interface and the command line. If you are not familiar with entering Linux commands, see Lab 4.1, "Using the Command Line."
Regardless of which GUI environment you use, you can run both KDE and GNOME programs and have them side by side on your display. For example, you can fire up Evolution (the GNOME email/calendar/ scheduling application) and Konqueror (the KDE web browser) and cut and paste data between them. This interoperability is enabled by the X Window System, which provides the foundation for both GUIs.
You can lock an item to a specific location within the panel by right-clicking and selecting the checkbox labeled "Lock to panel"; to unlock the item, deselect the checkbox.
Action | GNOME | KDE |
---|---|---|
Display window menu | Alt-Space | Alt-F3 |
Close window | Alt-F4 | Alt-F4 |
Unmaximize (Restore) | Alt-F5 | |
Task list menu | Alt-F5 | |
Move window using cursor keys | Alt-F7 | |
Resize window using cursor keys | Alt-F8 | |
Minimize | Alt-F9 | |
Maximize | Alt-F10 |
The clipboard used for cut/copy-and-paste operations is not used for fast pasting; instead, the selection (highlighted text or graphics) is directly duplicated (pasted) into the destination, and the clipboard contents are left intact.
See Chapter 5 for more information on using yum
Most GNOME settings take effect immediately; you do not need to click an Apply button for a change to take effect
If you have a "multimedia" keyboard with keys for sound control and common applications, you can in most cases use those keys as shortcuts. However, the Keyboard Shortcuts window will show these keys as hexadecimal codes, as shown in the highlighted line in Figure 2-8. Not all keys can be used as shortcuts because some multimedia keyboards are internally divided to act as two separate keyboards, with multimedia keys being sent to a different output. In a few rare cases, the multimedia keys don't generate normal keyboard scancodes at all.
Theme type | Personal installation | System-wide installation |
---|---|---|
Icon themes | ~/.icons | /usr/share/icons/ |
Application/control and Window Manager themes | ~/.themes | /usr/share/themes/ |
If you do not have KDE installed, you can install it; see Lab 5.3, "Using Repositories."Figure 2-9. KDE Control Center
An alternative, express way to change basic KDE desktop settings is to select Settings→Desktop Settings Wizard (or enter the command kpersonalizer), which will walk you through the process of setting the most common desktop options.
Relatively few themes are packaged in the .kth format required by the Theme Manager. Themes supplied in source format cannot be installed by the Theme Manager and must be configured manually.
The Add New Panel facility can add special panel types that are pre-populated with specific tools; for details, right-click on a panel and select Help.To delete a panel, right-click on any panel and select Remove Panel, and then select the panel you wish to remove. It is not possible to remove the original panel. If the panel contains anything, a confirmation dialog will appear before the panel is deleted.
system-config-display uses the existing display configuration as a starting point. If the existing configuration does not work at all, you may need to delete it to force system-config-display to start from scratch:
# rm /etc/X11/xorg.conf
In most cases, the exact video card model is not important; it's the chipset that counts. From your video card documentation, find out the chipset manufacturer and model (such as NVIDIA GeForce 4 MX) and select that option from the list. In many cases, an exact match is not required because one video driver is used for a wide range of chipsets.
If there are no options that work for your video card, select the VESA driver, which will provide basic capabilities on almost any modern video card.
If you logged in graphically, the GUI won't restart until you restart the system. You can force it to restart sooner by pressing Ctrl-Alt-Backspacebut you will lose any unsaved data, so exit from all applications first. (This key sequence abruptly aborts the X server process and normally should not be used to exit from a graphical session).
Name | Description |
---|---|
Monitor | Monitor specifications. |
InputDevice | Keyboard configuration. |
Pointer device configuration (mice, graphics tablets, touch screens). | |
Device | Video card configuration. |
Screen | Associates a Device with a Monitor and defines the available resolutions and color depth. |
ServerLayout | Associates one or more Screen sections with two or more InputDevice sections. Different ServerLayouts can be defined to combine devices in different ways for use at different times; for example, a laptop can have a ServerLayout that specifies that the internal+external displays should be used, and another one that specifies only the internal display. |
Files | Location of auxiliary files such as fonts, drivers, and color tables. |
ServerFlags | Flags to control the overall operation of the X server. The flags may alternatively be placed in the ServerLayout sections if they apply to some ServerLayouts but not to others. |
Extensions | Enables/disables extensions to the server capabilities. |
Module | Loads additional modules. (Modules may provide extensions, but extensions don't have to exist as separate modules.) |
Modes | Defines special video modes (rarely required). |
DRI | Direct Render Interface (DRI) device configuration, used for some 3-D gaming. |
The system will automatically start an X server using display number :0. Additional X servers can be started as long as they each use a unique display numberwhich is why :1 was used in this command.
Printer queues are created with default driver options. To adjust the driver options, create the queue, and then use the Printer Options tab to access the driver settings.
Make sure the sound device you are configuring with the Volume Control/Mixer is the same device you are testing with the Soundcard Detection tool!Modern sound chips have many different inputs, outputs, and processing sections, but not all sound card designs implement all of these features, and even if the features are implemented, some of the inputs and outputs may not be connected to anything, or they may be connected to an input or output labeled with a different name. KMix presents controls for almost every available input, output, sound path routing option, and switch; GNOME's Volume Control lets you configure which controls you wish to display. This reduces clutter on the screen, but it also means that required controls may not be visible until you enable them.
Nautilus does not permit you to install or delete system-wide fonts. However, Konqueror does, and it is possible to run Konqueror within a GNOME session. One easy way of doing this is to type Ctrl-F2 and enter konqueror in the dialog that appears.
You can also install and remove fonts through the KDE Control Panel.
Font name | Meaning |
---|---|
Courier-12 | Courier face, 12-point size |
Utopia:style=italic | Utopia face in italics |
Helvetica,Arial,Swiss-12 | Helvetica, Arial, or Swiss face (preferred in that order), 12-point size |
Fixed-12,16,10 | Fixed face in 12-, 16-, or 10-point size (preferred in that order) |
This option does not apply to media inserted into a memory-card reader! Use the "Mount removable drives when hot-plugged" option for memory cards.
The auto-run feature does not work with automatically mounted media because GNOME takes the precaution of mounting media with the noexec option, which prevents direct execution of files (including autorun files). It does work with manually mounted media.
If the display does not match the device you are trying to partition, you may be partitioning the wrong device; enter q to exit immediately!
You may need to remove and reinsert the drive to force the kernel to load the new partition table before you can format the partitions.The option -F 32 forces the use of 32-bit file allocation tables, which is not strictly necessary for drives under 512 MB in size but is required for larger drives and matches the filesystem type assigned to the partition by the previous fdisk command. The -n labelname option sets the filesystem label, which will be used to determine the mount points for the filesystem.
If you have ever used your USB drive without a partition table (formatting /dev/sda instead of /dev/sda1, for example), erase the master boot record (MBR) before partitioning to prevent udev from later detecting the drive as unpartitioned and mounting it incorrectly:
# dd bs=1k count=1 if=/dev/zero of=/dev/sdb
The unmount command is spelled umount; there's only one n.
Fedora Core does not include the KDE ACPI modules. However, you can use gnome-power-manager in KDE by starting it manually: press Alt-F2 or open a terminal, and type:The same program controls the power-management icon in the panel bar, which may or may not appear depending on the system configuration (it will usually appear by default on a system that has a battery, including most notebooks, but will not appear by default on a system with no battery). The symbol used for the icon will change according to the power supply: it will show a battery when discharging the battery, a battery plus a power cord when charging the battery, or just a power cord on a system with no battery. You can access the gnome-power-manager configuration window by right-clicking on the icon and selecting Preferences.
$ gnome-power-manager
A second power-management icon will appear in the KDE panel. You can disable KDE's icon through the Control Center menu option; go to Power Control→Laptop Battery and deselect the checkbox labeled "Show battery monitor."
gnome-power-manager will automatically be started next time you enter KDE.
Configuring the screen to blank without suspending or hibernating the system whenever the lid is closed is ideal for listening to digital music.
Depending on the hardware installed on your system, you may see different combinations of controls on the "Running on AC" and "Running on Battery" tabs.
A password is required to unlock the screen after a resume if passwords are configured in the screensaver (which is the default).
Resuming from hibernation will fail if the kernel has been upgraded since the last boot.
Usually the DRIVER, VMAJOR, and VMINOR lines should not be changed.
Xfce can be easily installed (see Lab 5.3, "Using Repositories"). To select your desktop environment, use the Session menu on the graphical login screen. Unplug any unneeded external devices, including USB devices, headphones, mice, and keyboards. Each USB device can consume up to 2.5 watts of power, increasing your power consumption by as much as 20 percent.
The Fedora power-management system is in active development. To stay informed of the latest developments, subscribe to the fedora-laptop-list (see Lab 9.1, "Participating in the Fedora Mailing Lists").
The BIOS configuration utility varies from system to system; consult your system or motherboard documentation.Some BIOS versions permit the wake time to be set through ACPI. To see if this is possible on your system, enable the alarm wake feature using your BIOS configuration utility, then boot Fedora and examine the /proc/acpi/alarm file:
The editing window includes some options that are unavailable when the device is first created.Figure 3-12. Network Configuration device-editing window
Changing the hostname field and then saving the network configuration will prevent you from opening any new GUI applications because the X Window System uses the hostname in the security key used to control access to the display. To correct this problem, log out and then log in again after changing the hostname, or enter this command before doing so:
$ xhost +localhost
The gateway must be on the same subnet as the network interface device.To edit or delete existing routes, select the route and click on the Edit or Delete buttons.
To create alias devices, use the same procedure that you use to create physical interfaces. The configuration tool will set the alias number for you automatically.
If you are running a nameserver on the same computer, enter 127.0.0.1 (the loopback address that connects to the local host) as the Primary nameserver. Optionally, enter another nameserver as the Secondary DNS just in case your local nameserver is ever down.The " DNS search path" field is used to specify the domains to be searched when looking up a hostname that does not have a domain-name component. For example, if this field contained myorganization.ca fedorabook.com , then the hostname bluesky would be looked up as bluesky.myorganization.ca , and if no IP address could be found for that name, it would be looked up as bluesky.fedorabook.com .
If a nameserver times out on you frequently (a problem that is common on slow or congested links, and which causes name lookups to fail the first time and succeed the second time they are requested), enter the nameserver twice (for example, make it both the primary and secondary nameserver).
Do not delete the entry for 127.0.0.1 or ::1, or your system will not work properly. Both the system's hostname and localhost must appear as the hostname or alias for this entry. If you change this entry and save the configuration, it may not be possible to open new programs on the graphical display until you log out and then log in again.
At this time, NetworkManager is a work in progress. When it works, it works well, but some hardware that works fine with other configuration techniques does not work at all with NetworkManager. It is proposed that NetworkManager will eventually become the configuration tool of choice.The NetworkManager service is enabled in the same way as every other service (see Lab 4.6, "Managing and Configuring Services "). You can configure it to start at the next boot by choosing the menu option System→Administration→Services, and then selecting the checkboxes labeled NetworkManger (the related NetworkManagerDispatcher service is not usually required); to start the services immediately, select each of them in turn and then click the Start button.
Notice the nonstandard use of capital letters in the name NetworkManager.As soon as the NetworkManager starts, an icon should appear in your panel's notification area, which is shown in Figure 3-21 . This icon will indicate the type of IP connection currently in use. To switch to a different connection, click on the icon; a list of available connections will appear (including all broadcast local network names if you have a wireless card, plus a little signal-strength bar graph for each wireless network). Click on the network you wish to connect to, and NetworkManager will attempt to make the connection. You will be prompted to enter WEP or WPA encryption keys if necessary.
Although the use of network classes has been made obsolete by the introduction and widespread use of classless interdomain routing (CIDR), the network class values are still used to determine the default netmask. This generates the correct value for most private networks.Table 3-1. Netmasks by IP address class (not including Multicast addresses)
First octet of IP address | Example | Network class | Netmask | Number of IP addresses in subnet |
---|---|---|---|---|
0127 | 3.15.97.4 | A | 255.0.0.0 | 16,777,216 |
128191 | 132.2.2.9 | B | 255.255.0.0 | 65,536 |
192255 | 204.99.3.8 | C | 255.255.255.0 | 256 |
dhclient may be running even if you didn't start it manually, since boot-time network activation or activation through system-config-network or system-control-network may have launched it.
The most common wireless adapter family affected by firmware issues is the Intel Pro Wireless (IPW) seriesoften integrated into systems under the Centrino moniker, but also sold as add-on units with Mini-PCI, CardBus, or USB interfaces.
