Configuring HTTPS on JBoss

Note: We are assuming here that Jboss6.1 and Jdk1.6.0.27 installed in D: drive and server is running on port 8080.

Step: 1. Creating keystore and private key

• Open a command prompt with run as administrator.
• Change directory to D:\jdk1.6.0_27\bin
• Enter below mentioned command with replacing <changeit> to your password as per your choice.

keytool -genkey -alias jbosskey -keypass <changeit> -keyalg RSA –validity 365 -keystore server.keystore

(Eg: keytool -genkey -alias jbosskey -keypass password -keyalg RSA –validity 365 -keystore server.keystore)

• Hit enter.
• Please enter password which you used in first command.
• Retype the same password again.
• What is your first and last name?
  Enter your jboss server DNS name or Alias name as per your choice.
• Enter organizational unit name.
• Enter organization name.
• Enter your city name.
• Enter state name.
• Enter country code.
• Enter Y to Agree.

• You will see “server.keystore” inside D:\jdk1.6.0_27\bin
• Please enter below command for verifying keystore.
  keytool -list -keystore server.keystore
• Enter the password.
• You will see output like below screen shot.
  

Generating and storing the Self sing certificate.

Note: replace <changeit> with your “server.keystore" password which you mentioned during "server.keystore" creation

• Enter following command.

keytool -export -alias jbosskey -keypass <changeit> -file server.crt -keystore server.keystore

Eg: keytool -export -alias jbosskey -keypass password -file server.crt -keystore server.keystore

• You will see “server.crt” inside D:\jdk1.6.0_27\bin

Note: replace <changeit> with your "server.keystore" password which you mentioned during "server.keystore" creation

• Enter following command.

keytool -import -alias jbosscert -keypass changeit -file server.crt -keystore server.keystore

Eg: keytool -import -alias jbosscert -keypass password -file server.crt -keystore server.keystore

Note:You receive a warning that it already exists in the keystore. Ignore it. It is because Java expects separate keystore and trustore files and we are using only one.

• Please enter below command for verifying keystore.
  keytool -list -keystore server.keystore
• Enter the password.
• You should see a TrustedCertEntry named jbosscert in the listing like in below screen shot.

• Copy “server.keystore” from D:\jdk1.6.0_27\bin to D:\jboss6.1\server\default\conf\ folder.

Step: 2. Enable HTTPS for JBoss

• Edit server.xml file using text editor(Recommended notepad++) D:\jboss6.1\server\default\deploy\jbossweb.sar folder
• Search for line SSL/TLS Connector and it will look like as below.

<!-- SSL/TLS Connector configuration using the admin devl guide keystore

<Connector protocol="HTTP/1.1" SSLEnabled="true"

port="${jboss.web.https.port}" address="${jboss.bind.address}"

scheme="https" secure="true" clientAuth="false"

keystoreFile="${jboss.server.home.dir}/conf/chap8.keystore"

keystorePass="rmi+ssl" sslProtocol = "TLS" />

-->

• Uncomment the line, just cut the --> arrow and paste it to first line like shown in below line and edit the code and enter keystore password which you used for creating keystore.

<!-- SSL/TLS Connector configuration using the admin devl guide keystore -->

<Connector protocol="HTTP/1.1" SSLEnabled="true"

port="443" address="${jboss.bind.address}"

scheme="https" secure="true" clientAuth="false"

keystoreFile="${jboss.server.home.dir}/conf/server.keystore"

keystorePass="password" sslProtocol="TLS" />

Step: 3. Enable Re direction from HTTP to HTTPS on JBoss

• Edit server.xml file using text editor(Recommended notepad++) D:\jboss6.1\server\swift\deploy\jbossweb.sar folder
• Search for line A HTTP/1.1 Connector on port 8080 and it will look like as below.

<Connector protocol="HTTP/1.1" port="${jboss.web.http.port}" address="${jboss.bind.address}"

redirectPort="${jboss.web.https.port}" />

• Edit the code as shown in below.

<Connector protocol="HTTP/1.1" port="8080" address="${jboss.bind.address}"

redirectPort="443" />

• Edit web.xml file using text editor(Recommended notepad++) D:\jboss6.1\server\default\deploy\jbossweb.sar folder

• Add the following code at bottom but before </web-app> as show in below.

