Well my Home Theater PC is just about finished… I just installed samba, enabled openSSH via my SSH key, along with my other goodies. Just doing the final tweaks to smooth out video playback via xorg.conf hopefully all the settings will carry over perfectly as this the same exact GPU and such.
But my Nvidia driver is 361 instead of 358 which I was using when on 14.04.
I am just hoping I don’t have to recompile a kernel just for the “Intel Core 2 or Newer” CPU’s along with modifying the system timer from 250Hz to at least 300Hz to have a number more evenly divisible into 30FPS to equal US NTSC video vs European PAL at 25FPS, if that is the case I will bump it to a 1000Hz timer for faster responsiveness as it’s a desktop, as well as being divisible into 30 and 25 in case I take it over seas. If I have to recompile for the Home Theater I am merely going to recompile from the Ubuntu sources rather than directly from kernel.org. My laptop will be getting a custom kernel from kernel.org though as it doesn’t have the proprietary GPU for smoother video playback
I opted for fresh reinstalls for my laptop and HTPC as I ran into issues with the upgrade and then merely reinstalled all my applications and such through my scripts, as I always keep my /home on a separate partition just in case I have to reinstall things.
I am working on upgrading my servers from 14.04LTS to 16.04LTS as well by Q2 of 2017 after lots of testing. Some servers will probably be rebuilt from scratch. However I am in no rush as we all have until 2019 for the end of life of Ubuntu 14.04 LTS to end.
I recently wrote a nice little program to setup and maintain your firewall on Ubuntu GNU/Linux 14.04. This will install a cron job to run daily and pull lists from multiple sites to block malicious IP addresses. Adding around ~40,000 or more individual IP addresses as well as the top 20 malicious IP blocks per day, all voluntarily and freely contributed. All of the malicious individual addresses are managed with ipset, while the IP blocks are managed with IPTables. This leads to a very efficient way of managing the tables easily and automatically. This optionally allows you to enable or disable Tor Exit node connections. I have also created an optional weekly cron job that will block whatever countries you may wish. I hand typed all 233 countries codes into a dialog menu. I added a new iptables-persistent from another Github repository which also works with ipsets to keep it persistent upon reboot for both iptables.
It’s simple enough to install. Simply run the script as root and select if you want to block Tor exit nodes or if you want to block any countries. If there are any issues or suggestions please let me know on GitHub. I want to eventually make this also capable of running on CentOS for my PhonePBX.
When making my other servers I was double checking fail2ban configurations and noticed there is no fail2ban settings for nginx seeing as the webmail runs on it. Not sure if it’s an issue, or anything but I was hoping some other could tell me if I am on the right track, or if it’s not even necessary.
I did this for my email server which runs nginx as the web server.
“Freedom” is the very word at the core of libertarianism: the ability for us to be able to do anything we believe in freely, so long as it does not infringe on the freedoms of another individual. When you think of freedom, what comes to your mind? Speech, religion, assembly, press, property, perhaps the right to bear arms, perhaps the ability for us to do whatever we please to our own bodies, and we can go on from there. So why do many not consider freedom to mean the ability to own our software in our own computers like we view our bodies or our vehicles? This is where Free, Libre, and Open Source Software (FLOSS aka Free or Libre) comes in. What exactly does Free and Open Source mean? Free and Open source software is software whose source code is available for modification or enhancement by anyone. But let us always remember, Free software came before Open Source.
“Source code” is the part of software that most computer users don’t ever see; it’s the code which computer programmers can manipulate to change how a piece of software—a “program” or “application”—works. Programmers who have access to a computer program’s source code can improve that program by adding features to it, or fixing parts that don’t always work correctly.
The problems with Windows and Apple are that you can’t really trust them all that much in terms of privacy. They both have backdoors for the government. Now, while the government may have good intentions according to some, they are severely flawed. The problems with a backdoor in a system that I can’t close as a user, means that malicious hackers have another exploit to get into your system with and potentially monitor or steal information from you. Allowing software to be Free means that it is transparent and vetted by thousands of people all around the world, who are constantly working on the software.