Address range | Available IP addresses | Treatment using default netmask |
---|---|---|
10.0.x.x | 16,777,216 | One Class A network of 16,777,216 addresses |
172.16.x.x172.31.x.x | 1,048,576 | 16 class B networks of 65,536 addresses each |
192.168.x.x | 65,536 | 256 class C networks of 256 addresses each |
As an exception to the rule, Firefox does not need to be restarted after /etc/resolv.conf is changed.The system-config-network tool is a Python script that manipulates the file /etc/sysconfig/network and the contents of the directory /etc/sysconfig/network-scripts (in addition to the /etc/hosts and /etc/resolv.conf files). These files are then read by the system init script to configure the boot-time network environment, and they are also used by other utilities such as ifup , ifdown , and system-control-network .
It's a good idea to get into the habit of making a backup of configuration files before modifying them, just in case something goes wrong:
# cp /etc/X11/Xorg.conf /etc/X11/Xorg.conf.backup
Options | Description | Reason for change |
---|---|---|
LeftEdge, TopEdge, RightEdge, BottomEdge | Define the border between edge/corner and middle regions of the touchpad | Used to shrink or expand the regions used for scrolling and corner-taps. |
PalmDetect, PalmMinWidth, PalmMinZ | Configure the touchpad to ignore broad touches | Prevents accidental touches of the user's palm from registering as touchpad events. PalmDetect enables/disables, PamMinWidth sets the minimum touch diameter that will be considered a palm, and PalmMinZ is the minimum pressure required to register a palm. |
RTCornerButton, LTCornerButton, LBCornerButton, RBCornerButton | Define the mouse-button clicks that will be registered when the user touches the corner of the keypad | By default, the top-right corner can be tapped to produce a middle mouse click, and the bottom-right corner can be tapped to produce a right mouse click. If you are finding that these clicks are being accidentally registered, set these button values to zero (0); alternately, you can select a specific button you wish to associate with a corner tap (1=left, 2=middle, 3=right, 4=down, 5=up, 6=left, 7=right) |
TapButton1, TapButton2, TapButton3 | Define the mouse-button clicks that will be registered when the user taps in the middle region of the touchpad with one, two, or three fingers | If you find that you accidentally tap the touchpad with more fingers than you intend to use, you can change the two- and three-finger tap buttons. To disable a tap altogether, set the appropriate value to 0. |
VertScrollDelta, HorizScrollDelta | Define the amount of finger motion required to register a scroll event. | Set these values to adjust the scroll rates, or set them to 0 to disable scrolling altogether. Note that smaller values increase sensitivity. If you're finding that Firefox keeps moving back and forth in its History when you accidentally sweep your finger across the touchpad, try setting HorizScrollDelta to 0. |
MaxTapTime | Defines the maximum time (in milliseconds) in which to detect a tap (which is interpreted as a left mouse click). | If tap-to-click drives you bonkers, set this to 0. Otherwise, you can use it to adjust how sensitive your touchpad is to tapping. |
If you find yourself using the terminal frequently, you can make it easier to launch: right-click on the Terminal option in the application menu and select "Add this launcher to panel." A new panel icon will appear that will launch a new terminal when clicked.If you have logged in to the system through a character-mode login screen or an SSH login, you will automatically be presented with a command line.
Key or key sequence | Description |
---|---|
Left arrow | Move left one character. |
Right arrow | Move right one character. |
Backspace | Delete the character to the left of the cursor. |
Delete | Delete the character under/to the right of the cursor. |
Ctrl-U | Delete to the start of the line. |
Ctrl-left arrow | Move one word to the left. |
Ctrl-right arrow | Move one word to the right. |
Esc, DAlt-D | Delete to the end of the current word. |
Esc, BackspaceAlt-Backspace | Delete to the start of the current word. |
HomeCtrl-A | Go to the start of the line. |
EndCtrl-E | Go to the end of the line. |
In this book, I'll use $ to indicate any normal user's prompt, user $ to specifically indicate user's prompt, and # to indicate the root prompt. Avoid entering commands as root unnecessarily!
There are actually 64 virtual terminals, but virtual terminals above number 12 are not directly accessible from the keyboard and are therefore rarely used.You can log in on multiple VTs simultaneously and switch back and forth between them. This is particularly useful when you bring up documentation on one VT and enter commands on another.
The phrase online documentation refers to both local and Internet-based electronic documentation.
A system call is a request made of the operating system by an application program.Table 4-2. Section numbers for manpages
Section | Description |
---|---|
1 | User commands |
2 | System calls |
3 | Library functions |
4 | Special files |
5 | File formats |
6 | Games |
7 | Conventions and miscellany |
8 | Administration and privileged commands |
apropos is another name for man -k. To my ear, it has more class!To see all of the manpages with a specific name in all sections of the manual, use the whatis command:
Key | Description |
---|---|
Page Up/Page Down | Scroll through the text. |
p | Go to the previous node. |
n | Go to the next node. |
Tab | Jump to the next menu option in the current page. |
Enter (when the cursor is on a menu option) | Follow the menu option. |
Space | Go to the next page, or next node if there is no more text in the current node. |
l | Return to the last node accessed. |
Each of these tools also provides a graphical user interface for viewing manpages and info documents.
Scheme | First characters of pathname | Relative to... | Example |
---|---|---|---|
Absolute | / | Root directory | /home/chris/book/chapter/one.odt |
Relative-to-Home | ~ | User's home directory | ~/book/chapter/one.odt |
~ chris | Home directory of chris | ~chris/book/chapter/one.odt | |
Relative | (Anything other than / or ~) | Current working directory | chapter/one.odt (Assuming that /home/chris/book is the current directory) |
Directory | Purpose |
---|---|
/bin | Basic binaries (programs) needed to start the system. |
/boot | Files used during the boot process, including the boot menu and kernel. |
/dev | This directory contains special files that are actually connections to devices, such as keyboards, mice, modems, printers, sound cards, and so forth. When you read data from a special file or write data to it, you're actually communicating with the associated device. |
/etc | System configuration files (sometimes regarded as the "home directory for the computer"). |
/home | Users' home directories, for the storage of personal files. |
/lib | Libraries. |
/lost+found | A directory used to recover files in the event of filesystem damage. Any file that has been disassociated from its name is placed here during filesystem recovery. |
/media | External media (floppy disks, USB drives, digital cameras, optical disks) that have been mounted. |
/mnt | Historical location for mounting storage devices, many of which have now moved to /media. |
/opt | Optional, add-on software. The definition of add-on software is subjective; if you obtain OpenOffice.org directly from the openoffice.org web site, it will be installed here, but if you install the version distributed with Fedora, it will be installed in /usr/bin. |
/proc | Per-process status information plus system information. |
/root | Home directory for the root user (superuser). |
/sbin | Basic system administration binaries. |
/selinux | Files for Security Enhanced Linux. |
/sys | System device information. |
/tmp | Temporary file storage. |
/usr | User data (years ago, home directories were also stored in /usr). |
/usr/bin | The remainder of the standard binaries. |
/usr/lib | User libraries. |
/usr/libexec | Programs that are not directly executed by the user but that are executed by another application (e.g., graphics demos for the xscreensaver program) |
/usr/local | Local files (specific to your system configuration). |
/usr/local/bin | Local binaries and scripts. |
/usr/sbin | The remainder of the system administration binaries. |
/usr/src | Source code for locally built RPM packages and the Linux kernel. |
/var | Files that change frequently (variable), including databases, print requests, and logfiles. |
/var/log | Various system logfiles. |
/var/spool | Files for various queues (spools), such as print queues and file-transfer queues. |
Filename | Description | Matches | Does not match |
---|---|---|---|
a* | Any filename starting with a | absolutely.txt | Albert |
a.out | backup | ||
albert | _abc_ | ||
*x* | Any filename containing an x | xylophone.gif | constantinople |
nexus | ALEX | ||
old.x | |||
*[09] | Any filename ending in a digit | file3 | file |
menu.backup60 | file3a | ||
file3.txt | |||
416-555-1212.phone | |||
[Aa]???.txt | Any eight-character filename starting with a or A and ending in .txt | appl.txt | application.txt |
ax42.txt | a.txt | ||
Any1.txt | allow.txt | ||
[azAZ][09] | Any two-character filename starting with a letter and ending with a digit | a9 | No |
G7 | 7G | ||
N3 | XX | ||
Fortran77 | |||
[!azAZ]* | Any filename that does not start with a letter | 9lives.odt | abc.txt |
[^azAZ]* | _whatever | Nevermore |
Although it makes command-line file manipulation more awkward, more and more users are adding spaces to photo and music filenames. Use the single form of words instead of the plural ( font instead of fonts ); it's less typing, and you won't have to keep track of whether you chose the singular or plural form.
ls -l is so frequently used that Fedora has a predefined alias (shorthand) for it: ll.You can also sort by file size (from largest to smallest) using -S :
rm -r can delete hundreds or thousands of files without further confirmation. Use it carefully!
The graphical desktop tools don't directly delete files; they relocate them to a hidden directory named ~/.Trash, which corresponds to the desktop Trash icon, where they stay until the Empty Trash option is chosen. You can do the same thing from the command line:
$ mv badfile ~/.Trash
If you accidentally cat a non-text file, your terminal display can get really messed up. The reset command will clear up the situation:To display only the top or bottom 10 lines of a text file, use the head or tail command instead of cat .
,l*l<lL\xe2 ,,<lFL<<<G\\l<lGRL<l\xe2 \xf5 <L,l<lLl\LLLl<*]US]$$][]UWVS[ j)Eue[^_1PuuuG;re[^_UUSR@t@CuX[USP[n X[xG hG6QGListxG!GN9Akregator11ApplicationE <L\L 2hLl\xe2 \xf5 [&&*CS@&*_^-&@$#D]$ reset[chris@concord2 ~]$
vi is pronounced "vee-eye," not "vye" or "six."
Command | Description |
---|---|
Left, h, or Backspace | Move left one character. |
Down or j | Move down one line. |
Up or k | Move up one line. |
Right, l, or Space | Move right one character. |
Enter | Move to the start of the next line. |
Home, ^, |, or 0 (Zero) | Move to the start of the line. |
End, $ | Move to the end of the line. |
:number Enter | Move to line number. |
:0 Enter | Move to the start of the file. |
:$ | Move to the end of the file. |
w | Move forward one word. |
Command | Description |
---|---|
i | Insert before the cursor. |
I | Insert at the start of the line. |
a | Append after the cursor. |
A | Append at the end of the line. |
o | Open a line after the current line and insert text. |
O | Open a line before the current line and insert text. |
Command | Description | Examples |
---|---|---|
x | Delete one character to the right of the cursor. | x deletes one character to the right of the cursor; 25x deletes the character at the cursor position and 24 characters to the right. |
X | Delete one character to the left of the cursor. | X deletes one character to the left of the cursor; 19X deletes 19 characters to the left. |
d, followed by a cursor movement | Delete from the cursor position to the indicated position. | dj deletes the current line and the line below; dw deletes one word. |
dd | Deletes a line. | dd deletes the current line; 15dd deletes 15 lines. |
y, followed by a cursor movement | Yank from the cursor position to the indicated position. | yj yanks the current line and the line below; yw yanks one word. |
yy | Yanks a line. | yy yanks the current line; 15yy yanks 15 lines. |
p | Puts yanked or deleted text after the cursor. If the text contains any partial lines, it is inserted directly after the cursor; otherwise, it is inserted starting on the next line. | p puts one copy of the yanked text into the document after the cursor; 20p puts 20 copies of the yanked text after the cursor. |
P | Puts yanked or deleted text before the cursor. If the text contains any partial lines, it is inserted directly before the cursor; otherwise, it is inserted on the previous line. | P puts one copy of the yanked text into the document before the cursor; 20P puts 20 copies of the yanked text before the cursor. |
Command | Description |
---|---|
:w | Write (save) using the current filename. |
:w newfilename | Write to the file newfilename (subsequent :w commands will still write to the original filename). |
:w! | Force-write (write even if in read-only mode). |
:q | Quit (succeeds only if the document is saved). |
:q! | Force quit even if the document isn't saved (abort!). |
:wq or :x or ZZ | Write and quit (exit with save). |
Runlevel | Description | Purpose |
---|---|---|
s (or S) | Single-user maintenance mode | Emergency system recovery work |
0 | Halt | Stops the system |
1 | Single-user mode | System administration |
2 | (Multiuser without networking) | (Not normally used) |
3 | Multiuser, character-mode | Normal system operation without graphical login; useful for servers |
4 | (Not defined) | (Not normally used) |
5 | Graphical | Normal system operation with graphical login. |
6 | Reboot | Restarts the system |
7, 8, 9, a, b, c | (Not defined) | Available for custom purposes |
If you have configured a GRUB password, you will be prompted to enter it before changing the boot options.
