X-Git-Url: http://git.grml.org/?a=blobdiff_plain;f=grml_tips;h=4fa526361d41e0573e0c2fbaf905600fa4fb113c;hb=4c8e7332cd1a7b92a85de64d90273ad5845821df;hp=1ed3439d807a10a474f5b9814d17a106d76df422;hpb=0af15bf28002df1377b5e2a0c648efe7893157b4;p=grml-tips.git diff --git a/grml_tips b/grml_tips index 1ed3439..4fa5263 100644 --- a/grml_tips +++ b/grml_tips @@ -43,12 +43,6 @@ Configure network: # grml-network -- -Boot grml via network: - -# grml-terminalserver - -See: man grml-terminalserver + http://grml.org/terminalserver/ --- Deactivate error correction of zsh: % NOCOR=1 zsh @@ -584,6 +578,10 @@ Save live audio stream to file: or % mencoder mms://file.wmv -o $FILE -ovc copy -oac copy + +or + +% mimms mms://file.wmv -- Merge video files: @@ -659,7 +657,9 @@ to get a list of all supported trees -- Transfer your SSH public key to another host: -% ssh-copy-id -i ~/.ssh/id_dsa.pub user@remote-system +% ssh-keygen # ssh-keygen / ssh-key-gen: if you don't have a key yet +[...] +% ssh-copy-id -i ~/.ssh/id_rsa.pub user@remote-system or % cat $HOME/.ssh/id_rsa.pub | ssh user@remote-system 'cat >> .ssh/authorized_keys' -- @@ -704,9 +704,9 @@ Write back the guessed table: Develop, test and use exploit code with the Metasploit Framework: cd /tmp -wget http://www.metasploit.com/tools/framework-2.7-snapshot.tar.gz -unp framework-2.7-snapshot.tar.gz -cd framework* +wget http://framework-mirrors.metasploit.com/msf/downloader/framework-3.0.tar.gz +unp framework-3.0.tar.gz +cd framework-3.0 ./msfcli -- Useful documentation: @@ -1088,9 +1088,9 @@ EOF See also: http://www.debian.org/releases/stable/i386/apcs04.html.en Avoid all of the above steps - use grml-debootstrap(8) instead! -- -Convert files from Unicode / UTF to ISO: +Convert files from Unicode / UTF-8 to ISO: -% iconv -f utf8 -t iso-8859-15 < utffile > isofile +% iconv -c -f utf8 -t iso-8859-15 < utffile > isofile and vice versa: @@ -1274,8 +1274,7 @@ Write a Windows 2000/XP/2003 MBR to device: Use a Vodafone 3G Datacard (UMTS) with Linux: Plug in your vodafone card and check in syslog whether the appropriate -(probably /dev/ttyUSB0 or /dev/noz0 when using newer vodafone cards) has -been created. If so run: +(probably /dev/ttyUSB0 or /dev/noz0) has been created. If so run: # gcom -d $DEVICE # wvdial --config /etc/wvdial.conf.umts $PROFILE @@ -1290,8 +1289,32 @@ Usage examples: # gcom -d /dev/noz0 # wvdial --config /etc/wvdial.conf.umts dreiusb -Notice: newer vodafone cards require the nozomi driver. Run 'modprobe nozomi' on -your grml system. +If you receive invalid DNS nameservers when connecting, like: + +[...] +--> primary DNS address 10.11.12.13 +--> secondary DNS address 10.11.12.14 + +just provide a working nameserver to resolvconf via: + +# echo "nameserver 80.120.17.70" | resolvconf -a ppp0 + +Notice: some vodafone cards require the nozomi driver (run 'modprobe nozomi' on +your grml system), some other ones require the sierra driver (run +'modprobe sierra'). + +If your device isn't supported by usbserial yet, manually provide vendor and +product ID when loading the usbserial module. Usage example: + +% lsusb +[...] +Bus 004 Device 008: ID 1199:6813 Sierra Wireless, Inc. + +# modprobe usbserial vendor=0x1199 product=0x6813 + +To get a list of available providers execute: + +# gcom -s -d /dev/ttyUSB0 /usr/share/doc/gcom/examples/operator -- hdparm - get/set hard disk parameters @@ -1715,7 +1738,7 @@ GET http://www.google.com HTTP/1.0 [press enter twice] Adjust system for use of qemu with kqemu: Make sure you have all you need: -# apt-get update ; apt-get install qemu grml-kerneladdons-$KERNELVERSION +# aptitude update ; aptitude install qemu kqemu-modules-$(uname -r) Then set up kqemu: @@ -2077,10 +2100,13 @@ xfs without vol_id: # xfs_admin -l /dev/sda1 reiserfs without vol_id: -# debugreiserfs /dev/sda1 | grep UUID +# debugreiserfs /dev/sda1 | grep -i label + +jfs without vol_id: +# jfs_tune -l /dev/sda1 | grep -i label reiser4 without vol_id: -# debugfs.reiser4 /dev/sda1 | grep uuid +# debugfs.reiser4 /dev/sda1 | grep -i label -- Check filesystem's UUID: @@ -2088,24 +2114,25 @@ generic way: # vol_id -u /dev/sda1 ext2/3 without vol_id: -# dumpe2fs /dev/sda1 | grep UUID +# dumpe2fs /dev/sda1 | grep -i UUID xfs without vol_id: # xfs_admin -u /dev/sda1 reiserfs without vol_id: -# debugreiserfs /dev/sda1 | grep LABEL +# debugreiserfs /dev/sda1 | grep -i UUID reiser4 without vol_id: -# debugfs.reiser4 /dev/sda1 | grep label +# debugfs.reiser4 /dev/sda1 | grep -i UUID -- -Change a FS-LABEL: +Change a filesystem's LABEL: swap: # mkswap -L $LABEL /dev/sda1 ext2/ext3: # e2label /dev/sda1 $LABEL +# tune2fs -L $LABEL /dev/sda1 reiserfs: # reiserfstune -l $LABEL /dev/sda1 @@ -2121,7 +2148,7 @@ fat/vfat: # mlabel -s i:$LABEL ntfs: -# ntfslabel /dev/sda1 /dev/sda1 +# ntfslabel $LABEL /dev/sda1 -- Disable pdiffs feature of APT: @@ -2144,7 +2171,7 @@ Restore the backup using unzsplit: More usage examples: man zsplit + man unzsplit -- -Measure network performance using ipserf +Measure network performance using iperf: Server side: % iperf -s -V @@ -2496,7 +2523,11 @@ Configuration options relevant on harddisk installation: # tzconfig which adjusts /etc/timezone and /etc/localtime according - to the provided information. + to the provided information. Running: + + # dpkg-reconfigure tzdata + + might be useful as well. * /etc/default/rcS: set variable UTC according to your needs, whether your system clock is set to UTC (UTC='yes') or @@ -2542,3 +2573,518 @@ Further information: http://www.debian.org/doc/manuals/system-administrator/ch-sysadmin-time.html http://wiki.debian.org/TimeZoneChanges -- +Recorder shellscript session using script: + +% script -t 2>~/upgrade.time -a ~/upgrade.script +% scriptreplay ~/upgrade.time ~/upgrade.script +-- +Test UTF-8 capabilities of terminal: + +wget http://melkor.dnp.fmph.uniba.sk/~garabik/debian-utf8/download/UTF-8-demo.txt.gz +zcat UTF-8-demo.txt.gz + +or: + +wget http://www.cl.cam.ac.uk/~mgk25/ucs/examples/UTF-8-test.txt +cat UTF-8-test.txt +-- +UTF-8 at grml / some general information regarding Unicde/UTF-8: + + http://wiki.grml.org/doku.php?id=utf8 +-- + +This allows one ssh connection attepmt per minute per source ip, with a initial +burst of 10. The available burst is like a counter which is initialised with +10. Every connection attempt decrements the counter, and every minute where the +connection limit of one per minute is not overstepped the counter is +incremented by one. If the burst counter is exhausted the real rate limit +comes into play. This gives you 11 connectionattepmts in the first minute +before blocked for 10minutes. After 10 minutes block the game restarts. + +Hint: you could set the burst value to 5 and the block time to only 5 minutes +to achive the same average connection rate but with halve the block time. + +iptables -A inet_in -p tcp --syn --dport 22 -m hashlimit --hashlimit-name ssh \ + --hashlimit 1/minute \ --hashlimit-burst 10 --hashlimit-mode srcip \ + --hashlimit-htable-expire 600000 -j ACCEPT +iptables -A inet_in -p tcp --dport 22 -m state --state NEW -j REJECT +-- +Tunnel a specific connection via socat: + +On the client: +% socat TCP4-LISTEN:8003 TCP4:gateway:500 + +On the gateway: +# socat TCP4-LISTEN:500,fork TCP4:target:$PORT + +Using localhost:8003 on the client uses the tunnel now. +-- +Set date: + +# date --set=060916102007 + +where the bits are month(2)/day(2)/hour(2)/minute(2)/year(4) + +Set date using a relative date: + +# date -s '+3 mins' + +or + +# date -s '+tomorrow' + +Display a specific relative date: + +# date -d '+5 days -2 hours' + +Don't forget to set hardware clock via: + +# hwlock -w +-- +Booting grml via network / PXE: + +Start grml-terminalserver on a system with network access +and where grml is running: + +# grml-terminalserver + +Then booting your client(s) via PXE should work without +any further work. + +See: man grml-terminalserver + http://grml.org/terminalserver/ +-- +Debugging SSL communications: + +% openssl s_client -connect server.adress:993 > output_file +% openssl x509 -noout -text -in output_file + +or + +# ssldump -a -A -H -i eth0 + +See http://prefetch.net/articles/debuggingssl.html for more details. +-- +Remove bootmanager from MBR: + +# lilo -M /dev/hda -s /dev/null +-- +Rewrite grub to MBR: + +# mount /mnt/sda1 +# grub-install --recheck --no-floppy --root-directory=/mnt/sda1 /dev/sda +-- +Rewrite lilo to MBR: + +# mount /mnt/hda1 +# lilo -r /mnt/hda1 +-- +Create screenshot of plain/real console - tty1: + +# fbgrab -c 1 screeni.png +-- +Create screenshot when running X: + +% scrot + +Tip: use the gkrellshoot plugin when using gkrellm +-- +Redirect all connections to hostA:portA to hostB:portB, where hostA and hostB are +different networks: + +Run the following commands on hostA: + +echo 1 > /proc/sys/net/ipv4/ip_forward +iptables -t nat -A PREROUTING -p tcp --dport portA -j DNAT --to hostB:portB +iptables -A FORWARD -i eth0 -o eth0 -d hostB -p tcp --dport portB -j ACCEPT +iptables -A FORWARD -i eth0 -o eth0 -s hostB -p tcp --sport portB -j ACCEPT +iptables -t nat -A POSTROUTING -p tcp -d hostB --dport portB -j SNAT --to-source hostA +-- +Flash BIOS without DOS/Windows: + +Dump flash info and set the flash chip to writable: +# flashrom + +Backup the original BIOS: +# flashrom -r backup.bin + +Notice: the following step will overwrite your current BIOS! +So make sure you really know what you are doing. + +Flash the BIOS image: +# flashrom -wv newbios.bin + +Also check out LinuxBIOS: http://linuxbios.org/ +-- +Enable shadow passwords: + +# shadowconfig on +-- +Set up an IPv6 tunneln on grml: + +# ipv6-tunnel start +-- +Set up console newsreader slrn for use with Usenet: + +% grml-slrn +-- +Calculate with IPv6 addresses: + +% ipv6calc + +For usage examples refer to manpage ipv6calc(8). +-- +Common network debugging tools for use with IPv6: + +% ping6 +% tracepath6 +% traceroute6 +% tracert6 +% nc6 +% tcpspray6 +-- +Set up NFS (Network File System): + +Server-side +~~~~~~~~~~~ +Make sure the relevant services are running on the server side: + +# /etc/init.d/portmap start +# /etc/init.d/nfs-common start +# /etc/init.d/nfs-kernel-server start + +Export shares via /etc/exports: + +/backups 192.168.1.100/24(rw,wdelay,no_root_squash,async,subtree_check) + +... or manually export a directory running: + +# exportfs -o rw,wdelay,no_root_squash,async,subtree_check 192.168.1.100:/backups + +and unexport a share running: + +# exportfs -u 192.168.1.100:/backups + +and every time when you modify /etc/exports file run + +# exportfs -ra + +Display what NFS components are running: + +# rpcinfo -p + +Display list of exported shares: + +# exportfs -v +or +# showmount -e + +Client-side +~~~~~~~~~~~ +Make sure the relevant services are running on the client side: + +# /etc/init.d/portmap start +# /etc/init.d/nfs-common start + +Verify that the server allows you to access its RPC/NFS services: + +# rpcinfo -p server_name + +Check what directories the server exports: + +# showmount -e server_name + +On the client side you can use something like the following in /etc/fstab: + +192.168.1.101:/backups /mnt/nfs nfs defaults,users,wsize=8192,rsize=8192 0 0 +-- +Mount a cloop file: + +# aptitude install cloop-src +# m-a a-i cloop-src + +# modprobe cloop file=/path/to/cloop/file +# mount -r -t iso9660 /dev/cloop /mnt/test +-- +Create a PS/PDF of a plaintext file: + +% a2ps --medium A4dj -E -o output.ps input_file +% ps2pdf output.ps +-- +Print two pages on one in a PDF file: + +% pdfnup --nup 2x1 input.pdf + +Concatenate, extract pages/parts, encrypt/decrypt, +compress PDFs using 'pdftk'. +-- +Read a PS/PDF file on console: + +% pstotext file.pdf + +or on plain framebuffer console in graphical mode: + +% pdf2ps file.pdf ; ps2png file.ps file.png ; fbi file.png + +or + +% fbgs file.pdf +-- +Bypass the password of a PDF file: + +% gs -q -dNOPAUSE -sDEVICE=pdfwrite -sOutputFile=output.pdf input.pdf -c quit +-- +Record sound: + +% rec test.aiff + +This will record a AIFF audio file. +-- +Change passphrase / password of an existing SSH key: + +% ssh-keygen -p +-- +Enable syntax highlighting in nano: + +Just uncomment the include directives for your respective +language at the bottom of the file /etc/nanorc +-- +Create netboot package for grml-terminalserver: + +# sh /usr/share/doc/grml-terminalserver/examples/create-netboot +-- +To boot grml via network (PXE) check out grml-terminalserver: + +# grml-terminalserver + +See http://grml.org/terminalserver/ for more details. +-- +Rotate pictures: + +Using the 'Orientation' tag of the Exif header, rotate +the image so that it is upright: +% jhead -autorot *.jpg + +Manually rotate a picture: +% convert -rotate 270 input.jpg output.jpg +-- +Rename files based on the information inside their exif header: + +% jhead -n%Y-%m-%d_%Hh%M_%f *.jpg + +This will rename a file named img_2071.jpg to something like: + +2007-08-17_10h38_img_2071.jpg + +if it was shot at 10:38 o'clock on 2007-08-17 (according to +the information inside the exif header). +-- +Calculate network / netmask: + +Usage examples: +% ipcalc 10.0.0.28 255.255.255.0 +% ipcalc 10.0.0.0/24 +-- +Blacklist a kernel module: + +# blacklist + +-> running 'blacklist hostap_cs' for example will generate an +entry like this in /etc/modprobe.d/grml: + +blacklist hostap_cs +alias hostap_cs off + +To remove the module from the blacklist again just invoke: + +# unblacklist + +or manually remove the entry from /etc/modprobe.d/grml. +-- +Create a Debian package of a perl module: + +% dh-make-perl --cpan Acme::Smirch --build +-- +The Magic SysRq Keys (SysReq or Sys Req, short for System Request): + +To reboot your system using the SysRq keys just hold down the Alt and +SysRq (Print Screen) key while pressing the keys REISUB ("Raising +Elephants Is So Utterly Boring"). + +R = take the keyboard out of raw mode +E = terminates all processes (except init) +I = kills all processes (except init) +S = synchronizes the disk(s) +U = remounts all filesystems read-only +B = reboot the system + +Notice: use O instead of B for poweroff. + +Or write the sequence to /proc/sysrq-trigger instead: + +# for i in r e i s u b ; do echo $i > /proc/sysrq-trigger ; done + +To enable or disable SysRq calls: + +# echo 0 > /proc/sys/kernel/sysrq +# echo 1 > /proc/sys/kernel/sysrq + +See http://en.wikipedia.org/wiki/Magic_SysRq_key for more details. +-- +Memtest / memcheck: + +Just boot your grml Live-CD with "memtest" to execute a memcheck/memtest +with Memtest86+. +-- +Tunnel TCP-Traffic through DNS using dns2tcp: + +Server-side: +~~~~~~~~~~~~ +1. Create necessary DNS-Records: +dnstun.example.com. 3600 IN NS host.example.com. +dnstun.example.com. 3600 IN A 192.168.1.1 +host.example.com. 3600 IN A 192.168.1.1 + +2. Configure dns2tcpd on host.example.com.: +# cat /etc/dns2tcpd.conf +listen = 192.168.1.1 #the ip dns2tcpd should listen on +port = 53 #" port " " " " +user = nobody +chroot = /tmp +domain = dnstun.example.com. # the zone as specified inside dns +ressources = ssh:127.0.0.1:22 # available resources + +3. Start the daemon: +# cat > /etc/default/dns2tcp << EOF +# Set ENABLED to 1 if you want the init script to start dns2tcpd. +ENABLED=1 +USER=nobody +EOF +# /etc/init.d/dns2tcp start + +Client-side: +~~~~~~~~~~~~ +You have two possibilities: +- Use the DNS inside your network (DNS must allow resolving for external domains) +# grep nameserver /etc/resolv.conf +nameserver 172.16.42.1 +# dns2tcpc -z dnstun.example.com 172.16.42.1 +Available connection(s) : + ssh +# dns2tcpc -r ssh -l 2222 -z dnstun.example.com 172.16.42.1 & +Listening on port : 2222 +# ssh localhost -p 2222 +user@host.example.com:~# + +- Directly contact the endpoint (port 53 UDP must be allowed outgoing) +# dns2tcpc -z dnstun.example.com dnstun.example.com +Available connection(s) : + ssh +# dns2tcpc -r ssh -l 2222 -z dnstun.example.com dnstun.example.com & +Listenning on port : 2222 +# ssh localhost -p 2222 +user@host.example.com:~# + +Notice: using 'ssh -D 8080 ..' you will get a socks5-proxy listening on +localhost:8080 which you can use to tunnel everything through your "dns-uplink". +-- +Configure a MadWifi device for adhoc mode: + +Disable the autocreation of athX devices: +# echo "options ath_pci autocreate=none" > /etc/modprobe.d/madwifi + +Remove the autocreated device for now: +# wlanconfig ath0 destroy + +Configuration in /etc/network/interfaces: + +iface ath0 inet static + madwifi-base wifi0 + madwifi-mode adhoc + ... + +Hints: + - Do not use interface names without ending 0 (otherwise startup fails). + - Only chooss unique names for interfaces. +-- +Find dangling symlinks using zsh: + +% ls **/*(-@) +-- +Use approx with runit supervision +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +Install the packages: +# apt-get install approx runit + +Add user approxlog for the logging daemon: +# adduser --system --home /nonexistent --no-create-home approxlog + +Create config directory: +# mkdir /etc/sv/approx + +Use /var/run/sv.approx as supervise directory: +# ln -s /var/run/sv.approx /etc/sv/approx/supervise + +# cat > /etc/sv/approx/run << EOF +#!/bin/sh +echo 'approx starting' +exec approx -f 2>&1 +EOF + +You normally do not need a logging service for approx because it logs +to syslog too. So just for completion: +# mkdir -p /etc/sv/approx/log +# ln -s /var/run/sv.approx.log /etc/sv/approx/log/supervise +# cat > /etc/sv/approx/log/run << EOF +#!/bin/sh +set -e +LOG="/var/log/approx" +test -d "$LOG" || mkdir -p -m2750 "$LOG" && chown approxlog:adm "$LOG" +exec chpst -uapproxlog svlogd -tt -v "$LOG" +EOF + +Now activate the new approx service (will be started within 5s): +# ln -s /etc/sv/approx/ /var/service/ + +Make approx managed via runit available via init-script interface: +# dpkg-divert --local --rename /etc/init.d/approx +# ln -s /usr/bin/sv /etc/init.d/approx +-- +Remote-reboot a grml system using SysRQ via /proc (execute as root): + +eject &>/dev/null +umount -l /cdrom +eject /dev/cdrom +echo b > /proc/sysrq-trigger +-- +Show what happens on /dev/sda0: + +# mount the debugfs to relay kernel info to userspace +mount -t debugfs none /sys/kernel/debug + +# is a convenient wrapper arround blktrace and blkparse +btrace /dev/sda0 +-- +Convert Flash to Avi: + +% ffmpeg -i input.flv output.avi +-- +Usage example for cryptsetup / -luks encrypted partition on LVM: + +volume group name: x61 +logical volume name: home + +echo "grml-crypt_home /dev/mapper/x61-home none luks" >> /etc/crypttab +Start cryptdisks +mount /dev/mapper/grml-crypt_home /mnt/test +-- +fdisk/parted/... complains with something like +'unable to open /dev/sda - unrecognised disk label'?! + +See http://grml.org/faq/#fdisk => + +* use /sbin/fdisk.distrib from util-linux +* switch to sfdisk, cfdisk,... +* use parted's mklabel command (but please read the + parted manual before executing this command) +--