/<security-constraint>

<web-resource-collection>

<web-resource-name>Protected Context</web-resource-name>

<url-pattern>/*</url-pattern>

</web-resource-collection>

<!-- auth-constraint goes here if you requre authentication -->

<user-data-constraint>

<transport-guarantee>CONFIDENTIAL</transport-guarantee>

</user-data-constraint>

</security-constraint>/

</web-app>

• Restart the Jboss Server; you are done with the configuration Swift server on SSL with redirection.

Installing a Certificate from a Certificate Authority

To obtain and install a Certificate from a Certificate Authority (like verisign.com, thawte.com or trustcenter.de), read the previous section and then follow these instructions:

Create a local Certificate Signing Request (CSR)

In order to obtain a Certificate from the Certificate Authority of your choice you have to create a so called Certificate Signing Request (CSR). That CSR will be used by the Certificate Authority to create a Certificate that will identify your website as "secure". To create a CSR follow these steps:

• Create a local Certificate (as described in the previous section):

·         keytool -genkey -alias tomcat -keyalg RSA \

    -keystore <your_keystore_filename>

Note: In some cases you will have to enter the domain of your website (i.e. www.myside.org) in the field "first- and lastname" in order to create a working Certificate.

• The CSR is then created with:

·         keytool -certreq -keyalg RSA -alias tomcat -file certreq.csr \

    -keystore <your_keystore_filename>

Now you have a file called certreq.csr that you can submit to the Certificate Authority (look at the documentation of the Certificate Authority website on how to do this). In return you get a Certificate.

Importing the Certificate

Now that you have your Certificate you can import it into you local keystore. First of all you have to import a so called Chain Certificate or Root Certificate into your keystore. After that you can proceed with importing your Certificate.

• Download a Chain Certificate from the Certificate Authority you obtained the Certificate from.
  For Verisign.com commercial certificates go to: http://www.verisign.com/support/install/intermediate.html
  For Verisign.com trial certificates go to: http://www.verisign.com/support/verisign-intermediate-ca/Trial_Secure_Server_Root/index.html
  For Trustcenter.de go to: http://www.trustcenter.de/certservices/cacerts/en/en.htm#server
  For Thawte.com go to: http://www.thawte.com/certs/trustmap.html
  
• Import the Chain Certificate into your keystore

·         keytool -import -alias root -keystore <your_keystore_filename> \

    -trustcacerts -file <filename_of_the_chain_certificate>

• And finally import your new Certificate

·         keytool -import -alias tomcat -keystore <your_keystore_filename> \

    -file <your_certificate_filename>

CVS Server Setup Guide

1.0 Introduction

The Concurrrent Versioning System (CVS) has become an integral tool in the development of many software applications. Unfortunately, the process of setting-up the server discourages many from using CVS. This document was written to give a start-to-finish installation and setup of CVS on Red Hat Linux.

Please refer to the documentation provided from the CVS web site if you encounter problems. Also, the FAQ is often very helpful.

http://www.cvshome.org/docs/

http://ccvs.cvshome.org/fom/fom.cgi

2.0 Installation

1. Obtaining the Source Distribution

   The best way to install the latest release of CVS is to obtain the source code and compile CVS.
   To download the source code proceed to the CVS web site: http://www.cvshome.org/
   Navigate to the download page of the CVS web site. There will be a large list of releases but the “stable” release is the one you should download.

2. Configuring and Installing the Source Distribution

   Configuring the source distribution determines what operating system you are using and where the binary files should be installed.
   To get the source distribution onto the CVS server, you can either upload from your machine to the server or download it directly to the server from the CVS website. The later is detailed in following instructions:
   1. Login to the Red Hat Linux server via SSH
   2. su Switch to the root user. Enter the password for the root user when prompted.
   3. cd /usr/local/src Change to the source repository directory.
   4. wget <URL_of_CVS_distribution_file> Download the source distribution. Replace <URL_of_CVS_distribution_file> with the actual URL to download the CVS distribution file.
   5. tar -xzvf cvs-1.xx.tar.gz Decompress and untar the source files. This should create a new directory with a name similar to that of the distribution file containing all the CVS source files. You should briefly review the files “README” and “INSTALL” in the new directory for detailed instructions on configuring and installing CVS.
   6. cd cvs-1.xx Change to the new CVS source directory
   7. ./configure Configure the CVS source for installation. This creates a “make” file to compile the source and install it.
   8. make Compile the CVS binaries.
   9. make install Install the binaries and documentation on the system.

3.0 The Repository

The CVS repository is basically a directory in which all the files and directories under version control are stored. This document covers the bare minimum of what is needed to get the CVS repository up and running. It is recommended that you review the CVS manual (a.k.a the Cederqvist) for more information.