Option | Description | Notes |
---|---|---|
-b directory | Base for home directories (a directory with the same name as the username will be created in this directory and used as the home directory) | useradd only; the default is /home. |
-c "fullName" | User comment field; almost always used to hold the user's full name | If the full name contains spaces, quote it. |
-d homedir | User's home directory | |
-e YYYY-MM-DD | Account expiry date | |
-f days | Days of inactivity before the account is considered abandoned and locked | |
-g group | User's primary group | Default is the user's own group (same name as the username). |
-G grp1,grp2,... | Supplementary group membership | |
-M | Don't create a home directory | useradd only. |
-m | Create a home directory if it doesn't exist | This is the default action. |
-p cryptpass | Set encrypted password to cryptpass | Useful when copying accounts from an old system configuration. |
-s shell | Sets the user's shell to shell | |
-u uid | Set the numeric user ID to uid | Useful when copying accounts from an old system configuration or synchronizing with old NFS servers. |
-L | Lock account against login | usermod only. |
-U | Unlock account and permit login | usermod only. |
This field is historically called the gecos or gcos field because it originally cross-referenced user IDs between the Unix and General Electric Comprehensive Operating System (gecos) at Bell Labs. You'll still find this field documented as pw_gecos in Linux library function documentation (for an example, see man getpwent).
For accounts that require a password but should not permit the user to log in, such as an account used only for file sharing or POP/IMAP email access, use the dummy shell /sbin/nologin. If the user attempts to log in, the message "This account is currently not available" is displayed, and the user is logged out automatically. To use a different message, place the desired text in the file /etc/nologin.txt.
There are two other mechanisms available for file access control: see Lab 8.2, "Using SELinux" and Lab 8.3, "Using Access Control Lists."
Table 4-13. Special file permissions | ||||
---|---|---|---|---|
Name | Abbreviation | Appearance in ls -l output | Meaning when applied to a file | Meaning when applied to a directory |
Set-User-ID | SUID | s in the x column for the user if execute permission is enabled, or S if execute permission is disabled. | When executed, the program takes on the user identity of the file's owner. | (No meaning) |
Set-Group-ID | SGID | s in the x column for the group if execute permission is enabled, or S if execute permission is disabled. | When executed, the program takes on the group identity of the file's group. | All files and subdirectories created in the directory will be owned by the same group that owns the directory. Subdirectories will automatically have their SGID permission enabled. |
Sticky bit | Sticky | t in the x column for other if execute permission is enabled, or T if execute permission is disabled. | (No meaning) | Files in the directory can be deleted or removed only by their owner (otherwise, anyone with write permission on the directory can delete or rename files in that directory). |
The permissions on the directories that contain the file also come into play when determining what a user can do with a file. If he does not have execute permission on all of the directories in the path from the root (/) to the file, then he will not be able to access the file, regardless of the permissions on the file itself. Likewise, if he has execute permission on all of those directories, plus write permission on the directory containing the file, then he can delete the file (destroying all the data), even if he can't write to itand then create a new file with the same name.
Notation | Description |
---|---|
u+w | Adds write permission for the user. |
o-rwx | Removes read, write, and execute permission for others. |
ug+r,o-r | Adds read permission for the user and the group; removes read permission for others. |
a-x, ugo-x | Removes execute permission for all users. |
u=rw,go=r | Sets exactly read and write permission for the user, and only read permission for group and others. The difference between = and + is that = will disable other permissions (such as execute for the user in this example), while + will leave other permissions at their previous value. |
You won't be able to terminate processes owned by other users (including system processes) this way because you have insufficient permission. It is possible to run this program as root, which will let you terminate any process:
# gnome-system-monitor
Terminating the wrong process(es) can leave your system in a partially functioning or unusable state, and it may be necessary to reboot the system to recover. Be careful!
Just like the GNOME System Monitor, the KSysGuard program can't terminate processes owned by other users (including system processes) when run by a normal user. To run the program as root:
# ksysguard
KSysGuard can monitor many aspects of system status in addition to the process table; it's also capable of monitoring remote systems. See the KSysGuard Manual for details (press F1 in the KSysGuard window).
Key | Description |
---|---|
? | Display help. |
u | Restrict the display to processes owned by one user. |
M | Sort by memory usage. |
P | Sort by current CPU usage. |
T | Sort by time (cumulative CPU usage). |
m | Toggle memory summary on/off. |
f | Field-list customization display. You will see a menu of possible fields; press the letter of the field you wish to toggle on/off, then Enter to exit from this display. |
o | Field-order customization display. You will see a list of displayed fields; type the uppercase letter for a field to shift the field left on the display, or type the lowercase letter to shift it right. Press Enter to exit this display. |
Like ls, the ps command has dozens of options. The Fedora version of ps can use Unix System V syntax or BSD syntax, so many option letters have two meanings; the one that is used depends on whether the option is specified with or without a hyphen!
To see the full documentation for ps, view the manpage but be prepared to take some time; it's over 16 pages long!
Note that the value used with the nice command is the opposite of what you may usually associate with a priority. Put another way, a nice level of 20 results in a process that isn't very nice to its fellow processes, since it's running at a high priority and hogs the CPU.Notice that renice does not permit the user to increase the priority of a process, even if the user lowered it in the first place. However, root can set any priority she chooses:
The entire SSH security model revolves around the fact that the private key is private. If you permit access to your private key, the security is completely compromised.This generates a public key and installs it on the remote system. If you will be connecting to multiple host systems, distribute your key to all of the systems by repeating the previous ssh command for each host.
If you're not logged in to your Fedora system through the GUI, you will need to enter this command before using ssh-add:You can now connect to remote hosts without logging in:
$ eval $(ssh-agent)
Agent pid 15431
When you log in using the GUI, Fedora starts the ssh-agent program automatically.
The -X option may cause remote X clients to be counted as untrusted from the point of view of the X server. This is perfect for most purposes, but if you want the remote client to be able to do screen captures (for example, if the remote application is the GIMP and you want to acquire a screenshot), substitute -Y for -X to configure the remote client as trusted.
You may also need to configure Fedora's firewall to permit SSH connections.
Note that the error message starts with bash, indicating that it was produced by the shell and not by the cal command.A command is not aware of file redirection unless it has specifically been programed to check the standard file descriptors or perform special operations on them (such as changing terminal characteristics). Redirected file descriptors are inherited by applications that were started by commands; in this example, the nice command starts the cal command, and cal inherits the redirection set up for nice :
To send a copy of the data to the screen, use tee with the device file /dev/tty (the current terminal):
$ cal -y | tee /dev/tty | grep Mo | head -1 >/tmp/dow-header.txt
Name | Purpose | Format |
---|---|---|
DISPLAY | Information on which X display is being used | hostname:display.screen hostname is the hostname or IP address of the X server or blank for the local host, display is the display number, and screen is the screen number (optional; the screen number specifies the monitor in a multimonitor, single-person display configuration). |
HOME | Home directory | Absolute pathname of the user's home directory. |
HOSTNAME | Name of this computer | Fully qualified domain name of the local host. |
Location of the user's default mailbox | Absolute pathname of the user's mailbox (usually /var/spool/mail/<username>). | |
PATH | List of directories to be searched to find a command | Absolute pathnames of directories to be searched, separated by colons. |
PS1, PS2 | Primary and secondary shell prompts | Plain text. Special characters sequences consisting of \ and a letter are replaced with other information; for example, \w is replaced by the current working directory (see the manpage for bash for a complete list). |
TERM | Model number of the current terminal | Must correspond to a filename in /usr/share/terminfo/?/*. |
You don't need to export PATH in this case because it has already been exported; assigning a new value does not changes its exported status.Assuming that the topten script is saved in /home/hank/bin , you can now execute it by just typing its name:
Name | Description | Notes |
---|---|---|
$$ | Process ID of the shell | Since process IDs are unique (at any one point in time), this can be used to ensure unique filenames (e.g., /tmp/$$.txt will never conflict with the same filename used by another copy of the same script). |
$0 | Name of the script | Useful to generate error messages, and when one script is invoked through more than one name. |
$1, $2, $3, ... | Arguments given on the script's command line | The shift command will eliminate $1 and then shift all of the parameters accordingly ($2 becomes $1, $3 becomes $2, and so forth). |
$# | Number of arguments from the script's command line | If $# is 0, then no options were given on the command line. |
$* $@ | All of the arguments from the script's command line | When quoted, "$*" becomes a single block of text containing all of the arguments, while "$@" becomes separate words. If the script is called with the arguments "green" and "yellow", then "$*" would evaluate to "green yellow", while "$@" would evaluate to "green" "yellow". |
$? | Exit status of the last command | Manpages document the possible exit-status values for most commands. |
Structure | Notes | Example |
---|---|---|
for variable in list | The variable is assigned the first value in list, and loop-commands are executed. The process is then repeated for all of the other values in list. | # Set X to 'hosts', then display the filename and file contents. Repeat for 'services' |
do | for X in hosts services | |
loop-commands | do | |
done | echo "==== $X" | |
cat /etc/$X | ||
done | ||
if control-command | If the control-command succeeds, the if-commands are executed; otherwise, the else-commands are executed. | # Tell the user if the text 'test' appears in file1 |
then | if grep -q test file1 | |
if-commands | then | |
[else | echo "Found it!" | |
else-commands] | else | |
fi | echo "Not found." | |
fi | ||
while control-command | As long as control-command executes successfully, loop-commands are repeated. | # Display the free disk space every 2 seconds, forever |
do | while sleep 2 | |
loop-commands | do | |
done | df -h | |
done |
The exit status of the last command is taken as the exit status of a pipeline, which is grep in this case. The -q argument to grep suppresses the outputotherwise, matching lines are sent to standard output.The built-in command test can be used to test conditions; the exit status will be zero if the condition is TRue . The most common conditional expressions are listed in Table 4-19.
Operator | Tests whether... | Example using an environment variable |
---|---|---|
-f file | File exists and is a regular file | -f "$A" |
-d file | File exists and is a directory | -d "$B" |
-r file | File exists and is readable | -r "$C" |
-w file | File exists and is writable | -w "$D" |
-x file | File exists and is executable | -x "$E" |
value1 == value2 | Strings match | "$F" == "red" |
value1 != value2 | Strings don't match | "$G" != "blue" |
value1 -eq value2 | Integer values are equal | "$H" -eq 2 |
value1 -ne value2 | Integer values are unequal | "$J" -ne 10 |
value1 -gt value2 | value1 integer value is greater than value2 | "$K" -gt 25 |
value1 -ge value2 | value1 integer value is greater than or equal to value2 | "$L" -ge 25 |
value1 -lt value2 | value1 integer value is less than value2 | "$M" -lt 75 |
value1 -le value2 | value1 integer value is less than or equal to value2 | "$N" -le 75 |
expression1 -a expression2 | expression1 and expression2 are both true | "$P" -gt 36 -a "$P" -lt 71 |
expression1 -o expression2 | expression1 or expression2 (or both) are true | "$P" -lt 12 -o "$P" -eq 50 |
Inside double parentheses, you can read a variable's value without using the dollar sign (use A=B+C instead of A=$B+$C).Here's an example using a while loop that counts from 1 to 20 using integer arithmetic:
Don't confuse the C-style for loop with the for...in loop!
The shebang line gets its name from sharp and bang, common nicknames for the #! characters.
bash comments start with # and are not executed so commenting out code means adding # at the start of selected lines to disable themEnvironment variables are inherited by child processes, so any environment variables set up during the login process are accessible to all shells (and other programs) you start. bash also supports the use of aliases , or nicknames, for commands, but since these are not inherited by child processes, they are instead placed in the file ~/.bashrc , which is executed each time a shell starts. If you log in once and then start three shells, ~/.bash_profile is executed once at login and ~/.bashrc is executed three times, once for each shell that starts.
In this chapter, the sections Lab 5.1, "Querying the Package Management Database" and Lab 5.2, "Installing and Removing Software Using RPM" deal with individual package management from the command line. If you want to go directly to the simplest and most comprehensive way of managing software packages, skip to Lab 5.3, "Using Repositories."
