Archives par mot-clé : Security

A nicer LUKS full disk encryption passphrase prompt in Debian 7 (Wheezy)

Un commentaire

When installing Debian on a new system, if you don’t install Plymouth and you use full disk encryption, the passphrase prompt will come up in a text console which is not very pleasing to the modern eye:

LUKS-text-prompt.png

After much experimentation, I found the Joy theme from the available Plymouth themes provided a much better experience. It was created by Audrien Auburg and adapted from an Edubuntu theme by Jonathan Carter for use with Plymouth. This is an excellent example of Ubuntu functionality brought back into Debian for the benefit of all.

This is how to install such a boot theme in a new Debian system using an Intel graphics chipset:

$ sudo -s
# apt-get install plymouth plymouth-drm

Edit /etc/initramfs-tools/modules and add the modules required for modesetting:

# KMS
intel_agp
drm
i915 modeset=1

Apply the Joy theme and make the changes effective:


# /usr/sbin/plymouth-set-default-theme joy
# update-initramfs -u

And here is the result:

IMG_20130422_132413

If you have another graphics chipset, or if you want more details about setting Plymouth or changing to other themes, check the Debian wiki documentation about Plymouth for more specific instructions.

Also keep in mind this is not very useful on fast SSD-equiped systems: if you don’t use full-disk encryption, the boot sequence is so fast that you won’t see the theme much!

1

Ajenti, another web admin panel

2 commentaires

I just found out about Ajenti, a system management Web UI (released as free open source software under the GPLv3 license), it may be useful to manage desktops and small server setups, as opposed to other projects like Zentyal which do a lot more.

Ajenti

I’ve asked if it’s compatible with Ubuntu 12.04 LTS (which would mean also compatible with Trisquel 6).

Why is this interesting? There are tons of web interfaces out there and vendors of NAS hardware all implement a variation of this. A few years ago when I came across the Franklin Street Statement on Freedom and Network Services I decided that if I was to advocate the use of autonomous, self-hostined/managed services, I should try to Eat my own dog food whenever I could. With this in mind, I kept my eyes open for projects that would not only publish their source code under free open source licenses but also would be easy to implement at home, with consumer hardware, in typical DIY manner – just a bit shy of the current cloud this and cloud that madness.

I’ve been using OpenMediaVault for a couple of small NAS projects, and I love it. It’s based off Debian so I am in familiar territory, I wish this was part of Debian already, I prefer adding such web UIs to existing vanilla installs instead of using a dedicated/modified/derived distribution. I also like its plugins, specially the OpenVPN one, which even generates archives with files and instructions when creating a new access. But aren’t plugins much like packages, optional funcitonality which you should be able to add/remove without bvreaking the system? The main difference is when you have pluggins in such a web UI, such plugins aren’t of Debian-package quality, and introduce yet another layer of software you need to keep an eye on for updates, upgrades, security, etc. Oh, and yet another bug tracker, forum, blog, etc. to follow if you are to get involved.

I’ve always wondered why web UIs like those on OpenWRT or DD-WRT / Tomato are not part of all GNU/Linux distributions, as a separate package. A lot of commercial providers come up with their own too, it all seems like a huge duplication of effort when someone comes up with yet-another-web-ui. Having a common project or interface guidelines would make it easier to use 100% free software on such devices, while having an easy-to-use web interface.

When I researched alternative firmware to use with my DNS-323 Dlink NAS device, I came across Alt-F, yet another one! This motivated me into researching how to install a full distribution on it – eventually Debian was it. It’s very interesting that one can install Debian on several NAS-like devices or specialized hardware, but then you loose the access to a nice (though always different) web interface provided by the vendor.

In many ways it seems sysadmin work and infrastructure management can be done with 100% free software, but what good is it when you have to depend on proprietary interfaces or middleware? I think projects like OpenMediaVault and Ajenti go in the right direction.

What are your favorite Web UI implementations of every-day infrastructure administration tasks?

 

Software Freedom Day tomorrow in Montreal / demain à Montréal

Don’t miss it! À ne pas manquer!

This year I was able to bring two simultaneaous events together, in different locations.

Cette année j’ai pu programmer 2 événements différents, ça se passe demain, à deux endroits différents :).

Les détails à / All details at: http://wiki.softwarefreedomday.org/2011/Canada/Montreal

See you there! À demain!

 

Gobby server in 3 steps

Un commentaire

I was tasked to examine different options for internal collaborative editing in a small project, for only a few documents and even fewer people.

I knew there was a Gobby server in Ubuntu but didn’t know it was this easy to setup. I quickly found out about Gobby-Infinote (Gobby using the new Infinote protocol) and Infinoted (server). It was really nice to be able to go to the #infinote channel on Freenode and ask questions one-on-one to the actual developpers and validate my tests! Thank you!

From Gobby’s website:

Gobby is a free collaborative editor supporting multiple documents in one session and a multi-user chat. It runs on Microsoft Windows, Mac OS X, Linux and other Unix-like platforms.

I performed my tests on an Ubuntu 9.10 64-bit desktop.

  1. On all client systems, install the gobby-infinote package
  2. Then on the server system, install the infinoted package
  3. Once the server is installed, either:
  • If you trust your local network and don’t want any security, launch the server using: 
    infinoted --security-policy=no-tls

    or

  • If you’d rather have encryption, TLS is available. Use: 
    infinoted --create-key --create-certificate -k key.pem  -c cert.pem

The keys creation is automatic, and you can launch the server just using:

infinoted -k key.pem  -c cert.pem

You can also specify such options in ~/.config/infinoted.conf as noted on Infinoted’s wiki (which I plan to update with some of my notes). I am not sure yet what’s best to start the server automatically at system’s startup, I am told upstart should handle this. I’ll probably file a bug or investigate that further later.

Of course your server system can be a desktop, and you can run Gobby from that same system. Once installed clients should go to Accessories > Internet > Gobby Collaborative Editor (0.5).

You will also need to install avahi-daemon so the Infinote Gobby server availability is advertised through your local network and it’s shown among possible choices in your Gobby clients.

If you have setup TLS and you double click one of the available servers that use it, you will be presented a warning as you have a self-signed certificate:

The « other » Gobby in Ubuntu is a previous, stable version (package: gobby). Its server companion, sobby, is not the focus of current development efforts.

The main differences I found are:

  • Optional TLS encryption
  • Undo ability (which required rewriting the sync protocol)
  • Interface improvements
  • Ability to delete files
  • Folder hierarchy creation now possible
  • Graceful recovery & offer to save when the server « disappears » or when someone deletes a file
  • Zeroconf support – so the server « advertises » itself on a LAN, no more IP/port info needed

The current client version in Karmic is 0.4.92 but 0.4.93 is already in Lucid and 0.4.94 is looing up.

Find out more here: