FIX: ALT+PrtScn Not Working

In the latest version(s) of Ubuntu there is a stupid bug where ALT+PrtScn no long works

The fix is simple, in a console enter the following code;

sudo sysctl -w kernel.sysrq=0

This will disable the "SysRq" key, which apparently is interfering with Alt+PrtScn.

Just another reason to switch over to vanilla Debian

Intellinet 150n USB WiFi key

I had some trouble getting my new "Intellinet 150n Wireless LAN Adapter" working in Ubuntu 10.04 (Lucid)

The problem is that one of the other Realtek drivers (rt2800usb) conflicts with the driver we need (rt2870sta)

To fix it you need to stop the rt2800usb driver from loading by blacklisting it.

sudo vi /etc/modprobe.d/blacklist.conf

Add this line;

blacklist rt2800usb

Reboot and you should be up and running.

HOWTO: Setting up a vpn using ssh and pppd

For this we need two systems, one is designated as the server, the other the client. The server needs to have a static IP address or dynamic dns name from a free service such as https://www.dyndns.com/. Also, ensure that all firewalls are turned off or port 22 forwarding is enabled for both hosts.

Configuring the SSH accounts;

On the "server" machine;

Firstly, if you have not already installed ssh server do so now.
sudo apt-get install openssh-server

I use port 443 for VPN connections because this is usually the easiest port to get through a firewall that you don't control.

Edit your ssh server config;

sudo vi /etc/ssh/sshd_config

Change the line;

Port 22

to

Port 443

and restart your SSH server;

sudo /etc/init.d/ssh restart

Now, we create a user called "vpn";

sudo adduser --system --group vpn

The --system parameter sets vpn's shell to /bin/false but because the vpn user needs to log in via ssh, we must change this to /bin/bash in the /etc/passwd file.

sudo vi /etc/passwd

Here is an example;

vpn:x:110:110::/home/vpn:/bin/bash

The account password will only be used during this howto. You can choose a complex (secure) one now or a simpler temporary one and change it later.

Creating a password;

sudo passwd vpn

You should be able to login to the account from the client now;

ssh vpn@hostname

The next step is to create a ssh keypair for the root user on the client machine and place that public key in the vpn users authorized_keys file. Use this guide to configure passwordless ssh but remember to use the vpn user on the server instead of the root user as is shown in that guide.

Once you have passwordless SSH properly configured between root@client and vpn@server you should change the password to a more secure (random) one if you haven't already done so it will no longer be needed.

Time to set up the actual VPN.

Configuring the VPN;

The pppd daemon we will use needs to run as root, but we don't want to give our vpn user complete access to the system. To do that we configure sudo to give minimal access rights.

On the Server, open the visudo editor

visudo

Add these three lines to the end of the file

vpn ALL=NOPASSWD: /usr/sbin/pppd
vpn ALL=NOPASSWD: /sbin/iptables
vpn ALL=NOPASSWD: /sbin/route


This allows our vpn user to execute the pppd command to start the vpn and use the "route" command to set the return routes (if required).
If you are setting up a router<->router connection you will need to set the appropriate return routes to the client on the server.

To do this, create a script in the vpn user directory on the server.

vi /home/vpn/returnroutes.sh

Place the appropriate route commands to the subnet(s) at the clients end. If you don't want return routes then just don't enter any route commands. Here is mine;

#!/bin/sh
sudo route add -net 10.48.0.0/16 gw 192.168.0.1
sudo route add -net 10.0.0.0/16 gw 192.168.0.1


This script must be executable

chmod +x /home/vpn/returnroutes.sh

and owned by the vpn user

chown vpn:vpn /home/vpn/returnroutes.sh

We can also check that the pppd permissions are set up properly by logging in as the vpn user and issuing this command;

sudo /usr/sbin/pppd noauth

You should see a bunch of hieroglyphics such as this.