Option | Description |
---|---|
-a | Selects all packages. |
-f file | Selects the package that installed file. |
-g pkggroup | Selects the packages that belong to pkggroup (such as Applications/Productivity). |
-p pkgfile | Selects the uninstalled RPM package file pkgfile, which can be a local filename or an HTTP or FTP URI. Information is retrieved from the package file instead of from the RPM database. |
--triggeredby package | Selects packages that have scripts that are triggered by the installation or removal of package. For example, a mail-client package may have a script that changes its configuration if the local mail server is changed from sendmail to postfix. |
--whatprovides capability | Selects packages that provide a certain capability, such as the ability to run perl scripts. |
--whatrequires capability | Selects packages that require a capability. |
packagename | Selects a package with the given name. |
Option | Description |
---|---|
--changelog | Shows the package changelog, a list of changes to the various versions of the package (not necessarily to various versions of the software). |
-c | Shows the configuration files included in the package. |
-d | Shows the documentation files included in the package. |
-l | Lists files included in the package. |
--filesbypkg | Same as -l, except that the package name is printed in front of each file; useful when multiple packages are selected. |
-i | Provides detailed information about the package (package description, license, group, origin, and so forth). |
--provides | Lists the capabilities provided by the package. |
--requires | Lists the capabilities required to successfully use the package. |
--scripts | Displays pre- and post-installation scripts, and pre- and post-uninstallation (removal) scripts. |
--triggers | Displays the trigger scripts in the package. Trigger scripts are invoked when another, related package is installed or removed. |
Option | Description |
---|---|
--excludepath directory | Excludes files located in directory. |
--excludedocs | Excludes documentation files. This will save some space and may be useful on a small system, particularly if another machine is available with the documentation installed. |
--force | Enables rpm to overwrite files that are part of other packages, reinstall packages already installed, and downgrade instead of upgrade packages. |
-v | Verbose; lists each package as it is processed. |
-h | Displays hash marks (#) to show the progress of each operation. |
--justdb | Updates the RPM database, but doesn't actually install any software. |
--nodeps | Turns off checking for dependencies. Be careful using this option; the installed package will usually be unusable. |
--noscripts | Prevents installation scripts in the package from running. |
--notriggers | Prevents trigger scripts in other packages from running. |
--oldpackage | Permits a downgrade instead of an upgrade. |
--relocate olddir=newdir | Relocates files from one directory subtree to another. Useful if you want your binary files, datafiles, or documentation installed into an unusual location. Many Fedora packages are not relocatable. |
--repackage | (Applies to update/freshen only). Repackages the files from the old version of the package so that the upgrade can be undone (rolled back). See Lab 5.4, "Rolling Back a Package Installation, Upgrade, or Removal." |
--test | Checks for conflicts and potential problems, but does not make any actual changes to the system. |
Relocating files does not change configuration files, scripts, or programs that expect files to be located in particular locations. In the httpd example just shown, the Apache configuration files (/etc/httpd/conf/httpd.conf plus module-specific files in /etc/httpd/conf.d/*) must be edited by hand to reflect the new document root.The options for erasing software are a subset of the options for installing and upgrading; the most useful options are listed in Table 5-4 .
Option | Description |
---|---|
--allmatches | Erases all packages matching the name given (useful if more than one version is installed). |
--nodeps | Proceeds with the package removal even if doing so will break some dependencies for other packages. |
--noscripts | Prevents removal scripts in the package from running. |
--notriggers | Prevents trigger scripts in other packages from running. |
--repackage | Repackages the files being removed so that the removal can be undone (rolled back). See Lab 5.4, "Rolling Back a Package Installation, Upgrade, or Removal." |
--test | Checks for conflicts and potential problems, but does not make any actual changes to the system. |
Option | Description |
---|---|
list | Lists available packages. |
check-update | Verifies whether any updates are available. An exit code of 100 indicates that updates are ready for installation. |
whatprovides capability | Displays the name of any packages that provide the listed capability, which may be an RPM-style capability name or a filename. |
provides capability | |
search keyword | Searches for a package with keyword in the description, summary, packager name, or package name metadata. The search is case-insensitive. |
info package | Displays metadata about package (similar to rpm -qi). |
deplist package | Displays the dependencies of package, including the names of the packages that will resolve those dependencies. |
localinstall rpm_file | Installs or removes the package contained in the local rpm_file and, if necessary, resolves any dependencies using the repositories. |
localupdate rpm_file | |
-C | Runs the specified command from cache (doesn't contact each repository to check for updates). |
The yum-updatesd service must be running to make the update icon appear.To install the available updates, right-click on the update icon and select Apply Updates (or select Applications→System Tools→Software Updater, or enter the command pup). You will be prompted for the root password, and then the window shown in Figure 5-1 will appear; click "Apply updates" to install the updates listed.
If the browse-package-groups window looks familiar, you have a good memory. The same display is used for software package customization during installation.Select the checkbox in front of the packages that you wish to install, and deselect the checkbox of the packages that you wish to uninstall; then click Apply. After confirmation, the selected actions will be performed.
Fedora Extras also provides the Yumex tool, which provides an alternate graphical frontend to yum.
Repository | Enabled by default | Description |
---|---|---|
base | Y | Fedora Core base packages (same as CD/DVD) |
development | N | Prerelease Fedora Core packages (also known as "Rawhide") |
updates-released | Y | Updates to Fedora Core packages |
updates-testing | N | Prerelease update packages |
extras | Y | Add-on software for Fedora |
extras-development | N | Prerelease add-on software |
The Livna repository is located outside of the United States and distributes packages that have license or patent issues that make them ineligible for inclusion in the Fedora or Fedora Extras repositories. This may include usage restrictions (such as personal use only) or U.S. patent encumbrances. Check the licenses carefully to ensure that you can legally use the software in your circumstances in your jurisdiction.The FedoraFaq repository configuration files have livna enabled and the other repos disabled by default.
Each proprietary video driver requires a kernel module, so you may need to wait until a day or two after a new kernel is released before upgrading to that kernel.
Don't change the emit_via option, or puplet will not work.
Most tarballs will unpack into their own directory, but some badly packaged ones may not, and unpacking them will leave dozens of files in your current directory. Use tar's t option instead of the x to see the table of contents before unpacking:1. Change to the new directory:
$ tar tvzf xmorph_20040717.tar.gz
If you have a multiprocessor or multicore system, use make -j3, assuming it's not also a multiuser machine and you don't mind two cores/CPUs being utilized at 100 percent.1. If make was successful, use make install to install the software:
The fedora-rpmdevtools package provides the fedora-buildrpmtree command, which prepares a suitable directory structure within your home directory and creates a very basic .rpmmacros file. If you use this command, your RPMs will be built within the directory ~/rpmbuild.
Tag | Description |
---|---|
Name | Name of the package. |
Version | Version of the software in the package (software version). |
Release | Release number of the package (package version). |
Group | The application group to which the software belongs. See /usr/share/doc/rpm-4.4.2/GROUPS for a list of possible values. |
URL | The software's home page on the Web. |
License | The license used for the software (such as GPL or Mozilla). |
Summary | A one-line summary of the package description. |
Requires | Capabilities needed by the software in order to be successfully installed. Many requirements are automatically determined, so this line is often not needed. Also include in this tag any special capabilities required by install and uninstall scripts (or triggers). If a package name is given as an argument, a version number can be provided, and a comparison can be given (such as gcc >= 4.0 or sendmail = 8.13.4). |
BuildRequires | Capabilities needed by the software in order to be successfully built, but not needed simply to install the RPM. For example, the gcc C compiler may be required to build the RPM package, but not to install it once it has been built. |
Provides | Capabilities provided by the package. Like Requires, most of the Provides will be determined automatically. |
BuildRoot | Specifies where the package should be installed during the package-building process. Many packages use %{_tmppath}/%{name}-root, which will create a package-specific directory within ~/rpm/tmp. It is strongly recommended that you do not use /. |
If your build fails because you need additional software, you must find that software and add it to a BuildRequires line in the spec file.The -bi argument to rpmbuild instructs it to build up to the end of the %install stage. You can see that rpmbuild has detected files in BuildRoot that are not included in the package. To see the actual contents of the BuildRoot , you can change to the ~/rpm/CriticalMass directory and look around:
In the case of CriticalMass, there are no configuration files installed by the RPM.The whole %files section looks like this:
When changing a storage configuration, it is possible to make a mistake and lose data. Take your time, ensure that you are confident of what each step will do before performing it, and make sure you back up your data before performing any LVM operations.
In the examples given here, the volume-group and logical-volume names recommended in Chapter 1 have been used: the volume group is main, and the logical volumes are named root, home, and swap.Although you can increase or decrease the size of any logical volume at any time, an ext3 filesystem within a logical volume can be reduced in size only when it is not in use (unmounted). If the filesystem is the root filesystem, it is in use whenever the system is running; therefore, the only way to shrink the root filesystem is to use another disk as a temporary root filesystem, which is usually done by running the system from the installation CD in rescue mode (see Lab 10.6, "Using Rescue Mode on an Installation Disc "). There is also a limit to how large a filesystem can grow while in use; growing the filesystem past that point must be done when the filesystem is unmounted.
If you used the Fedora default names, the main volume group will be named VolGroup00, and the logical volumes will be named LogVol00, LogVol01, and so forth.
If the resize fails with the message "No space left on device," you may have attempted to resize the filesystem past the maximum that can be done while the filesystem is mounted (in use). You can attempt to unmount the filesystem by deselecting the checkbox labeled Mount and then retry the operation (this will always fail for the root filesystem and will usually fail for filesystems containing /var and /home, in which case you may need to use single-user mode).
Be extremely careful with this option because it will delete all of the data on an entire disk partition. If you select the wrong partition on a dual-boot system, you could wipe out all of the data used by the other operating system (such as Windows).If the Initialize Entity button is deactivated (grayed-out and unclickable), look in the right pane for the reason that the partition is "Not initializable." The most common reason given is Foreign boot partition , which means that the partition is marked as bootable in the drive's partition table. To correct this, use fdisk on the disk containing the partition; for example, run fdisk on the disk /dev/sdb to edit the settings for the partition /dev/sdb1 :
LVM subcommand | Description |
---|---|
vgs | Displays details about volume groups (compact) |
pvs | Displays details about physical volumes (compact) |
lvs | Displays details about logical volumes (compact) |
vgdisplay | Displays details about volume groups (verbose) |
pvdisplay | Displays details about physical volumes (verbose) |
lvdisplay | Displays details about logical volumes (verbose) |
vgcreate | Creates a volume group |
vgremove | Removes a volume group |
pvcreate | Prepares a block device (such as a disk partition) for inclusion in a volume group by adding a disk label to the start of the block device |
pvremove | Wipes out the disk label created by pvcreate |
vgextend | Adds a physical volume to a volume group |
vgremove | Removes a physical volume from a volume group |
pvmove | Migrates data from one physical volume to another |
lvcreate | Creates a logical volume or snapshot LV |
lvextend | Grows a logical volume |
lvreduce | Shrinks a logical volume |
lvresize | Grows or shrinks a logical volume |
vgscan | Scans block devices for volume groups (necessary when using a rescue-mode boot) |
The symbolic links are not available when you are in rescue mode (see Lab 10.6, "Using Rescue Mode on an Installation Disc"), so it's important to remember that you can also use these subcommands as arguments to the lvm command (for example, when in rescue mode, type lvm lvdisplay instead of lvdisplay).
If you have more than one VG present and only want to see information about a specific one, you can specify a volume group name as an argument to vgdisplay or vgs.To list the PVs present, use pvs or pvdisplay :
Suffix | Name | Size | Approximation |
---|---|---|---|
k, K | Kibibyte (kilobyte) | 210 = 1,024 bytes | Thousand bytes |
m, M | Mebibyte (megabyte) | 220 = 1,048,576 bytes | Million bytes |
g, G | Gibibyte (gigabyte) | 230 = 1,073,741,824 bytes | Billion bytes |
t, T | Tebibyte (terabyte) | 240 = 1,099,511,627,776 bytes | Trillion bytes |
If the resize2fs fails with the message No space left on device, the new size is too large for the existing allocation tables
The LVM commands accept sizes containing decimals (such as 1.2G), but resize2fs does not; use the next smaller unit to eliminate the decimal point (1200M).Both the filesystem commands and the LVM commands round off sizes to the closest multiple of their internal allocation units. This means that resize2fs and lvreduce may interpret a size such as 750M slightly differently. In order to avoid the potential disaster of resizing the LV to be smaller than the filesystem, always resize the filesystem so that it is slightly smaller than the planned LV size, resize the LV, and then grow the filesystem to exactly fill the LV. In this case, I'm resizing the filesystem to 740 MB and will resize the LV to 750 MB.
