Testing compiz-fusion on debian

My system:
debian lenny

Installation:
apt-get install compiz-fusion-kde
apt-get install compiz-fusion-gnome

Optional packages:
apt-get install compiz-fusion-plugins-unsupported
apt-get install compiz-fusion-plugins-extra
apt-get install compiz-fusion-icon

Above commands install kde and gnome-specific compiz-fusion backends and all other packages will be automatically installed depending on dependencies. To start compiz-fusion for KDE, go to System -> Compiz Fusion Icon.

Repo:
Put this in /etc/apt/sources.list
deb http://download.tuxfamily.org/shames/debian-etch/desktopfx/stable/ ./

Some screenshots:

Upgrading gcc to upgrade clamav to 0.92

I have problem upgrading my clamav 0.91.2 to 0.92 due to bug in gcc 4.0.1 on my Mandriva 2006. So I upgraded my gcc to 4.1.2. I chose to compile from source. It is advisable to refer to successful builds pertaining to the version of gcc to get a clue whether it will successfully build on your target system. I didn't choose later version because I couldn't find any successful build for my system. So I played safe. :P

Download: GNU gcc 4.1.2 (China Mirror)

You have to download at least gcc-core-4.1.2.tar.bz2 and gcc-4.1.2.tar.bz2. I also downloaded gcc-g++-4.1.2.tar.bz2, and gcc-objc-4.1.2.tar.bz2. I didn't download the others because I didn't need them. You may want to download them depends on your requirement.

Untar the tarballs
tar xjvf gcc-core-4.1.2.tar.bz2
tar xjvf gcc-4.1.2.tar.bz2
tar xjvf gcc-g++-4.1.2.tar.bz2
tar xjvf gcc-objc-4.1.2.tar.bz2

The above commands will untar the tarballs into a dir that is gcc-4.1.2. Then, as usual, run ./configure, make and make install. Before you run ./configure, please run ./configure --help to view what parameters needed. Some of the options are autodetected and included by configure itself (ie c/c++ libraries,headers ,etc).

configure
./configure --prefix=/usr --sysconfdir=/etc --localstatedir=/var

then you can run make and make install to install it to your system. clamav 0.92 will be successfully compiled with this version of gcc.

UPDATE: Reported that gcc < 4.0 can compile clamav 0.92 successfully. So you don't need to upgrade if you use that version of gcc. Also reported that using the 'buggy' gcc, one can use -O0 as optimization flag to avoid the bug.

upgrading clamav from source
Please read my article here. The steps are still the same.

Good luck!

Converting phpBB2 to phpBB3

phpBB is my favorite bulletin board system. After 4 years running on phpBB2, I tried to convert my board to phpBB3 RC7 (this is the latest at the time of writing). My phpBB2 version was 2.0.21. I read many in phpBB community forums, many people had some kinds of problem in conversion with the built-in convertor. I tried it myself and failed for 3 times. The problem was connection timed-out during conversion. Googling a bit, I found a solution. Thanks for the problem solver. You are a hero!. :-) Check it out here. This is how I did it:

Open phpbb3/install/install_convert.php

Find these lines:

/**
*
* @package install
* @version $Id: install_convert.php,v 1.53 2007/10/11 08:12:25 acydburn Exp $
* @copyright (c) 2006 phpBB Group
* @license http://opensource.org/licenses/gpl-license.php GNU Public License
*
*/

/**
*/

After those lines, add:

@set_time_limit(0);
@ini_set('memory_limit', '256M');
@ini_set('upload_max_filesize', '128M');
@ini_set('post_max_size', '256M');
@ini_set('max_input_time', '-1');
@ini_set('max_execution_time', '-1');
@ini_set('expect.timeout', '-1');
@ini_set('default_socket_timeout', '-1');

(Adjust timeouts and size as needed.)

Next find:

var $batch_size = 2000;

Change to:

var $batch_size = 6000;

It worked for me. I hope this benefits others. Good luck! :-)

apt-get: dynamic MMAP out of room

Recently after upgrading wine and a few other packages, apt-get threw errors like these:

Reading package lists... Error!
E: Dynamic MMap ran out of room
E: Error occurred while processing libedataserverui1.2-6 (NewFileVer1)
E: Problem with MergeList /var/lib/dpkg/status
E: The package lists or status file could not be parsed or opened.

I also could not use apt-cache and it threw the same error messages. The solution is just one-liner:

APT::Cache-Limit 12582912;

put that line in /etc/apt/apt.conf . It solved the problem at least for me. :-)

If it still hasn't solved the problem, try increasing the cache-limit value.

fail2ban - Yet another tool to protect your server

What is Fail2ban?

Fail2ban scans log files like /var/log/auth.log or /var/log/apache/error_log and bans IP that makes too many password failures. It updates firewall rules to reject the IP address. These rules can be defined by the user. Fail2ban can read multiple log files such as sshd or Apache web server ones. You need python >= 2.3, gamin >= 0.0.21 (optional) and one of these : iptables, shorewall or tcpwrapper.