Take for example Mozilla Firefox, formerly Netscape Navigator. It’s not maintained by some giant company like Google, Apple, or Microsoft that make their browsers and have parts that are completely closed. Firefox, being Free, is maintained by a large community who make one of the freest browsers, with a non-profit foundationmaintaining all the thousands of additions to code that go on every day. We can ensure there are no intentional backdoors in the code, while making it as customizable as we want. In fact the GNU/Linux (often just called “Linux”) back door attempt of 2003some suspected of being done by the NSA, is proof of that very fact that Free software is more secure.
“Free software” means software that respects users’ freedom and community. Roughly, it means that the users have the freedom to run, copy, distribute, study, change and improve the software. Thus, “free software” is a matter of liberty, not price. To understand the concept, you should think of “free” as in “free speech,” not as in “free beer”. We sometimes call it “libre software” to show we do not mean it is gratis.
Richard Stallman, founder of the Free Software Movement, said Windows and OS X are malware, even stated the observation Amazon’s Kindle has an Orwellian back door, and has said that only an idiot would trust the Internet of Things.
“Malware is the name for a program designed to mistreat its users,” Stallman wrote in The Guardian.
What kinds of programs constitute malware? Operating systems, first of all. Windows snoops on users, shackles users and, on mobiles, censors apps; it also has a universal backdoor that allows Microsoft to remotely impose software changes. Microsoft sabotages Windows users by showing security holes to the NSA before fixing them.
Apple systems are malware too: MacOS [OS X] snoops and shackles; iOS snoops, shackles, censors apps and has a backdoor. Even Android contains malware in a non-free component: a backdoor for remote forcible installation or de-installation of any app.
Now I know a lot of libertarians and conservatives would rather place their trust in businesses managing things. But this is where voluntarism come in, because no one is forcing you to contribute to the code. Far more people are using the software without contributing the software, but if you see a problem or feature that can be added you are more than welcome to do so. This is best explained in Eric Raymond’s “Cathedral and the Bazaar”, of why the FLOSS model of a bazaar with the community voluntarily working together is better than the cathedral approach of Apple or Microsoft. It’s also one of the most influential essays ever written in the IT world.
Linux overturned much of what I thought I knew. I had been preaching the Unix gospel of small tools, rapid prototyping and evolutionary programming for years. But I also believed there was a certain critical complexity above which a more centralized, a priori approach was required. I believed that the most important software (operating systems and really large tools like the Emacs programming editor) needed to be built like cathedrals, carefully crafted by individual wizards or small bands of mages working in splendid isolation, with no beta to be released before its time.
Linus Torvalds’s style of development—release early and often, delegate everything you can, be open to the point of promiscuity—came as a surprise. No quiet, reverent cathedral-building here—rather, the Linux community seemed to resemble a great babbling bazaar of differing agendas and approaches (aptly symbolized by the Linux archive sites, who’d take submissions from anyone) out of which a coherent and stable system could seemingly emerge only by a succession of miracles.
I have mentioned LibreOffice and Mozilla Firefox as FLOSS software, but there are thousands of distributions of GNU/Linux to use, and thousands of Free, Libre, and Open Source Software out there. It’s all about freedom of choice. If you don’t like one part of the system or program you can change it. For example I used to be a Gentoo GNU/Linux user where I can completely build my own system the way I wanted, then I became a bit lazy and switched to Ubuntu a few years ago as I didn’t want to have to spend so much time on each installation. I, of course, still didn’t like Ubuntu on a few parts, so I modified a lot of the operating system, until eventually Ubuntu decided to add the Unity User Interface, which I hated with a passion. So I switched to Xubuntu as a day to day work OS, withKali GNU/Linux on the same laptop for all my tools to penetrate network security as part of my job. One GNU/Linux in particular a lot of people who love their privacy like is Tails, which leaves no trace of you on the host computer, and encrypts as well as anonymizes all of your data. The Condor intraoral scanner, which I previously covered inMarch of 2015, is running Manjaro GNU/Linux. I also have been looking into Trisquel GNU/Linux which is a completely Free version of GNU/Linux, which Richard Stallman himself uses. There are parts in a quite a few distributions of GNU/Linux that use “non-free” software meaning its use, redistribution or modification is prohibited, or requires you to ask for permission, or is restricted so much that you effectively can’t do it freely. There are a few classes of types of software which the Free Software Foundation does a good job of explaining to the average user.