Removing an LV is irreversible, so be sure that you're not deleting any important data.
If the disk is not partitioned, you can use fdisk or (more easily) parted to create a partition before running pvcreate.You can then add that PV to an existing volume group:
These commands create a single partition that fills the entire disk /dev/sde:
# parted /dev/sde mklabel msdos# parted -- /dev/sdemkpart primary ext2 1 -1
In this case, the partition will be /dev/sde1.
The warning message displayed by lvreduce is accurate: if you set the logical volume size smaller than the filesystem size, you will lose data! Be extremely careful when resizing volumes; it's a good idea to back up your data first.Note that, as before, the filesystem was resized to be slightly smaller than the desired size, then expanded to fill the LV after the LV was resized.
If your system has the default Volume Group and Logical Volume names, substitute the correct name (such as /dev/VolGroup00/LogVol00) for /dev/main/home. The problem is that it's hard to keep the logical volume names straightwhich is why I recommend using more meaningful names.
The LVM device nodes will be created in /dev/mapper/<vg-lv> and /dev/<vg>/<lv>. The /dev/dm-<N> nodes are not created.You can now resize the root partition:
Using dmraid can thwart data-recovery efforts if the motherboard fails and another motherboard of the same model (or a model with a compatible BIOS dmraid implementation) is not available.Add-in cards that contain their own CPU and battery-backed RAM can reduce the load of RAID processing on the main CPU. However, on a modern system, RAID processing takes at most 3 percent of the CPU time, so the expense of a separate, dedicated RAID processor is wasted on all but the highest-end servers. So-called RAID cards without a CPU simply provide additional disk controllers, which are useful because each disk in a RAID array should ideally have its own disk-controller channel.
RAID Level | Description | Protection against drive failure | Write performance | Read performance | Number of drives | Capacity |
---|---|---|---|---|---|---|
Linear | Linear/Append. Devices are concatenated together to make one large storage area (deprecated; use LVM instead). | No. | Normal. | Normal | 2 | Sum of all drives |
0 | Striped. The first block of data is written to the first block on the first drive, the second block of data is written to the first block on the second drive, and so forth. | No. | Normal to normal multiplied by the number of drives, depending on application. | Multiplied by the number of drives | 2 or more | Sum of all drives |
1 | Mirroring. All data is written to two (or more) drives. | Yes. As long as one drive is working, your data is safe. | Normal. | Multiplied by the number of drives | 2 or more | Equal to one drive |
4 | Dedicated parity. Data is striped across all drives except that the last drive gets parity data for each block in that "stripe." | Yes. One drive can fail (but any more than that will cause data loss). | Reduced: two reads and one write for each write operation. The parity drive is a bottleneck. | Multiplied by the number of drives minus one | 3 or more | Sum of all drives except one |
5 | Distributed parity. Like level 4, except that the drive used for parity is rotated from stripe to stripe, eliminating the bottleneck on the parity drive. | Yes. One drive can fail. | Like level 4, except with no parity bottleneck. | Multiplied by the number of drives minus one | 3 or more | Sum of all drives except one |
6 | Distributed error-correcting code. Like level 5, but with redundant information on two drives. | Yes. Two drives can fail. | Same as level 5. | Multiplied by the number of drives minus two | 4 or more | Sum of all drives except two |
If you want to experiment with RAID, you can use two USB flash drives; in these next examples, I'm using some 64 MB flash drives that I have lying around. If your USB drives are auto-mounted when you insert them, unmount them before using them for RAID, either by right-clicking on them on the desktop and selecting Unmount Volume or by using the umount command.The mdadm option --create is used to create a RAID array:
Do not hot-plug disk drivesi.e., physically remove or add them with the power turned onunless the drive, disk controller, and connectors are all designed for this operation. If in doubt, shut down the system, switch the drives while the system is turned off, and then turn the power back on.If you check /proc/mdstat a short while after readding the drive to the array, you can see that the RAID system automatically rebuilds the array by copying data from the good drive(s) to the new drive:
I like the "Faithfully yours" bit at the end!If you'd prefer that mdadm run a custom program when an event is detectedperhaps to set off an alarm or other notificationadd a PROGRAM line to /etc/mdadm.conf :
Bit from drive A | Bit from drive B | Parity bit on drive C |
---|---|---|
0 | 0 | 0 |
0 | 1 | 1 |
1 | 0 | 1 |
1 | 1 | 0 |
The GRUB boot record should be written to each drive that contains the /boot filesystem (see Lab 10.5, "Configuring the GRUB Bootloader")
If the remote drive requires a user ID and password for connection, edit /etc/iscsid.conf.The options indicate discovery mode, sendtargets ( st ) discovery type, and the portal address or hostname. The result that is printed shows the IQN of the remote target, including a node record ID at the start of the line ( f68ace ). The discovered target information is stored in a database for future reference, and the node record ID is the key to accessing this information.
Do not use iSCSI directly over the Internet: route iSCSI traffic through a private TCP/IP network or a virtual private network (VPN) to maintain the privacy of your stored data.To shut down the remote mirror, reverse the steps:
System role | Standard directories | Notes |
---|---|---|
Database server (e.g., MySQL) | /var/lib/mysql | Stop the database server or use snapshots to ensure consistency between tables. |
Web server | /var/www/etc/httpd/home/*/~public_html | Also include any data directories used by web applications. |
DNS nameserver | /var/named/etc/named.conf | This information usually changes slowly. |
Desktop system, or any system accessed by individual users | /home | Exclude cache directories such as /home/*/.mozilla/firefox/*/Cache. |
Samba server | All directories served by Samba | |
CUPS print server | /etc/cups | Configuration information only; usually changes slowly. |
All systems | /etc | Configuration information for most software and hardware installed on the system. |
Level | Media used | Discs or tapes required |
---|---|---|
A (Son) | Monday Thursday | 4 |
B (Father) | Three out of every four Fridays | 3 |
C (Grandfather) | Fridays not covered by level B | 13 |
Note that level A media will be more frequently used than level B or C media and will therefore need to be replaced more often.You must also decide where and how you will store your media. Unless the media is stored offsite, a disaster such as fire or theft could result in the loss of both the original storage drives and the backup media, but storing media offsite will slow the restoration process.
You will need sufficient disk space to hold the compressed image before it is written to the optical disc.
Each LV to be backed up must have a mount point identified in /etc/fstab.
mt command | Description |
---|---|
mt rewind | Rewinds the tape |
mt fsf | Forward-skips a file |
mt fsf count | Forward-skips count files |
mt bsf | Backward-skips a file |
mt bsf count | Backward-skips count files |
mt status | Displays the drive status |
mt offline or mt eject | Rewinds and ejects the tape (if possible) |
Directory | Frequency | Time of execution | Task examples |
---|---|---|---|
/etc/cron.hourly | Hourly | :01 past each hour | Send/receive netnews |
/etc/cron.daily | Daily | 4:02 a.m. every day | Analyze web logs, rotate logs, delete old temporary files, monitor cryptographic certificate expiry, update installed software |
/etc/cron.weekly | Weekly | 4:22 a.m. every Sunday | Clean up old yum packages, index manpages |
/etc/cron.monthly | Monthly | 4:42 a.m. on the first day of every month | (None defined) |
Services are programs that constantly run in the background. Services can start automatically when the system starts, but not all services are configured this way by default (see Lab 4.6, "Managing and Configuring Services").
It also might be necessary to adjust your firewall or SELinux configuration to use the services discussed in this chapter (see Chapter 8 for more information).
Samba can be configured to work with a wide range of Windows versions and to serve resources in many different ways. This lab is focused on sharing files and printers with Windows XP systems in a small workgroup, which is a common scenario in home and small-business networks.
See Lab 4.7, "Managing Users and Groups," to create Fedora accounts for your users before enabling Samba access.Next, select Preferences→Samba Users to bring up the user configuration dialog box shown in Figure 7-2. Click Add User, select an existing Linux user, enter a Windows username (which may be the same as the Linux username), and enter the Samba password of your choice twice. Click OK when you're done.
If you are using a firewall or have SELinux enforcing turned on, you will need to adjust your security settings to permit remote systems to access the Samba server (see Lab 8.2, "Using SELinux").Your system will now be visible to local Windows computers; for example, on an XP system, click My Network Places and then "View workgroup computers," and your Fedora system will appear as an icon with the hostname that you have assigned to it, as shown in Figure 7-3 . Click on the computer icon to see the folders being shared by the Fedora system (after you enter your Samba user ID and password to authenticate).
Although the Samba configuration tool starts the Samba system, you'll need to enable the Samba service if you want Samba to start every time you boot your systemsee Lab 4.6, "Managing and Configuring Services."
In order for a remote user to access a shared directory through Samba, that directory must have the appropriate permissions and SELinux context.
Although you can access Fedora printers through Samba printer sharing, it's often faster and easier to access those printers directly through CUPS printer sharing, regardless of the operating system in use.1. Go to Printers and Faxes and then click "Add a Printer." The Add Printer Wizard will appear. Click Next to get past the introductory message, then select "A network printer, or a printer attached to another computer" for the printer type, and then click Next. Select "Browse for a Printer," and then click Next to see a list of computers on the local Windows network. Double-click on the name of the Fedora system, which will reveal the names of the printers on that system, as shown in Figure 7-5 ; double-click on the desired printer.
If you do not see the printer listed, you will need to insert the printer's driver CD, click Have Disk, and then select the disk location. When the list of printer models appears, select the one that matches the printer you are installing.1. If you already have a printer set up on the Windows system, you will be asked if the new printer should become the default. Choose Yes or No, and then click Next.
You will need to adjust the SELinux context of the shared directory (see "Using SELinux" in Chapter 8 Lab 8.2, "Using SELinux in Chapter 8).After editing the configuration file, restart or reload Samba to activate the changes:
Range | Number of addresses available | Class-based address breakdown |
---|---|---|
10.0.0.0 10.255.255.255 | 16,777,216 | 1 class A network of 16,777,216 addresses |
172.16.0.0 172.31.255.255 | 1,048,576 | 16 class B networks of 65,536 addresses each |
192.168.0.0 192.168.255.255 | 65,536 | 256 class C networks of 256 addresses each |
Address range and purpose | Host address | Name and description | Notes |
---|---|---|---|
0 | Network | Reserved address | |
1-63 Servers | 1 | prime (nameserver, web server) | Traditional nameserver address |
2 | cabinet (Samba fileserver) | ||
3 | chatterbox (Asterisk phone system) | ||
3-63 | Future use | ||
64-127 Network devices(non-computers) | 64 | laser1 | Main laser printer |
65 | multifunction1 | Printer-scanner-copier | |
66 | webcam1 | Monitors front door | |
67-127 | Future use | ||
128-191 Desktop and laptop systems | Dynamically assigned | ||
192-254 Network infrastructure | 192-253 | Future use | |
254 | gateway (router; path to the Internet) | Traditional address for a gateway | |
255 | Broadcast | Reserved address |
Hardware MAC address | Hostname |
---|---|
00:0c:0d:99:99:99 | prime |
00:0c:0d:aa:aa:aa | cabinet |
00:0c:0d:bb:bb:bb | chatterbox |
00:0c:0d:cc:cc:cc | laser1 |
00:0c:0d:dd:dd:dd | multifunction1 |
00:0c:0d:ee:ee:ee | gateway1 |
You will need to open port 68 UDP in your firewall configuration in order to permit clients to reach dhcpd. You should also verify that no other DHCP servers are running on your network (check router and gateway appliances in addition to computers).
Context | Message type | Origin | Description | |
---|---|---|---|---|
Initial negotiation | Lease renewal | |||
* | DHCPDISCOVER | Client | Client tries to discover the DHCP server. | |
* | DHCPOFFER | Server | The DHCP server offers its location and possible lease details. | |
* | * | DHCPREQUEST | Client | The client requests a lease. |
* | * | DHCPACK/DHCPNACK | Server | The server acknowledges (approves) or negatively acknowledges (rejects) the lease request. |
The Fedora package called bind contains the named service.The named service is not run by default. Once you configure it to run (see Lab 4.6, "Managing and Configuring Services "), it will act as a caching nameserver:
If you just want to use named as a caching nameserver, you can skip to the section entitled "Using your nameservers locally."To configure named as an authoritative nameserver for your domain, you just have to give it the information about your domain that you want it to serve to other systems. Usually at least two authoritative nameservers are set up for each domain; one is configured as the master , and the others are slaves . Changes to the DNS data are made on the master, and the slaves update themselves periodically.