What does the version number of Fail2ban mean?

The structure of the version number is major.minor.revision. Currently the major number is 0. The policy for minor is:

• odd numbers (0.5, 0.7, etc) are development versions.
• even numbers (0.6, 0.8, etc) are stable versions.

Fail2ban is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version.

Where can I get it?

fail2ban source can be downloaded from here. Distro-specific packages can be downloaded from http://www.fail2ban.org/wiki/index.php/Downloads. You might want to try using package manager first. It might be in your distros repositories. Chances are it is the older version. That's why I like to install from source :). For debianista, apt-get install fail2ban will take care of it.

Installation

As of this writing, the latest version is 0.8.1.
1. Extracting : tar xjvf fail2ban-0.8.1.tar.bz2
2. cd fail2ban-0.8.1
3. python setup.py install

This will install Fail2Ban into /usr/share/fail2ban. The executable scripts are placed into /usr/bin.

Fail2Ban should be correctly installed now. Just type:

fail2ban-client -h

to see if everything is alright. You should always use fail2ban-client and never call fail2ban-server directly. UPDATE: to be able to activate and control fail2ban server, you need to copy init file specific for your distro in fail2ban-0.8.1/files directory. For Mandriva, you can use RedHat one. Copy file redhat-initd to /etc/init.d directory :

cp redhat-initd /etc/init.d/fail2ban

There are also init files for SuSe and Gentoo.

Configuration

1. Edit file /etc/fail2ban/fail2ban.conf using your favorite editor. I used joe for it. So:

cd /etc/fail2ban
joe fail2ban.conf

In this file, you may want to increase the loglevel to 4 for more verbose log for troubleshooting purposes.

2. Edit file /etc/fail2ban/jail.conf
joe jail.conf

In this file, uncomment sections that you want to activate and change enabled = false to enabled = true. Say, you want fail2ban to monitor port 22 (ssh) for login attempts :

[ssh-iptables]
enabled = true
filter = sshd
action = iptables[name=SSH, port=ssh, protocol=tcp]
# sendmail-whois[name=SSH, dest=you@mail.com, sender=fail2ban@mail.com]
logpath = /var/log/auth.log
maxretry = 4

There are many sections in there for monitoring other ports like ftp, http, etc. It's up to you to monitor which ports. Just uncomment the sections you want and change enabled = true to activate in those sections. If you want to be notified, uncomment the commented line above and replace your email address for dest (and for sender too to reflect your system mails). I change the log path to /var/log/auth.log because this is the authentication log for my system. Change it accordingly for your system. All fail2ban actions are logged and can be reviewed by tail /var/log/fail2ban.log. Example of fail2ban.log on my system:

-- START --
2007-10-26 00:24:56,880 fail2ban.filter : DEBUG /var/log/auth.log has been modified
2007-10-26 00:24:56,880 fail2ban.filter : DEBUG Opened /var/log/auth.log
2007-10-26 00:24:56,881 fail2ban.filter : DEBUG Setting file position to 783921 for /var/log/auth.log
2007-10-26 00:24:56,882 fail2ban.filter : DEBUG Found 200.32.73.4
2007-10-26 00:24:56,883 fail2ban.filter : DEBUG Found 200.32.73.4
2007-10-26 00:24:56,883 fail2ban.filter.datedetector: DEBUG Sorting the template list
2007-10-26 00:24:57,868 fail2ban.actions: WARNING [ssh-iptables] Ban 200.32.73.4
2007-10-26 00:24:57,868 fail2ban.actions.action: DEBUG iptables -n -L INPUT | grep -q fail2ban-SSH
2007-10-26 00:24:57,886 fail2ban.actions.action: DEBUG iptables -n -L INPUT | grep -q fail2ban-SSH returned successfully
2007-10-26 00:24:57,886 fail2ban.actions.action: DEBUG iptables -I fail2ban-SSH 1 -s 200.32.73.4 -j DROP
2007-10-26 00:24:57,891 fail2ban.actions.action: DEBUG iptables -I fail2ban-SSH 1 -s 200.32.73.4 -j DROP returned successfully
2007-10-26 00:26:57,873 fail2ban.filter : DEBUG /var/log/auth.log has been modified
2007-10-26 00:26:57,873 fail2ban.filter : DEBUG Opened /var/log/auth.log
2007-10-26 00:26:57,874 fail2ban.filter : DEBUG Setting file position to 784190 for /var/log/auth.log
2007-10-26 00:26:57,875 fail2ban.filter.datedetector: DEBUG Sorting the template list
2007-10-26 00:34:58,860 fail2ban.actions: WARNING [ssh-iptables] Unban 200.32.73.4
2007-10-26 00:34:58,860 fail2ban.actions.action: DEBUG iptables -n -L INPUT | grep -q fail2ban-SSH
2007-10-26 00:34:58,867 fail2ban.actions.action: DEBUG iptables -n -L INPUT | grep -q fail2ban-SSH returned successfully
2007-10-26 00:34:58,867 fail2ban.actions.action: DEBUG iptables -D fail2ban-SSH -s 200.32.73.4 -j DROP
2007-10-26 00:34:58,872 fail2ban.actions.action: DEBUG iptables -D fail2ban-SSH -s 200.32.73.4 -j DROP returned successfully
2007-10-26 06:07:39,998 fail2ban.filter : DEBUG /var/log/auth.log has been modified
2007-10-26 06:07:39,998 fail2ban.filter : DEBUG Opened /var/log/auth.log
2007-10-26 06:07:39,999 fail2ban.filter : DEBUG Setting file position to 784279 for /var/log/auth.log
2007-10-26 06:07:40,000 fail2ban.filter.datedetector: DEBUG Sorting the template list
2007-10-26 11:23:50,076 fail2ban.filter : DEBUG /var/log/auth.log has been modified
2007-10-26 11:23:50,087 fail2ban.filter : DEBUG Opened /var/log/auth.log
2007-10-26 11:23:50,116 fail2ban.filter : DEBUG Setting file position to 784372 for /var/log/auth.log
2007-10-26 11:23:50,123 fail2ban.filter.datedetector: DEBUG Sorting the template list
-- End--

