I had to figure out a few things to get Ubuntu installed and working well on VirtualBox.

I had to enable virtualization technologies in my BIOS. I have a Lenovo T520 and did this by pressing F1 during startup and then going to Security > Virtualization. If I did not do this then I would receive the error “VT-x features locked or unavailable in MSR” when trying to run with more than 1 CPU or 3584 MB of RAM.

Also, I had to run “sudo apt-get install dkms” to get the VirtualBox Guest Additions to work well.

Finally, I remapped the host key. By default all kinds of weird things happen when you use the right Ctrl button. This can be fixed by going to File > Preferences… > Input and then setting Host Key to something you never use like Pause.

The Linux sed command is a stream editor.  What that means is basically that you can do a regex operation on each line of a file or a piped stream.  I always have a bit of trouble remembering how to use it since its regex implementation is a bit different than the ones I’m used to.  I’ll post more examples as I encounter them in my work.

Sed regex reminders:

• You need a backslash before parens in a regex grouping
• You refer to matched regex groups using \1, \2, etc.
• The + regex operator does not work
• Non-greedy quantifiers don’t work.  For example, .*? will not work
• The output is printed to standard out by default.  You need the -i option if you want to edit a file with sed.

Remove all but the first column in a .tsv stream
sed ‘s/\([^\t]*\).*/\1/’

Edit a .tsv file by removing all but the first column
sed -i ‘s/\([^\t]*\).*/\1/’

Remove the first line of a stream
sed ’1d’

Strip trailing whitespace from a file
sed -i -e ‘s/ *$//’

Replace @inheritDoc with @override after marking for edit
grep @inheritDoc -l -r java/com/benmccann | xargs p4 edit
grep @inheritDoc -l -r java/com/benmccann | xargs sed -i ‘s/\(.*\)@inheritDoc/\1@override/’

Replace @inheritDoc with @override in JS files after marking for edit
find java/com/benmccann -name ‘*.js’ -print0 | xargs -0 grep -l @inheritDoc | xargs p4 edit
find java/com/benmccann -name ‘*.js’ -print0 | xargs -0 grep -l @inheritDoc | xargs sed -i ‘s/\(.*\)@inheritDoc/\1@override/’

Automatic updates

If you’re using Ubuntu you can do this by editing /etc/apt/apt.conf.d/50unattended-upgrades. Running out of date packages with security holes is a good way to get your machine pwnd.

Remove unused software

Every piece of software installed on your system provides one more attack point for malicious users. You should inventory your system and remove anything you don’t need. E.g. to remove Ubuntu One from your system:

sudo apt-get purge ubuntuone*

Secure SSH

Edit /etc/ssh/sshd_config:

PermitRootLogin no
AllowUsers bmccann nx gitolite

You may also disable password authentication and replace it with public key authentication:

PasswordAuthentication no
PubkeyAuthentication yes

Restart the SSH daemon:

sudo service ssh restart

or

sudo /etc/init.d/ssh restart

This disallows login via password and instead replaces it with login via public/private key pair. To setup your public key encryption run ssh-keygen on the client and put ~/.ssh/id_rsa.pub from the client into ~/.ssh/authorized_keys on server.

Sometimes while messing around with SSH settings, you’ll lock yourself out. I this case it’s nice to use the -v option with the ssh client.

You can also setup shortcuts in ~/.ssh/config. E.g. the shortcut below turns ssh gitolite into an alias for ssh -l gitolite -p 77777 bensdynamicdns.getmyip.com.

Host gitolite
   User gitolite
   Hostname bensdynamicdns.getmyip.com
   Port 77777
   IdentityFile ~/.ssh/id_rsa

Secure NX

If you’d like to setup NX with this configuration it takes a couple extra steps than a normal NX installation. Note that every additional service you run on the machine provides one more attack point for hackers, so you’re more secure not running NX at all. However, if you choose to run NX for the benefits that it provides then here are some steps to help keep you safe:

• Download and install the client, node, and server in that order
• In /etc/ssh/sshd_config add the nx user by setting AllowUsers nx and restart the ssh daemon sudo /etc/init.d/ssh restart.
• NX uses a deprecated location for the ssh authorized_keys file, so you must fix that or you will get a public key authentication failed error. Open /usr/NX/etc/server.cfg and change #SSHAuthorizedKeys = "authorized_keys2" to SSHAuthorizedKeys = "authorized_keys". Now run sudo mv /usr/NX/home/nx/.ssh/authorized_keys2 /usr/NX/home/nx/.ssh/authorized_keys if there’s an authorized_key2 file present.
• Run sudo /usr/NX/scripts/setup/nxserver –install
• If you’ve disabled SSH passwords then you’ll also need to set EnableUserDB = "1" and EnablePasswordDB = "1" in /usr/NX/etc/server.cfg and then run sudo /usr/NX/bin/nxserver –useradd $USER since we’ve disabled passwords when we locked down SSH.
• Change the default NX key.  Run sudo /usr/NX/bin/nxserver –keygen.  In your NX client, open “Configure…” > “General” tab > “Key …” and copy the contents of “/usr/NX/share/keys/default.id_dsa.key” into the key window and save it.
• Optional for connecting to multiple servers at once:  Change DisplayBase in /usr/NX/etc/server.cfg.
• Restart the NX server to pickup your changes: sudo /etc/init.d/nxserver restart

Secure MySQL

Run mysql_secure_installation

Install fail2ban

• Install fail2ban by running sudo apt-get install fail2ban, which will lockout users who repeatedly try to access your system by guessing passwords.
• Make your own copy of the configuration file: sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local
• Check if fail2ban is running properly: sudo fail2ban-client status

More
Andrew Ault wrote a good article as well.
The NSA has a comprehensive guide to securing a Linux system

Evan’s Debugger is a Linux replacement for OllyDbg.

You can install it by downloading the .tar.gz and doing the following:

$ sudo apt-get install libqt4-dev
$ sudo apt-get install libboost1.40-all-dev
$ tar zxvf debugger-0.9.15.tgz
$ mv debugger /usr/local/src/
$ cd /usr/local/src/debugger
$ qmake -makefile DEFAULT_PLUGIN_PATH="/usr/lib/edb/"
$ make
$ sudo make INSTALL_ROOT=/usr install

I just got a laptop loaded with Lucid Lynx and have had a bit of a mixed experience adjusting.  I’ve actually used Ubuntu a bit in the past, but only minimally and never as my primary computer until now.

First reactions

• I like the default background.
• Have the fonts improved?  Fonts have always looked bad on Linux distros I’ve used in the past, but the Ubuntu font seems to be pretty clear.
• Why is the window close button in the top left?  Every computer I’ve ever used it’s been in the top right.  I hate that its anywhere else in Ubuntu.  It’s annoying because it goes against convention.  It’s also frustrating because it’s not uniform.  E.g. when closing tabs or windows in Chrome, the x is still in the top right.
• OMG.  Why is it so hard to change anything on the menu bar?  To move anything I have to right click every single icon on the menu bar and uncheck “Lock to Panel”.  Then I need to specifically select the Move option to be able to move the icon.  It’s very annoying that this is so difficult.  A much better UI would be a global lock/unlock for the panel instead of the per-icon mechanism and drag and drop support without having to first go into move mode.
• Finally!!!  You fixed the menus!!  The menus in every other Linux distro I’ve ever used have been super cluttered and unorganized.  I LOVE that they don’t suck anymore.  Do not underestimate how important this is.
• The menus themselves are even harder to change than the menu bar.  I had to do a Google search to figure it out.  Who was the genius that decided you need to go to System > Preferences > Main Menu?  Why the hell can’t I just drag icons and around and right click icons to edit their properties?

Nice surprises

• The pop up that appears when you change the volume or connect to Wi-Fi is beautiful and super friendly.  This is the one place where usability is hands down better than XP!  The volume bars in XP were really ugly.  And I hated having to x out of the Wi-Fi connection pop-up in XP.  The Ubuntu one nicely fades out after a second or so.  Kudos to that UI designer.  Can he be in charge of the rest of the UI?
• Wow does the Wi-Fi connect fast after startup
• Making Windows+L lock the screen on my computer was surprisingly easy.  The Keyboard Shortcuts window itself was really difficult to use, but I was really happy how easy it was to find.
• Hulu Desktop is a savior.  It kept me from defenestrating my computer when the website was totally broken in Linux.
• I was able to use KeePass 2.x eventhough it’s a Windows program.  I just needed to install libmono-system-runtime2.0-cil, libmono-winforms2.0-cil, and xdotool.  No I can type “mono KeyPass.exe” to run the program.  Awesome!