The user interface of this tool is unique! It does not behave in the same way as other graphical configuration tools, so take your time when using it.To add a zone which can be a complete domain or a subdomainclick on the DNS Server entry to highlight it, click the New button, and then select "zone" from the menu that appears. Figure 7-7 shows the small dialog box that appears.
Make sure that an A record exists for each hostname mentioned in CNAME, NS, and MX records.Once you have entered all of the resource records you want, click Save to save the information. If named is already running, it will be reloaded so that the changes take effect immediately.
These hosts don't have to be in the same zone or domain; for example, it's possible for email and name service to be handled by a host outside that domain. In that case, the A record will not appear in this zone but must appear in the zone for that domain.
For example, if the mail server for fedorabook.com was global.proximity.on.ca, then the MX record could point to that host. There would be no A record for global.proximity.on.ca within the fedorabook.com zone, but there would have to be one within the proximity.on.ca zone (which might be on a different nameserver altogether).
If you have the package bind-chroot installed, then prepend the directory /var/named/chroot/ to pathnames throughout this chapter. For example, /var/named would become /var/named/chroot/var/named, and /etc/named.conf would become /var/named/chroot/etc/named.conf.The remaining zone sections are used to resolve standard requests, such as the address of localhost and localhost.localdomain (always 127.0.0.1), and the reverse of those requests.
bind-chroot is a package intended to increase the security of the nameserver. It is considered obsolete, since SELinux now provides similar protection.
Entry | Description | Equivalent number of seconds |
---|---|---|
3D | 3 days | 259,200 |
1D12H 36H | 1 day and 12 hours (or 36 hours) | 129,600 |
2W | 2 weeks | 1,209,600 |
1D10M | 1 day and 10 minutes | 87,000 |
All hostnames and domain names in a zone file will have the name of the zone added to the end of them unless they end with a period. Thus, in this example, bluesky (with no period) would be interpreted as bluesky.fedorabook.com, as would bluesky.fedorabook.com with no period: bluesky.fedorabook.com.fedorabook.com.The values in parentheses at the end of the record are the serial number and the time values for this record. It's helpful (and common practice) to split this information across several lines and add comments to label which time value is which:
There is little point configuring a second nameserver if all of your services (mail server, web server, and so on) are on one server and that is the same machine that runs your master nameserver, because a failure or overload on that system would effectively cripple the other services along with the nameserver (and there is no value in being able to reach a server that can't provide service).This type of nameserver is called a slave , but it is still considered authoritative for the domain if there is an NS record for it in the zone.
You may need to adjust your SELinux configuration to use slave zones (see Lab 8.2, "Using SELinux").To configure a slave nameserver graphically, start the graphical configuration tool ( Figure 7-6 ), highlight the DNS Server entry, click on the New icon, and then click on the Zone option from the pull-down list. Create the zone in the same way you did on the master server, but set the Zone Type to "slave." Click OK, and the window shown in Figure 7-12 will appear.
The Linux resolver uses the file /etc/nsswitch to determine possible ways of resolving a hostname to an IP address. The default configuration is to check /etc/hosts first, and then try DNS.The caching nameserver first checks its cache to see if it already has the answer to the query, and if it does, it returns that answer to the client. Otherwise, it contacts one of the root nameservers (listed in /var/named/named.ca ) by sending a UDP packet to port 53. The root nameserver sends back a reply referring the caching nameserver to the authoritative nameserver for the appropriate top-level domain (TLD). The caching nameserver then sends another query, this time to the TLD nameserver, which replies with a referral to the next nameserver down the chain. This happens recursively until a nameserver that knows the answer is foundor until the possibilities are exhausted and a nameserver finally returns an NXDOMAIN (nonexistent domain) response.
You will need to open the IPP port 631 (ipp:tcp) in your firewall configuration (see Lab 8.1, "Prevent Unwanted Connections").Your printer will now be accessible to other systems.
LPD printer sharing requires the printer port 515 (printer:tcp) to be opened in your firewall.
LPD emulation is enabled globally; there is no provision to share only some printers, or to share only with certain clients
If you can access the web page on the server but not from a remote system, then the firewall configuration may require adjustment.
The webmaster's address is displayed in server error messages and could be harvested by web spiders, so it is a good idea to use a disposable email alias and change it frequently to thwart spammers.The Available Addresses area is used only if you wish to prevent the web server from using some network interfaces, or if you wish to use a nonstandard TCP/IP port (the default for HTTP is port 80). This is usually left at the default setting.
If you choose a Document Root that is not within /var/www/html and have SELinux active, you will need to change the security context of that directory (see Lab 8.2, "Using SELinux").
Comments must be on a line by themselves.Directives are global unless they are placed in a container , which limits the scope to which the directive applies. For example, the <Directory> container causes the contained directives to be applied only to a specific directory (and its subdirectories); here, the directives apply only to the contents of /var/www/html :
Changing DocumentRoot will require you to change the SELinux context of the new document root directory.
If you have SELinux enabled, each user will need to execute this command to make his content accessible to Apache:
$ chcon -R -t httpd_sys_content_t ~/public_html
Alternately, users can make their public_html content accessible to both Apache and Samba (see Lab 8.2, "Using SELinux").
Your DNS configuration must include all of the hostnames used for ServerName and ServerAlias or be configured with a wildcard hostname (*).
CGI scripts in users' ~/public_html directories will execute with that user's permission and will therefore be able to read and write any files that the user can read and write. This can be a huge security risk because a single web script can expose any file, email, or database on your system which that user can normally access.
In order to reduce the risk of a script that has been maliciously compromised, scripts that are writable by group or other users or contained in directories that are writable by group or others will not be executed by Apache, and an error message will be logged in /var/log/httpd/suexec.
Note that passwords are sent in unencrypted form over the network unless you use a secure (SSL) connection, so the security provided by this option is minimal.First, configure Apache to permit the use of .htaccess files for authentication configuration. If you're using the graphical configuration tool, select the checkbox labeled "Let .htaccess files override directory options."
If other users are logged in to the system, there is a small chance that they will be able to discover these passwords if you set them using the -b option because the command line is visible in the output of the ps command (although very briefly).If you enter an existing user ID instead of a new one, the old password will be updated instead of creating a new record:
htdigest does not accept the -b option used with htpasswd.
Remember to enable inbound connections on port 25 (SMTP) in your firewall configuration.
Run the newaliases command after each edit to the /etc/aliases file to ensure that the changes are put into effect immediately:Next, change any aliases that you do not wish to redirect to root , sending the mail to the user of your choice:
# newaliases/etc/aliases: 76 aliases, longest 10 bytes, 765 bytes total
This strategy is also effective when publishing email addresses on a web site: simply change the address on the web site periodically, using a different disposable email address each time. If a spammer harvests your email address from the web page, it will be useful to them only for a short time.
Note that the syntax for /etc/mail/virtusertable differs from the syntax for /etc/aliases: there are no colons, and only one destination address may appear in each entry.virtusertable also permits the redirection of entire domains, by leaving out the username portion of the email address:
To make fetchmail run automatically whenever you log in, place it in your ~/.bash_profile.
Buying a certificate is not covered in this lab.
If you are going to use IMAP or POP3 remotely, you will need to open some ports in your firewall. For IMAP, open ports for the IMAPandIMAPSservices (TCP ports 143 and 220); for POP3, open the POP3 and POP3S ports (TCP ports 110 and 995).
On the other hand, if you will be using the IMAP and POP3 services only with local applications such as SquirrelMailor local MTAs such as Evolution, you should close the IMAP and POP3 ports on your firewall.
If Apachewas running before you installed SquirrelMail, you'll need to restart or reload it so that it notices the SquirrelMail alias directive:You can now use SquirrelMail by accessing https://<hostname>/webmail . The web page shown in Figure 7-21 should appear.
# service apache reload
Unless you have other computers on your local network that need to access IMAP, you can restrict remote access to the IMAP server using Fedora's firewall facilities.
If you are using the default Apache SSL certificate (which is automatically up by default), you will get a warning from your browser when you first connect using https.Figure 7-21. SquirrelMail login page
You can instead access http://<hostname>/webmail to avoid that warning message, but your passwords and email may be read if someone intercepts your network communication.
Make sure that the mysqld service is running!You can then enter the database, access account, and password information into the configuration of whatever software will use MySQL.
MySQL recommends that you add a password to root's access of the MySQL server. You can do that with these commands (\ indicates that text continues on the following line):For example, to install Serendipity:
# /usr/bin/mysqladmin -u root password 'Secret'
# /usr/bin/mysqladmin -u root -h $(hostname) \
password 'Secret'
Secret is the root password that you wish to use. After you enable the root password, you'll need to use the -p option to mysql so that you are prompted for the password each time:
# mysql -p
This is the MySQL administrator account (root) and the MySQL password for that account; do not enter the Fedora root password!Once you have entered this information, click the Install button at the bottom of the page. You will see a confirmation page.
If you are using a firewall, you will need to open the FTP ports in the firewallTo view the contents of /var/ftp with a browser, go to ftp://<hostname>/ . To access files in a home directory, use the URL ftp://<user>@<hostname>/ (the browser will ask for your password) or ftp://<user>:<password>@<hostname>/ .
This configuration assumes that your Apache virtual host logfiles are named /var/log/httpd/<virtualhostname>-<access_log> and are in combined format.To configure Webalizer to analyze your virtual host logfiles each day, create the file /etc/cron.daily/00webalizer-vhosts :
The SELinux context of the directory containing the password file must be changed in order for this to work:The statistics reports should now be accessible using a web browser on any computer.
# chcon -t httpd_sys_content_t /var/lib/webalizer/
A list of most of the common services and their corresponding port numbers can be found in the file /etc/services.When the firewall is configured to your liking, click OK.
The Trusted Devices checkbox will disable firewall protection for the selected interface!Use the Allow Incoming checkboxes to select the services that will be permitted to connect to your system through the firewall. In almost all cases, SSH should be selected to permit secure remote connections for system administration.
In this example, IPP (Internet Print Protocol, used by CUPS), MDNS (multicast DNS, used by Avahi), and SSH connections are all permitted; only SSH was configured for the firewall, demonstrating that not all services are configured through the firewall configuration tools.Since the policy for each chain is ACCEPT, flushing (clearing) the rules will result in all packets being accepted. This is exactly what the iptables -F command does, which is executed when the iptables service is stopped.