1. Create a New Repository

Create a new “cvs” user with “cvs” as its default group. You must be logged-in as the root user to do this.

groupadd cvs

useradd –g cvs cvs

In addition to adding a new user and group to the Linux system, this should create a new home directory for the user. By default, this is /home/cvs.

Now, login as the “cvs” user and create a new directory for the repository root. You must set the permissions on the repository root to be group writable and set the “set gid flag” so that any files that are added to the repository belong to the “cvs” group. This ensures that users belonging to the “cvs” group will have access to these files.

su cvs

mkdir ~cvs/cvsroot

chmod 0770 ~cvs/cvsroot

chmod g+s ~cvs/cvsroot

Finally to initialize the new repository, execute:

cvs –d ~cvs/cvsroot init

1. Creating a New User for CVS Access

A user has to be a member of the “cvs” group to have access to the new CVS repository. So we must create a new user of the “cvs” group and set its password. You must be logged-in as the root user to do this.

useradd –g cvs brad

passwd brad

Now we must enable CVS to find the repository root when the user executes CVS commands. We can accomplish this by setting the “CVSROOT” environment variable in the user’s profile. Add the following to the user’s .bash_profile (e.g. /home/brad/.bash_profile).

CVSROOT=/home/cvs/cvsroot

umask 006

export CVSROOT

You should now be able to login as the new Linux user and execute CVS commands on the new repository. For example, you could try creating a test module and import it into CVS:

su brad

cd ~

mkdir testmodule

echo “This is a test file.” >> testmodule/test.txt

cvs import –m “Importing test.” testmodule Vendor-1 Release-1

It is recommended that you refer to the Cederqvist CVS manual for more information about running CVS commands.

4.0 Sources

Please refer to the following documentation for further information:

Step-to-step guide to stablish a CVS system

http://www.salleurl.edu/~is04069/Codders/cvspasoapaso.html

Cederqvist CVS Manual

http://www.cvshome.org/docs/manual/

Configuring CVS and CVSUP on Linux

http://www.freeos.com/articles/4608/

We did following steps:

9) Now open file called /etc/services and add the following lines.
Cvspserver 2401/tcp # CVS client/server operations
cvspserver 2401/udp # CVS client/server operations
10) Open file called /etc/xinetd.conf and add the following lines to that file.
service cvspserver
{
Port = 2401
socket_type = stream
protocol = tcp
wait = no
user = root
passenv =
server = /opt/bin/cvs
server_args = --allow-root=/home/cvs -f pserver
env = HOME=/home/cvs
log = /var/log/cvslog
}
11) Space on both sides of = in the above file is a must.
12) Restart xinetd services by running command “ services xinted restart “
13) Check whether CVS is running on the port 2401 by using the following command “nmap 192.168.16.17 |grep 2401”. If the CVS server is running correctly it will give output as “2401/tcp open cvspserver ”.
14) Suppose you want to put my CVS repository at /home/cvs. Then create an environmental variable called CVSROOT which points to /home/cvs.
15) Create the actual repository by the command “cvs -d /home/cvs init”.
16) Create a link to /etc/password to file called passwd.
17) Now go to the client machine and install the Wincvs available from //titan/software/cvs.
18) Open Wincvs window. Go to admin>>preferences.
19) At the ‘Enter CVSROOT’ field enter “:pserver:username@cvsserver_name:/home/cvs”.
20) In the Authentication field select “ password file on cvs server”.
21) Now it is time to create to new modules. In Wincvs client go to Create>>Import module. Select the folder from which you want to create the module.
22) Then in “import settings” dialog box enter the module name as whatever you want. Mention vendor tag and release tag appropriately. You can also give log message that is associated with this module.
23) Now any other client machine access the same modules

How To Install Webmin

Installing the RPM

If you are using the RPM version of webmin, run the command rpm -U webmin-1.270-1.noarch.rpm and the install will be done automatically to /usr/libexec/webmin, the administration username set to root and the password to your current root password. You should now be able to login to Webmin at the URL http://localhost:10000/ .

Installing the tar.gz file

Before downloading Webmin, you must already have Perl5 installed on your system. Perl is usually installed as /usr/local/bin/perl or /usr/bin/perl, and comes as part of most recent versions of Linux. If you don't have Perl, you can download the source from http://www.perl.com/ and compile it for your system. Most operating systems come with Perl these days, so check your operating system CD or website for a package as well.