But back to the main point. The beauty of GNU/Linux and FLOSS in general is freedom, as what works for some, doesn’t work for all. Linus Torvalds, the maker of the GNU/Linux kernel, himself didn’t like Ubuntu, whereas I kind of like the Ubuntu environment.
So at the end of it all, those who call themselves true libertarians, conservatives, or even just a full out privacy rights advocate should be throwing their closed source software away whenever possible, and embrace the true freedom only granted by software to the user which is FOSS or even better, FLOSS. It’s time to really embrace freedom to its fullest extent in all facets of your life. You can even start slowly dipping your toes in the water of the open source movement. I use Mozilla Thunderbird instead of Microsoft Outlook, Mozilla Firefox or even better GNU IceCatinstead of Microsoft Edge or Internet Explorer, Notepad++ (NotepadQQ in GNU/Linux) instead of Notepad,LibreOffice instead of Microsoft Office, GNUCash instead of Quickbooks, ProjectLibre instead of Microsoft Project,7-zip instead of WinZIP and WinRAR, Dia instead of Microsoft Visio, Scribus instead of Microsoft Publisher, and etc. You can find a FOSS or FLOSS solution for almost any task that you need to do today.
If any readers are interested in a deep look into the philosophy, culture, and history of the entire Free, Libre, and Open Source Movements, I highly recommend watching the documentary Revolution OS (About 1 1/2 hours) which is freely available on YouTube ( https://youtu.be/jw8K460vx1c) and elsewhere.
Update: After Speaking to Richard Stallman some changes were made
So I have been building servers for quite sometime, and if you have been operating servers for a while, you know of attempted intrusions into your server. I have been using Fail2Ban and UFW for quite some time on my Ubuntu servers and they work rather well. I would have them automate the job of managing IPTables, which can be rather cumbersome. Especially with IT people whose specialty may not be firewalls. So I have been looking around for a way to automate my job. My favorite tools thus far include
Fail2Ban – scans log files (e.g. /var/log/apache/error_log) and bans IPs that show the malicious signs — too many password failures, seeking for exploits, etc. Generally Fail2Ban is then used to update firewall rules to reject the IP addresses for a specified amount of time, although any arbitrary other action(e.g. sending an email) could also be configured. Out of the box Fail2Ban comes with filters for various services (apache, courier, ssh, etc).
UFW – Uncomplicated Firewall, The default firewall configuration tool for Ubuntu is ufw. Developed to ease iptables firewall configuration, ufw provides a user friendly way to create an IPv4 or IPv6 host-based firewall. By default UFW is disabled. Gufw is a GUI that is available as a frontend.
Blocklist.de – www.blocklist.de is a free and voluntary service provided by a Fraud/Abuse-specialist, whose servers are often attacked on SSH-, Mail-Login-, FTP-, Webserver- and other services.
The mission is to report all attacks to the abuse deparments of the infected PCs/servers to ensure that the responsible provider can inform the customer about the infection and disable them.
It’s rather easy to set up these update the IPTables with a simple crontab daily, which will sync with blocklist.de
First become root
Then download the script to cron.daily and make it executable
curl -s https://gist.githubusercontent.com/klepsydra/ecf975984b32b1c8291a/raw > /etc/cron.daily/sync-fail2ban
chmod a+x /etc/cron.daily/sync-fail2ban
Optional but Recommended, Initial run manually:
Tomorrow, check your /tmp/iptables.fail2ban.log file to see who’s been blocked.