To see a list of all the service-specific manpages for SELinux, enter the command:In the BOOLEAN section you will find this text:
$ apropos _selinux
Boolean name | Description in system-config-securitylevel | Reason for altering | Default value |
---|---|---|---|
allow_ptrace | Allow sysadm_t to debug or ptrace applications. | Permit root to use tools such as gdb for debugging. | Off |
allow_execmod | Allow the use of shared libraries with Text Relocation. | Required to use Adobe Flash browser plug-in and Sun Java. | Off |
allow_ftp_anon_write | Permits the FTP server to write to files labeled with type public_content_rw_t, described in Table 8-2. | Off | |
httpd_can_network_connect | Allow httpd scripts and modules to connect to the network. | Enables web scripts to connect to databases and mail servers. | Off |
httpd_enable_homedirs | Allow httpd to read home directories. | Enables the use of ~/public_html for personal web pages. | Off |
httpd_tty_comm | Unify httpd to communicate with the terminal. Needed for handling certificates. | Enables the use of certificates with passphrases (requires the passphrase to be entered on the terminal). | Off |
allow_httpd_anon_write | Permits Apache to write to files labeled with type public_content_rw_t (see Table 8-2). | Off | |
named_write_master_zones | Allow named to overwrite master zone files. | Required for dhcpd updating of zones. | Off |
nfs_export_all_ro | Allow reading on any NFS filesystem. | Enables NFS file sharing (read-only). | Off |
nfs_export_all_rw | Allow read/write/create on any NFS filesystem. | Enables NFS file sharing (read/write). | Off |
use_nfs_home_dirs | Support NFS home directories. | Allows home directories (such as /home/chris) to be imported from an NFS server. | Off |
samba_enable_home_dirs | Allow Samba to share users' home directories. | Allows homes shares in smb.conf. | Off |
use_samba_home_dirs | Allow users to log in with CIFS home directories. | Allows home directories (such as /home/chris) to be imported from a Samba or Windows server. | Off |
allow_samba_anon_write | Permits Samba to write to files labeled with type public_content_rw_t. | Off | |
spamassasin_can_network | Allow Spam Assassin daemon network access. | Enables the use of real-time blackhole lists (RBLs) by Spam Assassin. | Off |
ssh_sysadm_login | Allow SSH logins as sysadm_r:sysadm_t. | Allows root login via SSH (otherwise, you'll need to log in as a regular user and then use su). This may be required if you're running remote backups via SSH. | Off |
subsystem_disable_trans | Disable SELinux protection for subsystem. | Use this as a last alternative. It's better to disable SELinux protection for one subsystem than to turn it off entirely. | Off |
All file types end in _t for easy identification.Files contained in your home directory are usually given the type user_home_t . The default policy will not permit web pages in ~/public_html to be accessed through the web server, even if the httpd_enable_homedirs boolean is turned on, unless the files being shared have the type httpd_sys_content_t . To change file contexts, use the chcon command:
Type | Description | Examples |
---|---|---|
httpd_sys_content_t | Files that may be served by httpd | Web pages, graphics, CSS files, client-side ECMAScript/JavaScript |
httpd_sys_script_exec_t | CGI scripts that may be executed by httpd | Web scripts written in any external scripting language (e.g., scripts written in Perl when you are not using mod_perl) |
httpd_unconfined_script_exec_t | CGI scripts that will not be constrained by SELinux | Dangerous!but may be required for some complex CGI scripts |
httpd_sys_script_ro_t | Datafiles that may be read (but not written) by CGI scripts | Static CGI script datafiles |
httpd_sys_script_ra_t | Datafiles that may be read and appended (but not overwritten or truncated) by CGI scripts | Script logfiles, guestbooks, nonrevisable order queues, survey and quiz records |
httpd_sys_script_rw_t | Datafiles that may be read/written by CGI scripts | User profiles, session status, and other CGI datafiles |
samba_share_t | Enables sharing of the file by Samba (not required for home directories) | Group Samba shares |
public_content_t | Enables sharing of the file (read only) by Samba, httpd, NFS, and rsync | Files shared by multiple servers |
public_content_rw_t | Enables sharing of the file (read/write) by Samba, httpd, FTP, and rsync | Files shared and updatable through multiple servers |
A file label that has been changed manually may be changed back to the default value during a relabeling (discussed in the next section).For example, if you have created the /var/samba directory and are using it for Samba group shares, it will need to be labeled with the type samba_share_t :
The -xdev argument limits the search to a single filesystem.So now we know that httpd (Apache) was unable to access the directory /home/chris/public_html .
Fedora Core 6 includes the first release of the setroubleshoot tool, which provides a desktop notification of AVC denials as well as a GUI program for analyzing AVC messages. To use this tool, install the setroubleshoot package.
SELinux does not override permissions; access to a resource must be permitted by all security mechanismsincluding SELinux, permission modes, ACLs, mount options, and filesystem attributesbefore it will be granted.An SELinux policy defines the rules used to make each access decision. There are three inputs into each decision: the security context of the source subject, and the security context and class of the target object.
If you've added the System Monitor applet to your GNOME panel, clicking on it will start the GNOME System Monitor. You can also start it using the menu entry ApplicationsSystem ToolsSystem Monitor, or by typing the command gnome-system-monitor.Figure 8-7. GNOME System Monitor display showing the security contexts of processes
_t indicates a type, _r indicates a role, and _u indicates a userWhen init attempts to read the configuration file /etc/inittab , the label on that file defines the target security context ( tcontext ):
The last portion of the security.selinux attribute is the sensitivity level, which is used only for multilevel security (MLS) and multicategory security (MCS). The \000 at the end of the attribute indicates an ASCII NUL character, used to delimit the end of the attribute in traditional C style.The target class ( tclass ) associated with the object being accessed is determined by the type of object (and in some cases, how it is being accessed); in this example, where init is attempting to access /etc/inittab , the tclass is file . Therefore the SELinux policy is checked to see if access is permitted for an scontext of system_u:system_r:init_t , a tcontext of system_u:object_r:etc_t , and a tclass of file . To speed access, SELinux rules are cached in an area of memory called the access vector cache which explains why SELinux error messages are labeled avc .
Fedora development is focused on the targeted policy. Changing the policy may lead to a number of unexpected system problems!
If you kept the default volume group and logical volume names during installation, you may see device paths such as /dev/mapper/VolGroup00-LogVol01.The mount options are shown in parentheses; none of these filesystems were mounted with the acl option.
The g::r argument is a short form for group::r.
Don't name this alias getfacl, or you won't be able to copy ACLs between files; tabular output cannot be used as input to setfacl.
Do not attempt to upgrade or remove software packages if you've made any of the files belonging to those packages immutable! Doing so may render your system unusable. Be particularly careful if you are using immutable files on a system that has automatic yum updates enabled.
Be careful selecting the commands to include in the list: if any of the commands permit access to the shell, the user will be able to execute anything!Once this change has been made, the user chris can use sudo to execute the netstat command using the -p option (which requires superuser privilege to operate correctly):
It is reasonable idea to add /sbin and /usr/sbin to everyone's search path, since it makes both sudo and su more useful and provides easy access to the nonprivileged modes of the administration utilities.
Permitting unrestricted access to all commands through sudo is equivalent to giving away the root password. A root user can compromise the system at very basic levels, making it impossible to later secure the system, even if you cut off that user's access.For convenience, you can define groups of users, hosts, or commands and then reference those in entries. This is done by using the User_Alias , Host_Alias , and Cmnd_Alias statements.
It is also possible to use a complex expression as a control flag, but this feature is not used in the default Fedora Core configuration.
In this configuration, the pam_succeed_if.so lines do nothing! (They are used when a network authentication scheme is in effect, though.)These are the account entries, as included into the sshd configuration file from the system-auth file:
The contents of /etc/nologin will be displayed as a message to the user in a dialog box when he attempts to log in using the graphical user interface. In the case of a character-mode login, the file will be displayed but the screen will be cleared immediately, making it nearly impossible to read the message. The SSH daemon will not display the message at all.The pam_unix.so module (in this account mode) performs password maintenance checking, to see if the user should be forced to change her password, warned of imminent expiry, or locked out of the system. Finally, the pam_permit.so module sets up a default action of permit for the account section of the file.
Using the Authentication Configuration tool will undo any customization that you have made in /etc/pam.d/system-auth.Authentication can also be configured from the command line using authconfig .
Before editing any PAM configuration file, make a backup copy. You should also keep a root shell open in a virtual terminal or terminal window in case your changes accidentally lock you out of the system. Test the new configuration thoroughly before closing the root shell!Edit /etc/pam.d/sshd to add pam_time.so in the account section:
Notice that the sequence of the lines is critical; if you place the pam_time.so line after the file system-auth is included, it will be ignored for users with IDs less than 500 (such as root) due to the pam_succeed_if.so line in system-auth.The pam_time.so module restricts access based on the contents of the file /etc/security/time.conf , which is a text file with four semicolon-delimited fields per line. The fields are:
The default /etc/security/time.conf contains extensive notes on the line format.To prevent all users other than root from connecting via SSH during evenings and weekends, place these lines in /etc/security/time.conf :
This will permit the current console owner to execute the configuration tools regardless of where he is executing them. For example, if the user joe is logged in on the console (either graphically or using a character-mode login), then joe can execute configuration tools both at the console and through a remote connection.
This is, obviously, a security risk.
Value | Description |
---|---|
authpriv | Security, authentication, or authorization systems. |
cron | Task scheduler (crond and atd). |
daemon | Server daemons that don't have a category of their own. |
ftp | File-transfer-protocol daemon. |
kern | Kernel messages. |
local0, local1, local2, local3, local4, local5, local6, and local7 | Reserved for custom use on a distribution-by-distribution or site-by-site basis. Fedora uses local7 to log boot messages. |
lpr | Printing system. |
Electronic mail. | |
news | Net news (Usenet). |
syslog | Messages from syslogd itself. |
user | User-level messages. |
uucp | Unix-to-Unix copy messages (rarely used). |
Value | Description |
---|---|
debug | Informational software debugging messages. |
info | General informational messages. |
notice | Important normal messages that do not indicate an error or problem. |
warning | Information about an unusual or impending situation. |
err | Error messages, indicating that something is wrong. |
crit | Critical conditions indicating imminent danger. |
alert | Serious, emergency problems. |
emerg | Emergency situation: the system is in crisis and failing. |
Type of message | Destination |
---|---|
Everything except mail, authentication, and cron messages, with a priority of info or higher | /var/log/messages |
Authentication messages (which may contain private information) | /var/log/secure |
/var/log/maillog | |
Cron | /var/log/cron |
All messages of emerg level or higher | The terminals of all logged-in users |
UUCP and news messages of crit level or higher | /var/log/spooler |
Boot messages | /var/log/boot.log |
/var/log/messages is normally readable only by root. Although making it readable by other users may reveal a small amount of information about your system (reducing security), it can also reduce the amount of time spent in superuser mode (which, in turn, increases security). To make the messages file accessible to everyone:This tail command will display the last 10 lines in the file, and then additional lines within a second of the time that they are appended to the file. It can be left running in a terminal window in the corner of the screen while you perform system administration tasks.
# chmod a+r /var/log/messages
Ensure that your firewall configuration permits connections on UDP port 514.Next, edit the file /etc/syslog.conf on the machines that will be forwarding log messages to the syslog server, and add this line:
It's important to leave local logging turned on in case the syslog server is unavailable, so don't remove the lines that write to the local logfiles.The result will be a combined log containing entries from both the syslog server and the host that is forwarding its log messages:
logrotate also uses per-logfile configuration files in /etc/logrotate.d. These files are installed by various RPM packages that generate logfiles.
You may want to use this script with a lower-volume logfile than /var/log/messages, especially if you pay for each pager message.You can also have log output read to you over the system's speakers:
To filter messages by content, place a grep command between the tail and while lines in the script.
The original syslogd and klogd programs are from the package sysklogd.
A copy of this report is automatically saved in /var/log/aide.log.In this case, AIDE has detected a change in /bin/date and in /root/.lesshst (the history for the less command). The change to date is of particular note because that is a commonly used program, and the new version is configured with the set-user-ID bit set, meaning that any user typing date will execute a program with superuser privileges.
Pathnames | Fingerprint qualities |
---|---|
/boot/bin/sbin/lib/opt/usr /root/etc/exports/etc/fstab/etc/passwd/etc/group/etc/gshadow/etc/shadow | Permissions inode number Number of links UserGroupSize Time of last modification Time of creation or last inode modification Block count MD5 checksum SHA1 checksum |
All other files in /etc (except /etc/mtab, which is not checked) | Permissions inode number UserGroup |
/var/log | Permissions Number of links UserGroup |
These regular expressions are treated as if they have ^ prepended (they match only at the start of filenames). To exactly match one filename, append $:The second field is a list of fingerprint qualities, drawn from the list included in the file as comments, separated with + characters. The values NORMAL and DIR are configured as group definitions, permitting easy reference to commonly used combinations of fingerprint qualities. In this case, NORMAL is defined as R+b+sha1 , meaning the predefined fingerprint-qualities group R , block count, and SHA1 checksums. R in turn means permissions, inode number, number of links, user, group, size, modification time, creation/inode change time, and MD5 checksum.
/var/log/messages$ >
The $ prevents this selection line from matching the logrotate history files (such as /var/log/messages.1).
Consider using a disposable email address for your subscription because this address will be made public and will probably eventually receive some spam. See Lab 7.6, "Configuring the sendmail Server."Receiving messages in digest form reduces the volume of email to one or two large messages a day; the nondigested form will pepper your mailbox with many small messages but will make it is easier to respond to one specific message.
Even though Fedora is used internationally, the Fedora mailing lists are in English, which serves as the lingua franca of the open source community. The exceptions are the lists used by translation projects, which are usually in the target language.Your subscription request will generate an email like this one:
Be sure to review any logfiles, configuration files, or screenshots for confidential information before posting them publicly.When replying to a previous posting in nondigest mode, leave enough of the previous poster's comments as a quotation so that the reader will know what you're replying to. Place your reply at the end of the quoted text:
Don't use your system password for IRC because it could be read by a third party. Create a separate password exclusively for use with IRC.If you're visiting the FreeNode network with a nickname that you have already registered, authenticate to nickserv by typing:
IRC communication has a unique flavor. It's a good idea to lurk on a channel for a little while to get a sense of the discussion tone and key players before jumping into the conversation. Because IRC is immediate, answers to questions may not be as carefully reasoned out as those received through the mailing listsso beware!