When unpacked, the distribution creates a subdirectory called webmin-1.270 under the current directory. Since recent versions of Webmin support installation into a directory of your choice, you can pick a destination directory such as /usr/local/webmin. Then run the following commands in the directory containing the webmin-1.270.tar.gz file :

[root@yourhost /tmp]# gunzip webmin-1.270.tar.gz

[root@yourhost /tmp]# tar xf webmin-1.270.tar

[root@yourhost /tmp]# cd webmin-1.270

[root@yourhost /tmp/webmin-1.270]# ./setup.sh /usr/local/webmin

When the setup.sh script is run, it will ask the following questions:

• The Webmin configuration directory
  The directory in which all Webmin configuration information is stored. This is now separate from the Webmin install directory, so that configurations are saved when you upgrade.
  If you have previously installed Webmin and use the same config directory, this will be the only question asked.
  
• The Webmin log directory
  The location for pid and webserver log files.
  
• The full path to perl on your system
  This is usually /usr/bin/perl or /usr/local/bin/perl
  
• Your Operating system type
  In Webmin versions 0.990 and above, this question is only asked if your operating system cannot be automatically determined.
  The setup script will display a list of supported systems. If your OS is not on the list, you can try choosing the closest match. However this may not work properly, and may even cause serious problems!
  
• Web server port
  The TCP port that the Webmin web server will listen on.
  
• Web server login and password
  The login name and password used to acess the Webmin web server.
  
• Web server hostname
  The hostname of the machine on which Webmin will run.
  
• Use SSL
  This question will only be asked if your system has the Perl SSL libraries installed. See below for more..
  
• Start Webmin at boot time
  If your OS is supported, Webmin will ask if you want to have it automatically started at boot time.

Assuming you answer all the above questions correctly, the Webmin web server will be started and the setup script will give you the URL to go to. Enter this URL into your browser, and you will be prompted for the login and password that you choose in setup.sh. Once you have logged in your browser should show the main Webmin page, on which is an icon for each module you have installed.

If you installed Webmin by specifying an installation directory parameter to setup.sh as the instructions above show, the original webmin-1.270 directory can now be safely deleted.

Fedora core Linux password reset

Fedora core Linux

Forgotten root password

1. Reboot your computer.

2. Press key ‘A’ on the keyboard.

3. When you see the following

grub append> ro root=LABEL=/ rhgb

Give space and press key ‘1’ and hit enter key.

4. When you see

sh-2-05b#

Prompt type passwd root and hit enter key.It’ll ask for the new password. Enter the password according to your convenience to remember this.

5. You’ll be asked to re-type the password for verification. Once you’re finished, the password will be changed and you can reboot by typing shutdown –r now at the prompt; then you can log in to root as before.

How To Install VMware Server 2 On An Ubuntu 8.04 Desktop

1 Preliminary Note

I'm using the user name falko with the home directory /home/falko here - please adjust this appropriately.

2 Installing VMware Server

To download VMware Server, go to http://www.vmware.com/products/server/ and click on Download Now:

(JavaScript must be enabled in your browser to view the large image as an image overlay.)

On the next page, log in with your existing VMware account or create a new one:

(JavaScript must be enabled in your browser to view the large image as an image overlay.)

Follow the on-screen instructions. At the end, you should receive an email with a link to your download page. On the download page, you should see two license numbers, one for Windows and one for Linux. Write down or save the one for Linux and scroll down.

(JavaScript must be enabled in your browser to view the large image as an image overlay.)

Then download the VMware Server for Linux TAR image (not the RPM image!) to your desktop (e.g. to /home/falko/Desktop):

(JavaScript must be enabled in your browser to view the large image as an image overlay.)

Then open a terminal (Applications > Accessories > Terminal):

(JavaScript must be enabled in your browser to view the large image as an image overlay.)

Run the following command to install some necessary packages:

sudo apt-get install linux-headers-`uname -r` build-essential xinetd

Then go to the location where you saved the VMware Server .tar.gz file, e.g. /home/falko/Desktop (replace falko with your own username!):

cd /home/falko/Desktop

Unpack the VMware Server .tar.gz file and run the installer:

tar xvfz VMware-server-*.tar.gz
cd vmware-server-distrib
sudo ./vmware-install.pl

The installer will ask you a lot of questions. You can always accept the default values simply by hitting <ENTER>.

When the installer asks you

In which directory do you want to keep your virtual machine files?
[/var/lib/vmware/Virtual Machines]

you can either accept the default value or specify a location that has enough free space to store your virtual machines.