Frustrations

• Why does the volume control come with so much other crap?!!! It was on a panel that had a ton of garbage on it, so I took it off and it’s very difficult to get it back without a all the other junk.
• Can’t play DVDs after first installing.  I understand there are license restrictions, so it might not be feasible to install by default, but they should make it easier for people who want to utilize the full functionality of their machines.  E.g. on first run there should be a wizard asking if you want to install the ability to play DVDs.  And if you try to play a DVD, instead of just giving up it should tell you that you need to install libdvdcss2.
• The active window is shown as being lighter in the bottom panel than the others.  This is confusing as all hell, so I recommend using the Radiance theme.
• Using NX shadowing requires disabling Compiz.
• It seems that by default there is no GUI installed for controlling the firewall in Ubuntu?  Can that really be true?
• There are completely different panel buttons for logging out and shutting down.  These two buttons/menus should be merged into one.
• It’d be nice if I didn’t have to install an extension to make backspace work in Chrome.
• I wanted to see what Kubuntu was like so I installed KDE.  I’ve always preferred KDE in the past, but it was just awful on Ubuntu.  The menus were so cluttered I didn’t know where to go for anything.  When I switched back to Gnome now all of my menus were now cluttered there too with a bunch of KDE crap!  I uninstalled the KDE Plasma Desktop library that I checked to install KDE, but it left all of it’s dependencies (i.e. everything).  It was quite an ordeal to uninstall.  I uninstalled a couple of the base libraries and that got most the garbage off my system.

Nagging throw my chair through the window frustrations

• Please, please, please make Ctrl+Y redo in gedit.  Redo is Ctrl+Y in every other program I use in Ubuntu (Eclipse, Gimp, Chrome, Firefox, Open Office, Scribes, Geany, etc).  If you want to keep Ctrl+Shift+Z as redo that’s fine, just add a second key binding for Ctrl+Y.  I might have to finally plunk down the money to try the new Linux version of UltraEdit.
• The battery life stinks compared to Windows.  I’m using a Lenovo T400, which had XP on it previously and the battery life was phenomenal.  Now’s it’s abysmal.  If I leave my machine in my bad in hibernate mode for a day the battery will have died.
• Ubuntu has managed to take Flash on Linux to a whole new low.  It works worse than on any other Linux distribution I’ve ever used, which is saying a lot.  I realize it’s not totally their fault and hope that this will become a non issue with WebM, but right now it’s an enormous frustration.

Necessary fixes

• Put the x, minimize, and maximize buttons back in the top right corner of the windows.  Big thanks to gdi2k for pointing out a solution in the comments.  I first tried to fix this by changing to a different theme, which solved the problem, but made everything super ugly.
• Get rid of the pointless envelope in the top right corner. Run sudo apt-get purge indicator-messages, right click the envelope and choose “Remove From Panel”, and then “Add to Pannel…” followed by “Indicator Applet”
• Get a text editor where Ctrl+Y works.  Download scribes or run sudo apt-get install geany and then change the default text editor.
• Install libdvdcss2 so that you can watch DVDs.
• Install nautilus-open-terminal so that you can open a terminal from Nautilus (the file explorer)

Optional customizations

• Install the Conky system monitor: sudo apt-get install conky and put a configuration in ~/.conkyrc
• Install Java: sudo apt-get install openjdk-6-jdk
• Remove the games: sudo apt-get purge gnome-games-common

Stay current

• Optional.  If you’d like the latest stable software instead of the long term support version then select: System > Administration > Software Sources > Updates > Release upgrade > Normal releases.

Installing Google products

• sudo gedit /etc/apt/sources.list
• Add “deb http://dl.google.com/linux/deb/ stable non-free main” and “deb http://dl.google.com/linux/deb/ testing non-free main”
• sudo apt-get update
• Install picasa, googleearth, google-chrome-stable, or google-desktop-linux via the Ubuntu Software Center

Security and remote desktop

• I wrote a separate blog post about securing your installation.  It also describes how to setup NX for remote desktop support.

Overall I rather like Ubuntu.  OpenSUSE 11.2 left me feeling rather frustrated, so I’ve now switched to Ubuntu on my home machine as well.

Resume button disabled

I was unable to resume my NX session.  While trying to connect, the resume button was greyed out (or grayed out)  This apparently can happen if the two machines are running at a different color depth.

The machine I was trying to connect to was running Ubuntu, so I checked the color depth (sudo cat /etc/X11/xorg.conf) and saw that it was running at 24 bit.  Then I checked the color depth on my Windows machine (Control Panel > Display > Settings > Color Quality) and saw it was running at 16 bit.  There was no option to set it to 24-bit, so I chose the option “Highest (32 bit)”.  No more disabled resume button!

I think the cause of the problem was plugging my laptop into the projector at work yesterday.  It apparently changed my color depth and Windows didn’t reset it when I exited presentation mode.

Execution of last command failed

Trying to reconnect to my NX session kept failing.  I hit the Details button and saw the following:

NX> 596 NX> 596 ERROR: NXNODE Ver. 3.4.0-6  (Error id e76DC5C)
NX> 596 NX> 596 ERROR: resume session: run commands
NX> 596 NX> 596 ERROR: execution of last command failed
NX> 596 NX> 596 last command: '/bin/kill -USR2 16905'
NX> 596 NX> 596 exit value: 1
NX> 596 NX> 596 stdout:
NX> 596 NX> 596 stderr: /bin/kill: 16905: No such process

The only thing I found that would let me connect to my box via NX at all was to “rm /usr/NX/var/db/running/*” in order to kill my current session.  Killing the session is a sucky option, but at least now I can use NX again.

openSUSE is my favorite Linux distribution.  Linux in general has some usability frustrations as a desktop user, so I hope to share some of the ways they can be dealt with.  If you have questions of your own leave a comment.

Fix horrible bug that breaks buttons

GDK has a horrible debilitating bug that was not caught before release and at the time of writing the fix has not been backported as an online update.  This makes buttons in both Flash and Eclipse unresponsive to clicking.  You need to “export GDK_NATIVE_WINDOWS=true” in order for things to work correctly.  I added this in my ~/.bashrc file:

# .bashrc

# User specific aliases and functions
alias untargz="tar zxvf"

export GDK_NATIVE_WINDOWS=true
export PATH=/usr/local/eclipse/eclipse-3.5:$PATH

# Source global definitions
if [ -f /etc/bashrc ]; then
********. /etc/bashrc
fi

1-click installers – Setup graphics card, multimedia, and fonts

An easy way to install most of the software you need is to use a 1-click installer.  If you have an NVIDIA or ATI graphics card, then you’ll want to install the drivers using one of these installers.  I also recommend installing “Codecs pack for KDE”, “VLC Media Player”, and “Fonts with subpixel hinting enabled”.

Install Chrome

Download it from Google.

Setup multimedia

This is a perennial setup step on Linux distributions.  We’ll install the codecs needed to watch videos on Linux.

1. YaST > “Software” > “Software Repositories”
2. Click “Add”
3. Select “Community Repositories”
4. Select “Packman Repository” if it is not already
5. YaST > “Software” > “Software Management”
6. Install libxine1-codecs.

Setup time synchronization

NTP (Network Time Protocol) can be used to synch your system’s clock to a server on the internet.

1. YaST > “System” > “Date and Time”
2. Click “Change…”
3. Select “Synchronize with NTP Server”
4. Add the server for your region from pool.ntp.org (e.g. I used 0.us.pool.ntp.org since I’m in the United States)
5. Check the “Save NTP Configuration”
6. If you hit “Configure…” you can also add backup servers (e.g. 1.us.pool.ntp.org , 2.us.pool.ntp.org , etc.)

Setup a static IP address

This step is optional and is meant for people that know what a static IP is and want to set one up.  Having a static IP address is very nice when you want to remote desktop to your server or access it in some other way without worrying about what the IP address is.  There may also need to be some configuration done on your router for this one.  Or you may prefer to investigate DHCP reservations if your router supports them.

1. YaST > “Network Devices” > “Network Settings”
2. Under Hostname/DNS, you may change your hostname and Domain Name if you prefer
3. Under Global Options, switch to “Traditional Method with ifup”
4. Under “Overview”, select your network card and click “Edit”
5. Enter your static IP (besure to also enter DNS and gateway information)
6. Hit save

Setup a network file share (NFS) using Samba

Another optional step, Samba allows you to share files on your computer with others on the network.