Since each log filename contains special characters and spaces, you will need to quote the filename when using it in a command:
$ grep ctyler "FreeNode (formerly OpenProjects.net)-#fedora.log"
In the Bugzilla system, the word bug is used loosely; any issue, patch, enhancement request, or trouble report is called a bug.The Query tab provides a more precise way of searching, as shown in Figure 9-7 . Using that interface, you can narrow your search to a specific package in a particular version of Fedora Core or Fedora Extras. For options that are even more detailed, click on the Advanced tab.
If your query produces no matches, Bugzilla will helpfully inform you that "Zarro boogs" were found.
You may want to use a disposable email address because the address will be made public (see Lab 7.6, "Configuring the sendmail Server," for more on disposable email addresses).Bugzilla will send you an email containing a temporary password:
If the package you want is not in the component list, you may have selected the wrong productfor example, you may have selected Fedora Core for a package that is actually in Fedora Extras. Use the Back button on your browser to return to the product list and try another product.Select a platform and severity (the default is usually correct for both), and then enter a summary (title) for the bug. Choose one that succinctly describes the bug.
It's not uncommon to see the yum update fail due to dependency issues. Usually the issues will be solved by the next Rawhide update, and the yum command will succeed the next day. It's recommended that you run yum manually rather than using the yum daily update service so that you can see the error messages explaining any conflicts.
It's a good idea to periodically reinstall Rawhide from scratch to eliminate the "cruft" that accumulates with frequent unclean updates.
Don't omit the final / on the rsync URI.The i386 directory is the one we're interested in (it looks like you'd have to use a different mirror for other architectures):
There is a high rate of change in the development repository, and from time to time, most or all of the repository will be freshly rebuilt, resulting in very large transfers. If you have a transfer-limited or capped Internet account and run the rawhide-rsync script often, be careful that you don't accidentally exceed your transfer limits.
The rawhide-rsync reports are each over half a megabyte! Consider deleting them after reviewing the end of each report for errors.To verify that the local mirror is accessible through HTTP, connect with a browser. For example, if the host containing the mirror were bluesky , you'd point your browser to http://bluesky/rawhide , on which you would see the Fedora , iso , and image directories.
L10N in the Translation URI stands for localization (translation into specific languages). I18N stands for internationalization (technologies that enable use of software in multiple locales). The numbers in the abbreviations refer to the quantity of letters removed.
Always back up your data before adjusting partitions.Download the 26 MB GParted LiveCD from http://gparted.sourceforge.net/livecd.php and burn it onto a CD or DVD. Insert the disc into the system to be resized, and then start (or restart) the system; the screen shown in Figure 10-1 will appear.
You may need to adjust the BIOS boot options to force the system to boot from the disc.Press Enter. The system will ask you to select your language, as shown in Figure 10-2 , and then to select the keyboard type, as shown in Figure 10-3 .
Do not select 640x480 resolution; the GParted window will not fit on the screen.Figure 10-4. Display resolution selection screen
Back up any important data on your disk drive(s) before installing Fedora Core!
Be sure to read Chapter 6 before reading this lab.
# of disk drives | Possible RAID levels | Recoverable failure | Notes |
---|---|---|---|
1 | Cannot use RAID | None | |
2 | RAID 0 | None | Improves performance but also increases the risk of data loss. It provides storage capacity equal to two drives. |
RAID 1 | 1 drive | Provides storage capacity equal to one drive. This is the only RAID level that can be used for the /boot filesystem. | |
3 | RAID 5 | 1 drive | Provides storage capacity equal to two drives. |
4 or more | RAID 5 with no hot spares | 1 drive | Provides storage capacity equal to the number of drives minus one. |
RAID 5 with hot spare(s) | 1 drive at a time to a sequential maximum failure of 1 + the number of hot spares | Provides storage capacity equal to the number of drives minus the number of hot spares minus one. | |
RAID 6 with no hot spares | 2 drives | Provides storage capacity equal to the number of drives minus two. | |
5 or more | RAID 6 with hot spare(s) | 2 drives at a time to a maximum of 2 + the number of hot spares | Provides storage capacity equal to the number of drives minus the number of hot spares minus two. |
Another way to create a RAID partition is by clicking on the RAID button; the dialog in Figure 10-13 will appear, asking what you want to do next. Select the option "Create a software RAID partition" and click OK.For the File System Type, select "software RAID." Deselect all of the Allowable Drives checkboxes except one to indicate the drive on which you wish to create the partition. Enter the Size in megabytes, and select "Fixed size." Click OK to proceed.
When creating a RAID array, use partitions that are exactly or almost exactly the same size because the size of the smallest element defines the amount of space that will be used in each of the elements; any differences between the size of the smallest element and the sizes of each of the other elements is wasted space.To create a RAID array that will serve as a Physical Volume in an LVM Volume Group, set the File System Type to "Physical volume (LVM)," select the RAID Level, and select the checkboxes of the RAID partitions that will serve as elements of this array. Click OK to create the array.
It usually doesn't make sense to combine RAID and disk partition PVs in the same volume group because you will lose the data protection provided by the RAID array.Once you have created the physical volumes, click the LVM button. The window shown in Figure 10-15 will be displayed.
Reducing the physical extent size increases the size of the LVM data structures but gives a finer granularity for assigning storage to logical volumes. Increasing the physical extent size slightly reduces the LVM overhead, increasing performance.Select the checkbox of all of the physical volumes you wish to use in this volume group.
Mount point | Recommended size | Notes |
---|---|---|
/ | 10 GB | Required |
/home | 10 GB or more, depending on how much data your users will be personally storing | Strongly recommended for any system where users will be logging in on the console or via remote SSH access (e.g., desktop systems, servers with personal user accounts), and systems that are acting as file servers for personal files such as a Samba server (see Lab 7.1, "Configuring Samba to Share Files with Windows Systems"). By separating the users' home directories onto a separate filesystem, you can reinstall the operating system in the future without affecting users' files. |
/var | 2 GB to 1 TB depending on the applications in use | The /var filesystem holds data that is variable but that is not stored in the users' home directories for example, databases, email, web pages, and queued print requests. Creating a separate filesystem segregates it for backup and makes it easier to reinstall the operating system without affecting this data. |
It is best to leave some space within the VG unassigned so that you can use LVM snapshots and so that you can add space to a crowded filesystem without having to unmount another filesystem to reduce its size.Finally, create a swap LV by clicking on the Add button in the Make LVM Volume Group window; when the Make Logical Volume window appears ( Figure 10-16 ), set the File System Type to "swap," and enter the desired swap size. Although traditional wisdom dictates a swap size twice as large as the system memory, it's reasonable to give a system with more memory less swapspace, and a system with less memory more swapspace. If in doubt, use the traditional figure as a starting point, since it can be changed later. The swapspace should be at least as large as the installed RAM (Disk Druid will warn you if it is not).
The directory layout varies slightly among the mirror sites.Once you have obtained the diskboot.img file, transfer it to your USB flash drive using a Linux system. First, insert the drive into the system; you should see an icon appear on the desktop.
This procedure will wipe out everything on your USB flash drive! Back up the drive contents before proceeding.Use the df command to determine the drive's device name:
Since the DVD's filesystem does not support file attributesnecessary to assign an SELinux contextyou will have to disable SELinux enforcement for HTTPD before using it to serve files from a DVD.Alternatively, you can download the files directory to your web server directory. Go to the web page http://fedora.redhat.com/Download/mirrors.html , select an rsync , HTTP, or FTP mirror site for download, and download the entire distribution (all of the files and subdirectories in the os directory for your platform).
The directory layout varies from mirror to mirror. Use a browser to connect to your selected mirror site to confirm the directory names for the following commands.On an existing Fedora Core system, you can do this by first creating a directory that is web-accessible:
Don't miss the . at the end of the line!Ensure that the httpd service is started (see Lab 7.5, "Using the Apache Web Server "), and then start the installation on the target system using your choice of boot media (disc, PXE boot, or USB drive).
Before configuring a PXE Boot Server, confirm that the installation target machines use the PXE protocol for network booting.To configure the PXE server, select the menu option System→Administration→Server Settings→Network Booting Service. The window shown in Figure 10-17 will be displayed.
You can run the DHCP and TFTP servers on different machines if you add a next-server line to the DHCP configuration:Finally, configure the tftp Xinetd service and start the xinetd and dhcpd services (see Lab 7.2, "Configuring a DHCP Server ").
next-server 192.168.1.3;
This configures the next phase of the boot process to use the TFTP server at the IP address 192.168.1.3.
Do not run more than one DHCP server on your LAN. If you have a DHCP server on a router or gateway device, disable it while using the PXE boot server.
If a Kickstartoption line ends with \, it is continued on the next line.If you are using Kickstart to perform an upgrade instead of an installation, use the upgrade option. Otherwise, use these options to lay out the storage:
TCP port 5900 is the port used for VNC.You can now specify what should happen after the installation is complete:
Category | Available package groups |
---|---|
Desktop environments | @gnome-desktop @kde-desktop |
Applications | @authoring-and-publishing @editors @engineering-and-scientific @games @graphical-internet @graphics @office @sound-and-video @text-internet |
Development | @development-libs @development-tools @eclipse @gnome-software-development @java-development @kde-software-development @legacy-software-development @ruby @x-software-development |
Servers | @dns-server @ftp-server @legacy-network-server @mail-server @mysql @network-server @news-server @printing @server-cfg @smb-server@ sql-server @web-server |
Base system | @admin-tools @base @base-x @dialup @dns-server @java @legacy-software-support @system-tools |
Languages | @arabic-support @assamese-support @bengali-support @bulgarian-support @chinese-support @croatian-support @czech-support @estonian-support @gujarati-support @hebrew-support @hindi-support @hungarian-support @japanese-support @korean-support @polish-support @punjabi-support @romanian-support @russian-support @serbian-support @slovak-support @slovenian-support @tamil-support @thai-support @ukrainian-support |
Preinstallation scripts cannot change the installation source.
Post-installation scripts cannot reliably use hostnames; any IP addresses must be specified numerically.
GRUB numbers partitions starting at 0, while Linux numbers them starting at 1.The remainder of this file configures the two menu options. The first one consists of these four lines:
When converting an existing image to 14 colors, the result may look better if you select the No Dithering option, especially if the original image contains large areas of solid color. If you are creating a new image, select the indexed mode before you start drawing.Save the image in the /boot/grub directory, using the file extension .xpm.gz .
Installing a new kernel RPM will add an additional boot option and make it the default. If you are using yum to perform updating, a maximum of two versions of the kernel will be installed at once (configurable in /etc/yum/pluginconf.d/installonlyn.conf), so old kernel versions and their corresponding GRUB entries may be removed from the menu by yum when updating.
grub-install uses Linux disk names, such as /dev/hdc, instead of Grub disk names such as (hd2).
Type the entire growisofs command on one continuous line.To create a bootable floppy instead of a DVD:
It's worthwhile keeping a GRUB DVD or floppy with your system manuals just in case you ever find that you can't boot your system due to bootloader problems.Boot your system with this disc or floppy. A GRUB command prompt will appear, as shown in Figure 10-23 .
Note that the setup command was given the drive (hd0) instead of the partition (hd0,0) to install the boot record at the start of the drive instead of the start of the boot partition.You can now remove the GRUB disc/floppy and boot directly from the hard drive.
If you have a bootloader password configured, you will be prompted for it at this point.Figure 10-24. Selecting a menu-entry line to edit
When you issue the chroot command, you will no longer be accessing the software on the installation disc. Therefore, if the commands installed on the hard disk filesystems are corrupted or damaged, you will be using the corrupted or damaged versions. Likewise, if the software on your hard disk is newer than the software on the installation disc, you will be using the newer versions.Press Ctrl-D (for done) to exit from the chroot shell and return to the normal rescue shell.
Type this command on one line.
To make your system boot the Xen kernel by default, edit /boot/grub/grub.conf (see Lab 10.5, "Configuring the GRUB Bootloader")You can confirm that you are running the Xen kernel by using the uname command:
The setenforce command just shown disables SELinux protection for your system, which presents a security risk. Re-enable SELinux as soon as you are finished using the network installation server:To start the guest domain installation:
# setenforce 1
This message indicates that the installer was unable to start X. This is normal, since the guest domain does not have a video card.Choose one of the two options:
To start a guest domain and connect to its console immediately, use xm create with the -c (console) option:After the first boot, you may find it just as easy to use SSH to connect to the guest domain as though it were a remote server:
# xm create -c fedora
Ñïàñèáî, ÷òî ñêà÷àëè êíèãó â áåñïëàòíîé ýëåêòðîííîé áèáëèîòåêå BooksCafe.Net
Îñòàâèòü îòçûâ î êíèãå
Âñå êíèãè àâòîðà