At the end of the installation, you will be asked to enter a serial number:

Please enter your 20-character serial number.

Type XXXXX-XXXXX-XXXXX-XXXXX or 'Enter' to cancel:

Fill in your serial number for VMware Server.

After the successful installation, you can delete the VMware Server download file and the installation directory:

cd /home/falko/Desktop
rm -f VMware-server*
rm -fr vmware-server-distrib/

If you have accepted all default values during the installation, root is now the VMware Server login name. On Ubuntu, root has no password by default, therefore we create a password now:

sudo passwd root

VMware Server 2 does not have a desktop application for managing virtual machines - this is now done through a browser (e.g. Firefox). You can access the management interface over HTTPS (https://<IP ADDRESS>:8333) or HTTP (http://<IP ADDRESS>:8222); the management interface can be accessed locally and also remotely. If you want to access it from the same machine, type https://127.0.0.1:8333 or http://127.0.0.1:8222 into the browser's address bar.

If you're using Firefox 3 and use HTTPS, Firefox will complain about the self-signed certificate, therefore you must tell Firefox to accept the certificate.

Afterwards, you will see the VMware Server login form. Type in root and the password you've just created:

(JavaScript must be enabled in your browser to view the large image as an image overlay.)

This is how the VMware Server web interface looks. The structure is similar to the old VMware Server 1 desktop application, so the usage of the web interface is pretty straightforward.

Linux Files and File Permission

Linux Files and File Permission Linux files are setup so access to them is controlled. There are three types of access: 1. read 2. write 3. execute Each file belongs to a specific user and group. Access to the files is controlled by user, group, and what is called other. The term, other, is used to refer to someone who is not the user (owner) of the file, nor is the person a member of the group the file belongs to. When talking about setting permissions for "other" users to use, it is commonly referred to as setting the world execute, read, or write bit since anyone in the world will be able to perform the operation if the permission is set in the other category. File names and permission characters File names can be up to 256 characters long with "-", "_", and "." characters along with letters and numbers. When a long file listing is done, there are 10 characters that are shown on the left that indicate type and permissions of the file. File permissions are shown according to the following syntax example: drwerwerwe There are a total of 10 characters in this example, as in all Linux files. The first character indicates the type of file, and the next three indicate read, write, and execute permission for each of the three user types, user, group and other. Since there are three types of permission for three users, there are a total of nine permission bits. The table below shows the syntax: 1 2 3 4 5 6 7 8 9 10 File User Permissions Group Permissions Other Permissions Type Read Write Execute Read Write Execute Read Write Execute d r w e r w e r w e

· Character 1 is the type of file: - is ordinary, d is directory, l is link.

· Characters 2-4 show owner permissions. Character 2 indicates read permission, character 3 indicates write permission, and character 4 indicates execute permission.

· Characters 5-7 show group permissions. Character 5=read, 6=write, 7=execute

· Characters 8-10 show permissions for all other users. Character 8=read, 9=write, 10=execute

There are 5 possible characters in the permission fields. They are:

· r = read - This is only found in the read field.

· w = write - This is only found in the write field.

· x = execute - This is only found in the execute field.

· s = setuid - This is only found in the execute field.

· If there is a "-" in a particular location, there is no permission. This may be found in any field whether read, write, or execute field.

Examples

Type "ls -l" and a listing like the following is displayed:

total 10
drwxrwxrwx	4	george	team1	122	Dec 12 18:02	Projects
-rw-rw-rw-	1	george	team1	1873	Aug 23 08:34	test
-rw-rw-rw-	1	george	team1	1234	Sep 12 11:13	datafile

Which means the following:

Type and	# of	Files's	File's	Size in	Date of last	Filename
Permission field	Links	Owner	Group	Bytes	modification
|	|	|	|	|	|	|
drwxrwxrwx	4	george	team1	122	Dec 12 18:02	Projects

The fields are as follows:

1. Type field: The first character in the field indicates a file type of one of the following:

· d = directory

· l = symbolic link

· s = socket

· p = named pipe

· - = regular file

· c= character (unbuffered) device file special

· b=block (buffered) device file special

2. Permissions are explained above.

3. Links: The number of directory entries that refer to the file. In our example, there are four.

4. The file's owner in our example is George.

5. The group the file belongs to. In our example, the group is team1.

6. The size of the file in bytes

7. The last modification date. If the file is recent, the date and time is shown. If the file is not in the current year, the year is shown rather than time.