The lists you get are stored locally for now at /etc/fail2ban/blacklist.*
Your server should now be a little bit more secure with a few thousand new IP addresses added to your IPTables
So I ran into an issue with my Mozilla Thunderbird today when I was finished setting up my new email, contact, and calendar server with Mail-in-a-box. So I go to add the lightning extension for calendars, and low and behold I find out my Thunderbird (the one that came in the the default Xubuntu repos for 14.04LTS) was out of date and not supported by lightning. The Ubuntu repos had version 38.8, but what version was Mozilla at themselves? 45.1 as of this post. So I quickly installed the latest binary but I tend to be forgetful about updates, so I wanted to tie it into the apt package manager so I found a PPA that works.
First if thunderbird is installed remove it, and maybe backup your .thunderbird folder just in case. But you shouldn’t have to worry about losing any data.
sudo apt-get remove -y thunderbird
Next we need to add a new repository called Ubuntuzilla so edit your sources.list. I used nano for this, but feel free to use whatever you like.
sudo nano /etc/apt/sources.list
add to the end deb http://downloads.sourceforge.net/project/ubuntuzilla/mozilla/apt all main
or you can do that all with one command echo -e "\ndeb http://downloads.sourceforge.net/project/ubuntuzilla/mozilla/apt all main" | sudo tee -a /etc/apt/sources.list > /dev/null
Then grab the keys and update sudo apt-key adv --recv-keys --keyserver keyserver.ubuntu.com C1289A29
sudo apt-get update
Install your desired package, with one of the following commands: sudo apt-get install firefox-mozilla-build
sudo apt-get install thunderbird-mozilla-build
sudo apt-get install seamonkey-mozilla-build
So I have been building a lot of servers and generally I like to segment them to different domains but whois by default only will work with *.com, *.info, *.net you know the usual TLD’s you think of. But now there are so many new ones I like to scoop up I still want to test my server settings with whois. Well have no fear on my Xubuntu 14.04LTS I use everyday simply create the file “whois.conf” in the /etc/ folder. So use your favorite text editor and paste this file in to get any new TLD resolved.
Open Nano (or whatever text editor you prefer) sudo nano /etc/whois.conf
Once inside your text editor paste this list (list is very long so I added a read more section you will need to open to see the entire list)
# WHOIS servers for new TLDs (http://www.iana.org/domains/root/db)
# Current as of 2015-09-12
We all know when it comes to security, a secure password is always the most important thing. However remembering a complex password is always the toughest part anywhere. Especially when it comes to being a system administrator, our passwords are usually the most vital of anyone in the company. When it comes to telling people they need complex passwords, what always comes to mind is this xkcd comic about passwords.
As the bottom text suggests we have come to the point where it’s hard for us to remember passwords, but easy for computers to guess. So what’s the solution? Well what I do as a GNU/Linux person is use the command already built in to generate super secure passwords using the sha1sum, sha224sum, sha256sum, sha384sum, and sha512sum commands.
First off pick a random word or phrase. Now remember capitalization, spaces, and such will always effect the sum spit out. let’s start with sha1sum which is the shortest, and using the word “password” as our example throughout this tutorial
While setting up an OwnCloud server for my company, I couldn’t really find any good way to cache, and with the Ubuntu repos having an old version of Redis, meant of course it couldn’t be used for best performance and stability. I tried installing it manually from some guides I found, and trying to see OwnCloud’s documentation and was last using an Apcu and Redis (older version) combined so I stumbled upon a guide from TechandMe.se which actually resolved my issues of an old Redis, and dramatically sped up my server.
This guide is also scripted for an automated install, you can download the script here.
I was building my OwnCloud file storage on Ubuntu 14.04LTS (upgrading to 16.04.1 LTS this summer), which if you haven’t heard of definitely check out it is the most amazing cloud storage program and you control it yourself. It even offers server side encryption, and tons of options to make it how you want it for you or your company. See it at www.owncloud.org
But I was coming across an .htaccess issue that kept popping up so I modified Apache so much and it still appeared. So I finally stumbled across my fix. Move the OwnCloud data directory out of the default location. So here are the steps I took