~�}#�!}!}!} }4}"}&} } } } }%}&����}'}"}(}"��~

You can kill the process from another terminal or just wait 30 secs or so for it to finish on its own.

Now we can configure the client (logged in as root)
Firstly, we need to use a script to connect to the server. You can locate the script anywhere you like, I put it in /usr/local/bin

You can download a copy of the connect script or simply
copy and paste this text into a file


#!/bin/sh
# SCRIPT: vpn-connect version 2.2
# LOCATION: /usr/local/bin/vpn-connect
# DESCRIPTION: This script initiates a ppp-ssh vpn connection.
# see the VPN PPP-SSH HOWTO on http://www.linuxdoc.org
# for more information.
# NOTES: This script uses port 443 so your VPN server should be
# configured to listen for ssh on Port 443
#
# revision history:
# 1.6 11-Nov-1996 miquels@cistron.nl
# 1.7 20-Dec-1999 bart@jukie.net
# 2.0 16-May-2001 bronson@trestle.com
# 2.2 27-Sep-2009 brettg@tuxnetworks.com
#
# You will need to change these variables...
#
# The host name or IP address of the SSH server that we are
# sending the connection request to:
SERVER_HOSTNAME=tuxnetworks.homelinux.net

# The username on the VPN server that will run the tunnel.
# For security reasons, this should NOT be root. (Any user
# that can use PPP can intitiate the connection on the client)
SERVER_USERNAME=vpn

# The VPN network interface on the server should use this address:
SERVER_IFIPADDR=192.168.3.2

# ...and on the client, this address:
CLIENT_IFIPADDR=192.168.3.1

# This tells ssh to use unprivileged high ports, even though it's
# running as root. This way, you don't have to punch custom holes
# through your firewall.
LOCAL_SSH_OPTS="-P"

PATH=/usr/local/sbin:/sbin:/bin:/usr/sbin:/usr/bin:/usr/bin/X11/:

## required commands...

PPPD=/usr/sbin/pppd
SSH=/usr/bin/ssh
RETURNROUTES=/home/vpn/zenroutes.sh

if ! test -f $PPPD ; then echo "can't find $PPPD"; exit 3; fi
if ! test -f $SSH ; then echo "can't find $SSH"; exit 4; fi

case "$1" in
start)
# echo -n "Starting vpn to $SERVER_HOSTNAME: "
${PPPD} updetach noauth passive pty "${SSH} -p 443 ${LOCAL_SSH_OPTS} ${SERVER_HOSTNAME} -l${SERVER_USERNAME} -o Batchmode=yes sudo ${PPPD} nodetach notty noauth" ipparam vpn ${CLIENT_IFIPADDR}:${SERVER_IFIPADDR}
${SSH} -p 443 ${SERVER_HOSTNAME} -l ${SERVER_USERNAME} ${RETURNROUTES}
route add -net 10.1.0.0 netmask 255.255.0.0 gw $SERVER_IFIPADDR
# route add -net 10.2.0.0 netmask 255.255.0.0 gw $SERVER_IFIPADDR
# route add -net 192.0.0.0/8 gw $SERVER_IFIPADDR
;;

stop)
# echo -n "Stopping vpn to $SERVER_HOSTNAME: "
PID=`ps ax | grep "${SSH} -p 443 ${LOCAL_SSH_OPTS} ${SERVER_HOSTNAME} -l${SERVER_USERNAME} -o" | grep -v ' passive ' | grep -v 'grep ' | awk '{print $1}'`
if [ "${PID}" != "" ]; then
kill $PID
echo "disconnected."
else
echo "Failed to find PID for the connection"
fi
;;

config)
echo "SERVER_HOSTNAME=$SERVER_HOSTNAME"
echo "SERVER_USERNAME=$SERVER_USERNAME"
echo "SERVER_IFIPADDR=$SERVER_IFIPADDR"
echo "CLIENT_IFIPADDR=$CLIENT_IFIPADDR"
;;

*)
echo "Usage: vpn {start|stop|config}"
exit 1
;;
esac
exit 0


You need to change the SERVER_HOSTNAME variable in the above script. You may also need to change SERVER_IFIPADDR and CLIENT_IFIPADDR depending on your existing network landscape.

