Linux MagazineApril 2021的目錄

Sudo is the venerable tool that allows standard users to run admin tasks on Linux distributions. Without sudo, users would have to log into the system as the root user (or change to the root user with the su command), in order to run admin commands. Seeing as how that is a security risk, sudo has become a required tool for many Linux admins and users. However, it has been discovered (by researchers at Qualys) that, for nearly a decade, sudo contained a heap-based buffer overflow vulnerability. This bug could allow any unprivileged user to gain root privileges using the default sudo configuration. The vulnerability was introduced to sudo in July 2011, by way of commit 8255ed69 and effects the following versions of sudo: legacy versions from 1.8.2 to 1.8.31p2…

A new worm, based on Golang, has been discovered in the wild (since early December, 2020) that attempts to inject XMRig malware to mine for cryptocurrency. The worm targets public-facing services, such as MySQL, the Tomcat admin panel, Jenkins, and Oracle WebLogic. According to Avigayil Mechtinger, a security researcher with Intezer, "the attacker kept updating the worm on the command-and-control server, indicating that it's active and might be targeting additional weak configured services in future updates." The worm begins with a brute force attack. Once the worm gains access to a server, it works with three separate files: • A Bash or PowerShell script (depending on the operating system)• The Golang binary worm• XMRig miner So far the Bash and Golang binary worm have been undetectable by virus analysis platforms,…

When you open a terminal window and start typing a text-based command, you are interacting with a command shell or command line interface (CLI). A shell is a program that acts as an interface to a command processor, the component that carries out commands by interacting with the underlying system. Some of the command shells around today predate the birth of Linux and were originally used on classic Unix systems (see the box entitled “A Little History”). The most popular shell for Linux systems in the Bourne Again Shell, which is known universally as Bash [1]. Bash is the default for the terminal window on most systems, and Bash syntax is the norm for most popular discussions of Linux, including most of the articles in this magazine. But it isn’t…

Today’s networks require a monitoring solution with industrial-strength log management and analytics. One option that has gained popularity in recent years is ELK stack [1]. The free and open source ELK Stack collection is maintained by a company called Elastic. (According to the website, the company has recently changed the name of the project to Elastic Stack, but the previous name is still in common usage.) ELK Stack is not a single tool but a collection of tools (Figure 1). The ELK acronym highlights the importance of the collection’s three most important utilities. At the heart of the stack, Elasticsearch collects and maintains data, providing an engine, based on Apache Lucene, for searching through it. Logstash serves as the log processing pipeline, collecting data from a multitude of sources, transforming…

Generally speaking, laptops are not designed for typists. On many laptops, the keys are smaller than on a full-sized keyboard. Almost always, laptops use chiclet keys (small, flat squares) that slow typing, take a toll on fingers and hands after a few hours, and can cause serious repetitive stress injuries (RSI) over time. Ergonomic keyboards for laptops simply do not exist. Or rather they did not until recently, when Keyboardio teamed up with keyboard designer Phil Hagelberg of Technomancy to produce the Keyboardio Atreus (Figure 1) [1]. Although not integrated into a laptop frame, this portable USB keyboard is the length of a banana, making it easy to carry. It fulfills the long-ignored need for an ergonomic laptop keyboard – although you might want to change the factory layout to…

If you’re too young to remember the old Internet before the web, start up a terminal window and enter some commands at the Bash prompt. The whole Internet used to looked like that: no colors, no hyperlinks, no videos, no digital home photos – all a lot clunkier, and all in black and white. But guess what the old Internet didn’t have: no flashing banners, no cookies, no identity marketing, no ad scripts, and no phishing attacks. The truth is, the power and complexity of today’s World Wide Web has led to some practices that many users find downright annoying. Now a group of devoted but disillusioned web users is fighting back by bringing back the old Gopher protocol, a simple texted-based menu system that was often used to publish…

With lots of people currently considering the kind of digital footprint they’re leaving on the Internet and what kind of services they’re happy to share their personal data with, there’s never been a better time to reinvestigate RSS. RSS is an ancient technology: A simple XML file that updates when new posts are made to a website or podcast. Timestamps enable clients to scan for changes whenever they choose, and brief snippets of whatever a post is about allow users to decide whether or not to visit or listen based on an update. There are no cookies and few ways for marketing agencies to subvert the one-way protocol to retrieve unsolicited amounts of data. All the user needs is a client. However, because RSS has become increasingly rare on the…

There’s no denying that the World Wide Web is a wonderful thing. Anyone can set up their own website and make it available online to anyone else. However, there’s no doubt that the process is now more convoluted, and risky, than it was in the early days where you could serve pages from httpd running on your own system. This is maybe why corporations like Facebook have been so effective at becoming the (closed) World Wide Web for local community groups and institutions, and it’s something that this new browser could potentially help. Beaker is a web browser with a unique, and currently experimental, emphasis on peer-to-peer hosting of personal sites that could offer an alternative to a hosted community. The application has just hit its 1.0 milestone. When first…