8. The name of the file.

Set User Identification Attribute

The file permissions bits include an execute permission bit for file owner, group and other. When the execute bit for the owner is set to "s" the set user ID bit is set. This causes any persons or processes that run the file to have access to system resources as though they are the owner of the file. When the execute bit for the group is set to "s", the set group ID bit is set and the user running the program is given access based on access permission for the group the file belongs to. The following command:

chmod +s myfile

sets the user ID bit on the file "myfile". The command:

chmod g+s myfile

sets the group ID bit on the file "myfile".

The listing below shows a listing of two files that have the group or user ID bit set.

-rws--x--x 1 root root 14024 Sep 9 1999 chfn

-rwxr-sr-x 1 root mail 12072 Aug 16 1999 lockfile

The files chfn and lockfile are located in the directory "/usr/bin". The "s" takes the place of the normal location of the execute bit in the file listings above. This special permission mode has no meaning unless the file has execute permission set for either the group or other as well. This means that in the case of the lockfile, if the other users (world execute) bit is not set with permission to execute, then the user ID bit set would be meaningless since only that same group could run the program anyhow. In both files, everyone can execute the binary. The first program, when run is executed as though the program is the root user. The second program is run as though the group "mail" is the user's group.
For system security reasons it is not a good idea to set many program's set user or group ID bits any more than necessary, since this can allow an unauthorized user privileges in sensitive system areas. If the program has a flaw that allows the user to break out of the intended use of the program, then the system can be compromised.

Directory Permissions

There are two special bits in the permissions field of directories. They are:

· s - Set group ID

· t - Save text attribute (sticky bit) - The user may delete or modify only those files in the directory that they own or have write permission for.

Save text attribute

The /tmp directory is typically world-writable and looks like this in a listing:

drwxrwxrwt 13 root root 4096 Apr 15 08:05 tmp

Everyone can read, write, and access the directory. The "t'' indicates that only the user (and root, of course) that created a file in this directory can delete that file.
To set the sticky bit in a directory, do the following:

chmod +t data

This option should be used carefully. A possible alternative to this is

1. Create a directory in the user's home directory to which he or she can write temporary files.

2. Set the TMPDIR environment variable using each user's login script.

3. Programs using the tempnam(3) function will look for the TMPDIR variable and use it, instead of writing to the /tmp directory.

Directory Set Group ID

If the setgid bit on a directory entry is set, files in that directory will have the group ownership as the directory, instead of than the group of the user that created the file.
This attribute is helpful when several users need access to certain files. If the users work in a directory with the setgid attribute set then any files created in the directory by any of the users will have the permission of the group. For example, the administrator can create a group called spcprj and add the users Kathy and Mark to the group spcprj. The directory spcprjdir can be created with the set GID bit set and Kathy and Mark although in different primary groups can work in the directory and have full access to all files in that directory, but still not be able to access files in each other's primary group.
The following command will set the GID bit on a directory:

chmod g+s spcprjdir

The directory listing of the directory "spcprjdir":

drwxrwsr-x 2 kathy spcprj 1674 Sep 17 1999 spcprjdir

The "s'' in place of the execute bit in the group permissions causes all files written to the directory "spcprjdir" to belong to the group "spcprj" .

Examples

Below are examples of making changes to permissions:

chmod u+x myfile	Gives the user execute permission on myfile.
chmod +x myfile	Gives everyone execute permission on myfile.
chmod ugo+x myfile	Same as the above command, but specifically specifies user, group and other.
chmod 400 myfile	Gives the user read permission, and removes all other permission. These permissions are specified in octal, the first char is for the user, second for the group and the third is for other. The high bit (4) is for read access, the middle bit (2) os for write access, and the low bit (1) is for execute access.
chmod 764 myfile	Gives user full access, group read and write access, and other read access.
chmod 751 myfile	Gives user full access, group read and execute permission, and other, execute permission.
chmod +s myfile	Set the setuid bit.
chmod go=rx myfile	Remove read and execute permissions for the group and other.

Below are examples of making changes to owner and group:

chown mark test1	Changes the owner of the file test1 to the user Mark.
chgrp mark test1	Changes the file test1 to belong to the group "mark".

Note: Linux files were displayed with a default tab value of 8 in older Linux versions. That means that file names longer than 8 may not be displayed fully if you are using an old Linux distribution. There is an option associated with the ls command that solves this problem. It is "-T". Ex: "ls al -T 30" to make the tab length 30.

Umask Settings

The umask command is used to set and determine the default file creation permissions on the system. It is the octal complement of the desired file mode for the specific file type. Default permissions are:

· 777 - Executable files

· 666 - Text files

These defaults are set allowing all users to execute an executable file and not to execute a text file. The defaults allow all users can read and write the file.
The permission for the creation of new executable files is calculated by subtracting the umask value from the default permission value for the file type being created. An example for a text file is shown below with a umask value of 022:

666 Default Permission for text file

-022 Minus the umask value

-----

644 Allowed Permissions

Therefore the umask value is an expression of the permissions the user, group and world will not have as a default with regard to reading, writing, or executing the file. The umask value here means the group the file belongs to and users other than the owner will not be able to write to the file. In this case, when a new text file is created it will have a file permission value of 644, which means the owner can read and write the file, but members of the group the file belongs to, and all others can only read the file. A long directory listing of a file with these permissions set is shown below.

-rw-r--r-- 1 root workgrp 14233 Apr 24 10:32 textfile.txt

A example command to set the umask is:

umask 022

The most common umask setting is 022. The /etc/profile script is where the umask command is usually set for all users.
Red Hat Linux has a user and group ID creation scheme where there is a group for each user and only that user belongs to that group. If you use this scheme consistently you only need to use 002 for your umask value with normal users.

Install Webmin on Ubantu

Install Webmin

Webmin is a web-based interface for system administration for Unix. Using any modern web browser, you can setup user accounts, Apache, DNS, file sharing and much more. Webmin removes the need to manually edit Unix configuration files like /etc/passwd, and lets you manage a system from the console or remotely.Currently There is no Webmin package in the Ubuntu repositories.This tutorial will explain how to Install Webmin in Ubuntu Intrepid Ibex

You can install webmin for your server web interface to configure apache2,mysql,FTp servers and many more.Now we will see how to install webmin in Ubuntu 8.10

Preparing your system

First you need to install the following packages

sudo aptitude install perl libnet-ssleay-perl openssl libauthen-pam-perl libpam-runtime libio-pty-perl libmd5-perl

Now download the latest webmin using the following command or from here

wget http://garr.dl.sourceforge.net/sourceforge/webadmin/webmin_1.441_all.deb

Now we have webmin_1.441_all.deb package install this package using the following command

sudo dpkg -i webmin_1.441_all.deb

This will complete the installation.

Ubuntu in particular don’t allow logins by the root user by default. However, the user created at system installation time can use sudo to switch to root. Webmin will allow any user who has this sudo capability to login with full root privileges.

Now you need to open your web browser and enter the following

https://your-server-ip:10000/

Now you should see similar to the following Screen

After login if you want to configure Apache,Mysql server you need to click on Servers on your lefthand side you should many servers are ready to configure

This is very Easy to configure most of the servers and Enjoy your new Ubuntu Intrepid Ibex LAMP Server.

Install VLC Media player in Ubuntu

You need to make sure that you have a “universe” mirror in your /etc/apt/sources.list

sudo apt-get update

sudo apt-get install vlc vlc-plugin-esd

This will complete the installation

If you want to open VLC You need to go to Applications—>Sound&Video—>VLC Media Player

Once it open you should see the following screen

VLC Media Player Version Details

VLC Media Player Skins 2 interface

VLC Media Player Skins

If you want to download VLC Media Player Skins check here

Install VLC Plugin for Mozilla Firefox

sudo apt-get install mozilla-plugin-vlc

Linux Add User To Group

Q. How can I add a user to a group under Linux operating system?

A. You can use useradd or usermod commands to add a user to a group. useradd command creates a new user or update default new user information. usermod command modifies a user account i.e. it is useful to add user to existing group. There are two types of group. First is primary user group and other is secondary group. All user account related information is stored in /etc/passwd, /etc/shadow and /etc/group files to store user information.

useradd example - Add a new user to secondary group

Use useradd command to add new users to existing group (or create a new group and then add user). If group does not exist, create it. Syntax:
useradd -G {group-name} username
Create a new user called deepak and add it to group called developers. First login as a root user (make sure group developers exists), enter:
# grep developers /etc/group
Output:

developers:x:1124:

If you do not see any output then you need to add group developers using groupadd command:
# groupadd developers
Next, add a user called deepak to group developers:
# useradd -G developers deepak
Setup password for user deepak:
# passwd deepak
Ensure that user added properly to group developers:
# id deepakOutput:

uid=1122(deepak) gid=1125(deepak) groups=1125(deepak),1124(developers)

Please note that capital G (-G) option add user to a list of supplementary groups. Each group is separated from the next by a comma, with no intervening whitespace. For example, add user jerry to groups admins, ftp, www, and developers, enter:
# useradd -G admins,ftp,www,developers jerry

useradd example - Add a new user to primary group

To add a user mohan to group developers use following command:
# useradd -g developers mohan
# id mohan

uid=1123(mohan) gid=1124(developers) groups=1124(developers)
Please note that small -g option add user to initial login group (primary group). The group name must exist. A group number must refer to an already existing group.

usermod example - Add a existing user to existing group

Add existing user mohan to ftp supplementary/secondary group with usermod command using -a option ~ i.e. add the user to the supplemental group(s). Use only with -G option :
# usermod -a -G ftp mohan Change existing user mohan primary group to www:
# usermod -g www mohan

How to Add Ubuntu in Windows domain

Install likewise-open in Ubuntu Hardy

sudo aptitude install likewise-open-gui

This will complete the installation.

Adding Ubuntu Desktop to Active Directory Domain

You can do this using two methods using GUI or Using CLI

Using GUI

Applications -> Internet -> Likewise to join my computer to an active directory domain.

The only information we needed for successfully joining the AD domain was

1) The name of the domain to join

2) A domain administrator username and password

Enter that information into the application and lick the “join” button.

In order to log in with a domain account, log out of your current session. Log back in with a domain account
prepended with the domain and a backslash ie. domain\user. Enter the domain user’s password. All home folders for domain users are stored in /home/DOMAIN/username.

Using Command line

sudo domainjoin-cli join fqdn.of.your.domain Administrator

sudo update-rc.d likewise-open defaults

sudo /etc/init.d/likewise-open start

You can now log into your machine using your DOMAIN\user credentials. Remember that the DOMAIN\ part is mandatory and that it represents the short name of your Active Directory domain. You can join the domain using any user with sufficient privileges (there’s no need to use Administrator), and you can even directly join the PC in a particular OU passing the –ou argument to domainjoin-cli.

Remove from the windows Domain

The domainjoin-cli utility can also be used to remove from the domain.

sudo domainjoin-cli leave

Allow Active Directory Domain Administrators to Administer Ubuntu

This will allow members of the Domain Admins AD group to issue sudo commands. From a command prompt

sudo visudo

Add this line to the resulting file

%YOURDOMAINNAME\\domain^admins ALL=(ALL) ALL

save and exit file

Install Avast Antivirus in Ubuntu

First you need to download the .deb package from here

or

wget http://files.avast.com/files/linux/avast4workstation_1.0.6-2_i386.deb

Now you have avast4workstation_1.0.6-2_i386.deb package.Install .deb package using the following command

sudo dpkg -i avast4workstation_1.0.6-2_i386.deb

This will complete the installation now you need to get the registration key for this you need to fill the online form available here and they will send registration key to your mail address

Applications Menu Setup

or this you need to run a script from the following location

cd /usr/lib/avast4workstation/share/avast/desktop

sudo ./install-desktop-entries.sh install

This will complete the application menu setup.

If you want to access you need to go to Applications—>Accessories—>avast!Antivirus

First time it will prompt for license key enter your license key you have got in our previous steps

Avast Antivirus Interface

Avast Antivirus database is updating.If you want to update click on update database

You can select the virus scan here and click on start scan

Avast antivirus version details.

Unable to log in to GUI using root account Fedora

In Fedora Linux root log in is not allowed in GUI by default, if you want to enable the same then please follow below steps.

Step1: Login to Terminal using root account

Step2: Change Directory to /etc/pam.d

            cd /etc/pam.d

Step3: Take back up of two files inside pam.d direcory

           

1. gdm
2. gdm-password

 Note: in Linux it is strongly recommended to take back up of any file before making any changes

Step4: Open file “gdm” using text editor

            vi gdm

Step5: Comment the line "auth required pam_succeed_if.so user != root quiet" by adding a # symbol in the beginning of the line

            #auth required pam_succeed_if.so user != root quiet

            Note: # meant to comment that line so that it won't be considered as an input from that file

Step6: Open file “gdm-password” using text editor

            vi gdm-password

Step7: Comment the line "auth required pam_succeed_if.so user != root quiet" by adding a # symbol in the beginning of the file

            #auth required pam_succeed_if.so user != root quiet

Step8: Congrats you are done, now just log in to GUI as root user J