Now we need to make the script executable

chmod +x /usr/local/bin/vpn-client

To start the vpn, at the client type

/usr/local/sbin/vpn-client start

You can check if it is up using the "ifconfig" command

ifconfig ppp0

Note: if you already have a ppp connection, such as to your ISP, then you may need to do "ifconfig ppp1". To see all your current ppp connections enter

ifconfig | grep ppp

If you want the vpn connection to be permanently up you can create a script to check the status and restart it if required.

vi /usr/local/sbin/vpn-check

Code;

#!/bin/sh
EMAIL=brettg@tuxnetworks.com
DAEMON=pppd

if [ "$(/bin/pidof $DAEMON)" = "" ]; then
/usr/local/sbin/vpn-client start
wait
if ! [ "$(/bin/pidof $DAEMON)" = "" ]; then
echo "VPN restarted $(date +%m-%d-%Y)"
fi
fi


Now, add an entry to the system crontab to run the script every minute

vi /etc/crontab

Add this line

* * * * * root /usr/local/sbin/vpn-check

Cron will automatically restart so we don't need to do that.

Now, assuming all has gone well if you issue the command

/usr/local/sbin/vpn-client stop

and wait for about a minute the vpn client should automatically reconnect!

Source:
http://www.faqs.org/docs/Linux-mini/ppp-ssh.html#AEN237

HOWTO: Passwordless SSH using a public key

If you find yourself logging in to machines regularly or you want to include ssh commands in a script, for example using rsync to backup then you don't want to have to enter a password every time. In such cases you can use a public key.

The first thing we need to do is create a ssh key pair on the client host. Make sure that you login as the user who will be connecting to the server. In this case I am using the root user.

Warning: If your user already has a key pair then you should skip this step otherwise you may overwrite your existing key and potentially cause problems for other services that may already rely on them.

First, we should check whether there is already a keypair for our user;

ls -al ~/.ssh/
known_hosts

If there are files id_rsa and id_rsa.pub (or similar) listed then you already have a keypair and you should skip this step.

Creating an ssh key pair (press [enter] for each question asked);

ssh-keygen

Note: It is important that you don't enter a passphrase when asked to! If you did just run the command again, it will overwrite the key you just created.

You can check your new keys by looking in the .ssh folder

root@client:~# ls .ssh/
id_rsa id_rsa.pub known_hosts

The one we are interested in here is the public key which ends with .pub. We need to copy this file to /root on the server.

Note: You can do this via scp or copy it onto a thumbdrive or even type it in from a printout if you like! I will leave it up to you to decide the best method in your situation.

On the server, we will need to login as the root user;

Now, we should have the public key file that we copied earlier in our root directory. Let's double check that;

root@server:~# ls -al *.pub
-rw-r--r-- 1 root root 392 2010-08-02 08:22 id_rsa.pub

Great, it is there! We need to add this key to the root users authorized_keys file;

cat id_rsa.pub >> .ssh/authorized_keys

We can test that this worked by going back to our client PC and logging into the server via ssh;

root@client:~# ssh root@server
Linux server 2.6.32-25-generic-pae #44-Ubuntu SMP Fri Sep 17 21:57:48 UTC 2010 i686 GNU/Linux
Ubuntu 10.04.1 LTS

Welcome to Ubuntu!
* Documentation: https://help.ubuntu.com/
Last login: Thu Oct 14 15:38:57 2010 from client
root@server:~#

If it didn't ask you to enter a password then you are cooking with gas!