1. YaST > “Software” > “Software Management”
2. Install “samba”
3. YaST > “Network Services” > “Samba Server”
4. Choose “Not a domain controller”, start during boot, and tell it to unblock the firewall
5. Change sharing settings as you’d like and hit “Finish”
6. Add a user to Samba by running “smbpasswd -a username” where username is the user you’d like to create.
7. Connect from your Windows machine by right clicking “My Computer” and browsing your network.  If you have trouble connecting you might also try opening a “Run…” dialog off the start menu and typing in your IP address with two leading slashes e.g. “\\192.168.10.2″

Setup remote desktop through NX

The two main remote desktop softwares for Linux are VLC and NX.  NX is much faster and is what I would recommend.  Unfortunately, I have not been able to get desktop sharing to fully work.  If you get desktop shadowing to work properly then please let me know.  In addition to installing NX, we’ll also open the corresponding port in the firewall so that we can connect from another machine.

1. Download the NX Linux packages
2. Run “rpm -iv nxclient-3.4.0-5.x86_64.rpm”, “rpm -iv nxnode-3.4.0-5.x86_64.rpm”, and “rpm -iv nxserver-3.4.0-5.x86_64.rpm”
3. Run “/usr/NX/scripts/setup/nxserver –install”
4. Run “/usr/NX/bin/nxserver –keygen”
5. In your NX client, open “Configure…” > “General” tab > “Key …”
6. Copy the contents of “/usr/NX/share/keys/default.id_dsa.key” into the key window and save it
7. Open “/usr/NX/etc/server.cfg”
8. Uncomment ‘EnableSessionShadowingAuthorization = “1″ and change the value to “0″ which will enable you to select “Shadow” in the client under the General > Desktop if you’d like to do desktop sharing.
9. YaST > “Security and Users” > “Firewall” > “Allowed Services”
10. Allow “Secure Shell Server”

Upgrade to the ext4 file system

ext4 is the new default file system on openSUSE 11.2.  If you did a clean install, you will be running ext4 by default.  However, if you have a drive you did not reformat when installing the OS then you may be running ext3.  For example, I have two drives: 1 60 gig drive I use as my root partition and a 500 gig drive I use as my home directory.  When I installed openSUSE 11.2, I wiped the root partition and reformatted it as ext4, but I wanted to keep the data on my home directory, so I couldn’t reformat it and left it as ext3.

1. Run “df -T” to see your file system types.  For me it showed /dev/sdb1 as ext4 mounted on /home
2. Run init 1 to switch runlevels
3. Unmount the drive:  e.g. “umount /home”
4. Run e2fsck on the drive : e.g. e2fsck /dev/sdb1
5. Run tune2fs: e.g. tune2fs -O extents,uninit_bg /dev/sdb1
6. Edit /etc/fstab to change ext3 to ext4 on the drive
7. Run “mount -a” to remount the drive

Review: The Problem with Linux is Usability and Resource Allocation

openSUSE is as good a Linux desktop as you’ll find.  Unfortunately that’s not saying as much as I’d like.  There are so many broken things on the system and yet so much effort was put into developing things that average person doesn’t give a rat’s ass about. There’s a whole load of crap that comes with the system that’s a waste.  It’s incredibly frustrating to me to see so many resources go into this software that few people care about.  I don’t need Marble when the far superior Google Earth is available on Linux.  I don’t need Kaffeine when VLC is a better alternative.  Most of the games are a waste and can’t hold a candle to the hundreds of Flash games available online.   I’ve never used digiKam, but have to assume that at best it’s Picasa‘s ugly stepsister.  There are dozens of programs I’d rather use than KDE PIM: GMail, Thunderbird, LinkedIn, etc.  The list goes on, and on, and on.  Why are we building this stuff?  The single biggest improvement in openSUSE 11.2 is that Firefox is now the default browser.  This took way too long, but is a welcomed change.  I wish VLC would replace Kaffeine.  Someone at Novell, Canonical, et. al. needs to do some user testing.  Any 12-year-old kid would tell you you’re crazy if you think people would rather use Marble than Google Earth.  Linux distros have done an absolutely horrifyingly awful job of picking the best software to be the default.  Instead of wasting all this time, how about we come together and decide to make an operating system that just works?  There are so many usability frustrations that I’d like to see solved instead.  Novell, Canonical, and the other leaders in this area need to step up.