As you can see above, there's IP being banned by fail2ban by way of iptables and after a period of time, it will be unbanned. All these can be modified in /etc/fail2ban/jail.conf

To see whether the actions really happen, see iptables rules:

iptables -L -n

Chain INPUT (policy ACCEPT)
target prot opt source destination
fail2ban-SSH tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:22
REJECT all -- 85.185.250.20 0.0.0.0/0 reject-with icmp-port-unreachable

Chain FORWARD (policy ACCEPT)
target prot opt source destination

Chain OUTPUT (policy ACCEPT)
target prot opt source destination

Chain fail2ban-SSH (1 references)
target prot opt source destination
RETURN all -- 0.0.0.0/0 0.0.0.0/0

Please read the documentations in the tarball for latest updates and on how to configure it. With fail2ban, it is another weapon for system administrators to combat brute-force attacks. Enjoy :)

apt-get remove Fedora; apt-get install Debian

After giving a thought about possibility of converting my Fedora box to Debian,yesterday morning, with DVD I got from LFY, I gave it a try. Why? I fed-up with problems like crippled mp3 support (for obvious reason for a pure OSS distro),slow and error-prone yum and problem with incompatible and conflicted packages from 3rd-party repositories. My journey with Fedora has ended. Maybe I'll meet her again in the future :). We'll see.

Debian 4.0 aka Etch
Installation went smooth in text mode. It took longer as I was expecting because without my knowledge,I opted to download updates from internet during installation. There was a flaw when I tried installing LILO boot loader. The installer said it failed to install. I opted to continue and after rebooting, the boot loader was fine. GNOME was the default Window Manager installed when I select the Desktop installation but as usual, with beloved apt-get, I could install other window managers too.

Some basic commands
apt-get update <--- find new updates if any. apt-get install package_name <--- install a package. Dependencies will be taken care of. apt-get --reinstall install package_name <--- reinstall a package. apt-get remove package_name <--- uninstall a package but the config files remain intact. apt-get --purge remove package_name <--- completely uninstall a package. apt-get -u dist-upgrade <--- completely upgrade the whole distribution to the latest. dpkg -i package_name.deb <-- install a local package apt-get reminds me of slapt-get in Slackware world. slapt-get got the idea from this excellence apt-get.


A few confusing matters
Firstly, I couldn't see Firefox in GNOME or KDE menu. So I fired up apt-get. To my surprise, it had been installed. I found out that it had been 'rebranded' to IceWeasel. What a name? More info on this matter can be read here.

Secondly, I couldn't find pidgin. Instead, the old GAIM was installed. After googling, pidgin could be installed by downloading from here.

The experience so far is good. It has its share of Ubuntu which is one of my favorite distro too. I like the responsiveness of KDE and GNOME. It seems quicker than on Fedora and of course, apt-get is a lot quicker than yum.

Compiz on Slackware

I installed Slackware 12.0 on an old laptop (P3 , 256 MB RAM). This laptop has no CDROM and No Floppy drive. I installed it using PXEBOOT install method introduced in Slackware 12.0. It means, I have to boot from network card to get Slackware's installer running (Disk 1). Installing packages can be done using NFS. I'll story about that next time. :-)

The laptop's vga is i830M. I can use whether i810 or intel for the driver of xorg. To run compiz was a bit tricky for this chipset. After googling for awhile, I managed to get it running good. Your mileage may vary though.

Command to run compiz :
LIBGL_ALWAYS_INDIRECT=true compiz --replace ccp && emerald &

Note : emerald is the window decorator I have chosen to run. There are other window decorators but emerald is one of the famous.