HOWTO: Using apt-cacher-ng to cache packages

If you have a lot of machines to manage, you don't want them all reaching out to the internet to retrieve updates and using up your precious bandwidth. What you want is a local machine that can keep copies of all the files that your machines download from the repositories so that the next machine that asks for the same file can just be given the copy that has already been downloaded. You could of course use squid, but squid is a less than perfect solution as it is not designed to ensure files are kept on hand until they are no longer needed.

apt-cacher-ng is a purpose built application that keeps track of all the packages that have been downloaded. If a client requests some-package.v123.deb it checks to see if it is already cached locally and if so it provides it to the client.

If the package has not previously been requested, it then downloads the package, provides it to the client, adds it to the cache and, here is the important part, deletes all older, outdated versions of that file!

It will keep cached files indefinitely, unlike squid which is designed to flush files if they remain unrequested for a predefined period.

So, to use apt-cacher-ng, your /etc/apt/sources file doesn't need to be modified or configured in any special way. Just leave it configured as you would normally (in my case these are the official aus repos with the source repos removed);

Example;

deb http://au.archive.ubuntu.com/ubuntu lucid main restricted
deb http://au.archive.ubuntu.com/ubuntu lucid-updates main restricted
deb http://au.archive.ubuntu.com/ubuntu lucid-backports main restricted
deb http://au.archive.ubuntu.com/ubuntu lucid-backports universe multiverse
deb http://au.archive.ubuntu.com/ubuntu lucid universe multiverse
deb http://au.archive.ubuntu.com/ubuntu lucid-updates universe multiverse
deb http://au.archive.ubuntu.com/ubuntu lucid-security main restricted
deb http://au.archive.ubuntu.com/ubuntu lucid-security universe multiverse


To install apt-cacher-ng, simply do;

sudo apt-get install apt-cacher-ng

And that is it, there is no further configuration needed!

For each client however, you do need to make a few small changes;

Create (or edit) the file /etc/apt/apt.conf and add the following line (substituting the IP address for the address of your server of course!)

Acquire::http { Proxy "http:10.1.1.1:3142"; };

If you use Synaptic, you also need to modify another file;

sudo vi /root/.synaptic/synaptic.conf

Add the following lines to the end but before the final brace (ie before the " }; ')

useProxy "1";
httpProxy "10.1.1.1";
httpProxyPort "3142";
ftpProxy "10.1.1.1";
ftpProxyPort "3142";
noProxy "";

For the changes to be applied you need to do an apt-get update;

sudo apt-get update

If this completes without error you are done! It is that easy.

HOWTO: Mounting SSH directories

If you want to mount a directory on a remote PC then here is what you do.

Of course, to mount a folder via ssh the server must be running as a ssh server.

sudo apt-get install openssh-server

It is not necessary, but I strongly recommend that you set up passwordless ssh logins between the server and the client. The linked guide describes setting up SSH keys between two root users, so you do need to ensure that you configure things correctly for whatever pair of users you intend to use here.

From here on, all of the configuration we need to do is on the client.

1. Install SSHFS;

sudo apt-get install sshfs

2. Use the modprobe command to load fuse into the kernel;

sudo modprobe fuse

3. Set up the appropriate users & permissions;

sudo adduser username fuse
sudo chown root:fuse /dev/fuse
sudo chmod +x /bin/fusermount

If you've added yourself to the fuse user group, you need to logout and back in at this point.

To mount the home directory of "user";

sshfs user@host: mountpoint

Eg.

sshfs brett@server: ~/server_home

You can add a path after the colon.

Eg. to mount the "share" directory on the server (ie. /home/brett/share)

sshfs brett@server:/share ~/share

UPDATED: By default, only the user who has mounted the share has access to it. To allow access to root add the following option;

-o allow_root

For all users;

-o allow_other

To mount the share as read only;

-o ro

Eg. to mount the "share" directory on the server as read only and available to all users;

sshfs -o allow_other -o ro brett@server:/share ~/share

And that is all you need to do! Easy Peasy!