As mentioned, there are a lot of usability problems.  For example, Flash was unusable in full screen mode after install.  It turned out this was because I hadn’t yet installed my NVIDIA driver.  But this is a big problem.  How would any casual user know they had to do this?  My parents, brother, or sister would not have known to do this despite being reasonably computer savvy.  I knew because I’ve used Linux for many years, but if it requires a computer science degree to watch a YouTube video then you’ve failed.  And when I did realize I needed to install the driver, I needed to know which of three drivers I wanted.  Are you serious?  I could just imagine asking my mom what graphics card she has.  That would be a fun conversation.  It’s 2009.  And you don’t have the ability to detect my hardware?  I understand that there are licensing issues, but once I’ve said I want to install a graphics driver you should be able to tell me which one I need.  I want to get rid of the “Recently Used” option on the Kicker menu like I can with classic, but there’s no option to.  I don’t understand why YaST has a “Media Check” option.  Can’t you tell there’s no CD/DVD in my drive?  I tried to edit my network settings with YaST and it told me to use NetworkManager or change the setup method to Traditional with ifup.  How do I do either of those things?  I don’t know what NetworkManager is or how to open it.  There’s nothing in any of the menus called NetworkManager.  When I started Firefox it asked me if I wanted to use Flash, gnash, or swfdec.  But I tried gnash and swfdec and neither could play a Hulu video, so are you insane?  Of course I don’t want to use either of those.  Why are you confusing me?  Flash on Linux is a big problem.  The controls on the Hulu just stop working with frustrating frequency.  I can’t figure out why Amarok and Kaffeine are both broken.  I could go on, but you get my point.  Let’s fix these problems instead of building more crap no one asked for.  I know how much of this work has been done by volunteers and am extremely grateful for it.  I’ve contributed to several open source projects myself and know what it’s like, so I hope those reading know I am thankful to have this amazing free software.  I’m happy for what’s been done and am hoping the leaders of KDE and openSUSE will make some hard choices about what’s worth investing in and supporting, so that these projects can become successful in the mainstream world because as it stands now, even as great as it is, Linux simply isn’t ready.

Looking to register some domains for your website?  Get a free domain with your Network Solutions hosting package.

I’d heard of Tonido awhile back, but was having trouble getting it to run on OpenSUSE since it’s packaged only for Ubuntu.  Tonight I sat down and figured out how to get it to run:

• Install alien via the YaST package manager
• Convert the Tonido package to an RPM by using alien (alien -r filename.deb)
• Install newly created Tonido RPM
• Install libnotify1-32bit via YaST package manager
• Open port 10001 in Firewall (Security and Users > Firewall > Allowed Services > Advanced)
• Port forward port 10001 to the machine where Tonido is installed

Yay, now you can run Tonido.  When you start it, it will open Konqueror, for which it is very buggy.  So close that window and open http://127.0.0.1:10001/ in FireFox.  Now you’re off and running.

My initial thoughts:

• This needs SSL support to really be useful since it gives access to my whole computer.
• Too bad the setup is a bit hard.  I’m sure more people would adopt it if it used UPnP.
• The WebShare app could be pretty cool in the future, but at the moment it’s mostly worthless.  You can only download one file at a time and there’s no upload.  I’d like to be able to mount my shares on my Windows machine.  I really wish it exported them via WebDav or SFTP.
• The music player needs flac support.  I can’t play any of my music collection!

Want to know how to figure out what’s running on a given port on your machine?  The following example will show you what’s running on port 80 on your Linux machine:

lsof -i -n -P | grep :80

I always have trouble remembering how to use the find command in Linux, so here are a few examples.

Finding all hidden files:

find . -regex '.*/\..*'

Deleting all Java files:

rm -rf `find . -name *.java`

Deleting all directories named .svn:

rm -rf `find . -type d -name .svn`

Recursively set permissions for a web server:

chmod -R a+r ~/www
find ~/www -type d -exec chmod a+x {} \;

Finding all exectuable files:

find . -executable -type f