Godot, the open source games development engine, has been getting lots of deserved support and coverage in the last year. It’s doing a brilliant job helping people get into games development without getting themselves locked into a proprietary ecosystem, much like Blender is doing for 3D designers. Thrive is a game built with Godot that proves this progress is having a hugely beneficial effect on games development, not just in helping developers create games at low cost, but in helping games to be developed that might not otherwise be easily created. Thrive is a game about the evolution of life on an alien planet not too dissimilar to Earth, and some gamers think it’s an idea not too dissimilar to Spore – a cult game published by Electronic Arts in…

Arch Linux 64-bit Begun in 2002, Arch Linux is one of the most respected distributions available. Although less well-known than Ubuntu or Fedora, Arch has a reputation for the adherence to its core values of remaining simple and lightweight. However, what Arch means by those terms may not be what others assume. By simple, Arch means that its packages are as close to those of upstream developers as possible. The only modifications are those accepted by the upstream developers. When Arch does patch a package, the patch is usually a bug fix, which is removed when a newer upstream version of the package is available. Similarly, by lightweight, Arch means that it installs a bare-bones system, without the usual curated selection of packages that developers assume that users might want.…

AT&T Alien Labs has reported that TeamTNT (a group that specializes in attacking the cloud and misconfigured Docker instances) is using a new downloader (based on the Ezuri crypter) to decrypt, install, and execute a malware payload from memory, without writing to the disk. This downloader is based on Golang and serves as both crypter and loader for Executive and Linkable Format (ELF) binaries. The Ezuri crypter was created in 2019 and posted to GitHub (https://github.com/guitmz/ezuri) for anyone to use. When used, Ezuri asks for a payload path to be encrypted and for a password. If no password is given, one will be automatically generated. The malware is then hidden within the loader and, after the user's input, the packer compiles the loader with the encrypted payload that can then…

Occasionally, a derivative distribution comes to rival the original. These days, for example, Ubuntu and Linux Mint are as popular as Debian. Likewise, for the last six years, Manjaro [1] has consistently eclipsed the popularity of Arch Linux upon which it is based. In fact, by combining the simplicity and rolling release structure of Arch Linux with the organization of Debian, Manjaro has become one of the leading Linux distributions of any origin. Recently, Lisa Singer answered my request for more details on behalf of the Manjaro corporate management team. Manjaro began as a passion project of three friends from Munich: Roland Singer, Guillaume Benoit, and Philip Müller. First announced on the Arch Linux Forums, primarily as an installer in 2011, it immediately went dark as the three friends created…

Thanks to increasingly sophisticated technology, displaying high-resolution images on screen is no longer a difficult task. However, these more detailed images (with a combination of greater image size, resolution, and color depth) come at a cost, consuming more storage space and taking longer to download from remote sources, such as web browsers and webcams. Sometimes you just need an image to display quickly. You can save time and bandwidth by displaying images at a lower resolution and color depth as text (ASCII or Unicode characters) directly in the terminal and converting them with American National Standards (ANSI) color codes [1]. You can also convert the images to plain HTML and CSS and embed the results in a web page. Some text browsers, such as ELinks, then display these images directly…

After a decade of daily hammering on my old workhorse ASUS notebook, I decided it was time for an upgrade, especially since I’ve started using FreeCAD [1] with both resin and filament printers for my Steampunk gadget projects [2]. My daughter had a Dell 7573 [3] notebook with Windows 10 (running Auto-CAD and Revit) that she no longer needed, but wanted to save the data. So we worked a deal: I swapped in a new M.2 SSD (and my daughter kept the old drive with her data), installed Xubuntu, and viola, I had an updated notebook (Figure 1). In this article, I’ll walk you through installing Xubuntu [4] on a late-model Dell Inspiron 2-in-1 notebook. In addition, I’ll demonstrate how the new notebook works for my Steampunk projects. Swapping in…

The Linux From Scratch (LFS) project has been around for more than 20 years [1]. It does not deliver software as a result, but detailed instructions on how to create an executable Linux system from the source code itself. Why might you want to take this route? (1) You might be a masochist with too much time on your hands. (2) You have a project with very specific requirements. (3) You want to learn fundamentally how Linux works. The detLFS [2] project by Thomas Dettbarn answers these needs. Unlike the pure theory of LFS, detLFS makes life far easier for anyone wanting to take on the challenge because the project provides a set of scripts instead of a manual. The scripts create a runnable, minimal Linux system for the Raspberry…

The MIDI protocol, commonly used to connect synthesizers, drum machines, and audio hardware to each other and a computer, is now 40 years old and still used in almost every artifact of music technology. This is remarkable when you consider how much technology has changed over that time: 1200 baud modems to broadband Internet, FM radio to 5G mobile data, and analog synthesizers to digital synthesizers and back to analog. Also, computers became smartphones and tablets, and MIDI became encased within USB. But MIDI still carries the same note, controller, volume, and pitch information that it did in 1985, and even the recently ratified MIDI 2.0 specification maintains this long term compatibility. This is great for compatibility, because it means your Roland Jupiter-6 from 1982 still works with your USB…

We often look at IDEs for programming languages on these pages. But the ones we look at are usually most beneficial to experienced programmers. Thonny is the opposite. It’s a small, low-resource, and self-contained IDE that helps immensely when learning Python. There’s even a mode designed specifically for the Raspberry Pi desktop. But the best thing about it is that it bundles Python 3.x with the main application. That means the beginner doesn’t have to struggle with installing the right version of Python and making sure it takes precedence in their path before they’ve even typed a line of code. And when you’re ready to write code, the user interface is initially as simple as it can be. The main panel taken by the text editor, an object inspector on…

There are many brilliantly designed games that are very simple yet have great playability, and Kurve is one of the best examples. It’s a modern remake of an old freeware DOS game from the mid-90s called “Achtung, die Kurve!,” although many older players will recognize the gameplay as being similar to the light cycle level in the arcade game Tron, or perhaps even Snake on the Nokia 6110. In Kurve, you control the direction of a pixel that’s drawing a continuous line by using only two keys, one for left and one for right. If at any point you cross a line or hit the edge of the gameplay area, you lose. But the brilliant element that makes it all so much fun is that six people can play at…

If you need to count words or lines of text, calculate checksums and hashes, optimize program code, or perform any other conversion function, you can easily find an online source to do just that. However, you may not want to copy and paste confidential data to a potentially dubious website. Instead, Boop [1], a digital notepad that can be scripted, performs this task locally. The open source program originally developed for macOS supports typing or pasting text via clipboard. At the touch of a button, a variety of predefined scripts or even your own small programs can then be applied to the entered text. This means that all the data stays on your computer, and you can save yourself the trouble of searching for the right utility online. With the…

I subscribe to half a dozen forums for email distribution. Hardly a week goes by without one of them including a complaint about a desktop email client like KMail or Thunderbird. For many, the ultimate solution is to go back to simpler days and install Mutt [1]. Not only does the command-line interface give users full control over the settings, but Mutt’s lack of a prepackaged rendering engine for web browsers or a JavaScript interpreter makes for a smaller attack surface. Another major advantage is its smaller, more consistent memory usage. Mutt was first written by Michael Elkins in 1995. It was based on Elm, another popular command-line email client. Even today, Mutt remains very much a product of its time, often using other applications rather than adding functionality to…

Anyone who has used the World Wide Web (WWW) lately knows that something bad is happening to it. It does not resemble the WWW of the early years, with enthusiastic amateurs freely sharing ideas and information. These things still exist, and the web is still an indispensable medium connecting the world. But the web experience is now encumbered with advertising, invasions of privacy in the form of pervasive tracking, enormous file sizes, CPU straining JavaScript, the danger of exploits, and door slams asking you to subscribe to a newsletter before viewing a site. This unpleasant environment has led to a backlash. There are now some communities of developers and computer users who still desire a connected information system, but who seek a refuge from the noise, danger, and increasingly resource-hungry…

Recent months have seen huge demand for alternative messaging platforms. From Mozilla switching to Matrix, to Facebook’s WhatsApp privacy settings update pushing users to Telegram and Signal. It’s the perfect time for open source platforms to capitalize on renewed interest in decentralized messaging and to help solve the biggest problem they’ve always had – the chicken and egg problem of adoption. But this lack of adoption isn’t always because people don’t know the alternatives exist. It can also be because the alternatives don’t look too good. Signal is a great example because, while it’s undoubtedly one of the best open source messaging solutions, switching to it is a tough ask for the typical WhatsApp user used to seamless device and media integration. Matrix is another platform that can be hard…

There are so many different archiving tools for Linux including the venerable tar, gzip, and xz, and the plucky upstart, zip. Each typically has its own syntax for compressing files and folders into a single file, and conversely, its own syntax for decompressing that single file into one or more of its constituent original parts. Some even separate these functions into separate commands entirely. Of course, it’s common to find graphical tools such as Xarchiver that encapsulate all these functions into a single executable. What isn’t so common is finding a tool that does this across operating systems like PeaZip promises. PeaZip is a graphical desktop archive tool that can extract the contents of over 200 archive types, including all of the above, and many more, on both Linux and…

When it comes to music and audio software, we have several complex and comprehensive applications for sound generation and audio production, but there isn’t much choice when your requirements are simple. One such simple task is triggering specific audio recordings (samples) at specific times. You could press play at the right time in Audacity, or you could set up a sequence of notes in an application like Ardour or Rosegarden. There aren’t, however, many tools designed specifically to do this, although there are sampler plugins that get close. This is almost exactly the use case that hardware samplers were designed to address, and it’s also the use case that the recently rebooted Giada has been designed to address. Giada is a powerful audio file player that makes playing audio files…